漏洞描述
存在/AJAX/ajaxget接口可以非授权访问，通过ajaxmsg搭配功能函数可以调用读取一些敏感信息
版本：
<=MagicR100V100R005
<=MagciR100V200R00
漏洞分析与复现
一、固件获取和解包
虽然我有物理机，但是我还是从官网下的更新固件包，https://download.h3c.com.cn/download.do?id=3342938
通过binwalk R100V100R100进行解包,发现可以直接查看到内容，
ZHEFOX@ZHEFOX-MacOS:~/Desktop$ binwalk R100V100R005.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
33280 0x8200 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4145728 bytes
1245184 0x130000 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2269691 bytes, 534 inodes, blocksize: 131072 bytes, created: 2018-01-17 03:54:08
使用binwalk -eM R100V100R100进行提取
ZHEFOX@ZHEFOX-MacOS:~/Desktop$ binwalk -eM R100V100R005.bin
Scan Time: 2022-03-31 19:12:49
Target File: /home/ZHEFOX/Desktop/R100V100R005.bin
MD5 Checksum: 42ec9ec3de32216ae2d93ad1ff3a208b
Signatures: 411
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
33280 0x8200 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4145728 bytes
WARNING: Symlink points outside of the extraction directory: /home/ZHEFOX/Desktop/_R100V100R005.bin.extracted/squashfs-root/web -> /var/web; changing link target to /dev/null for security purposes.
WARNING: Symlink points outside of the extraction directory: /home/ZHEFOX/Desktop/_R100V100R005.bin.extracted/squashfs-root/dev/log -> /var/tmp/log; changing link target to /dev/null for security purposes.
1245184 0x130000 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2269691 bytes, 534 inodes, blocksize: 131072 bytes, created: 2018-01-17 03:54:08
Scan Time: 2022-03-31 19:12:51
Target File: /home/ZHEFOX/Desktop/_R100V100R005.bin.extracted/8200
MD5 Checksum: 4b2d56fb09ee2c3feafac6513c01f7c6
Signatures: 411
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0xFB26C18E, created: 2018-01-17 03:51:29, image size: 4145664 bytes, Data Address: 0x80001000, Entry Point: 0x800044B0, data CRC: 0x9E4BD9D4, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: none, image name: "Linux Kernel Image"
3194976 0x30C060 Linux kernel version 2.6.30
3260544 0x31C080 CRC32 polynomial table, little endian
3274176 0x31F5C0 SHA256 hash constants, big endian
3281920 0x321400 CRC32 polynomial table, big endian
3475335 0x350787 Neighborly text, "neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)"
3477803 0x35112B HTML document header
3477966 0x3511CE HTML document footer
3666048 0x37F080 AES S-Box
3974025 0x3CA389 Microsoft executable, MS-DOS
4145216 0x3F4040 ASCII cpio archive (SVR4 with no CRC), file name: "/dev", file name length: "0x00000005", file size: "0x00000000"
4145332 0x3F40B4 ASCII cpio archive (SVR4 with no CRC), file name: "/dev/console", file name length: "0x0000000D", file size: "0x00000000"
4145456 0x3F4130 ASCII cpio archive (SVR4 with no CRC), file name: "/root", file name length: "0x00000006", file size: "0x00000000"
4145572 0x3F41A4 ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
成功提取后，进入发现是squashfs架构，在squashfs-root发现了www目录，跟进发现是一个asp网站
二、漏洞实现和分析
曾经在攻击该接口时，因为无法改参数无法实现RCE，但是我还在思考到会不会这个接口可以有别利用前途呢，我将服务器的http的binary丢入IDA进行分析查阅。
366: function AjaxGetWan1State()
367 {
368 XMLHttpReqtmp = createXMLHttpRequest();
369 if (XMLHttpReqtmp)
370 {
371: var url = "AJAX/ajaxget";
372 var msg="ajaxmsg=aspGetGroup(Wan1BasicState)";
373 XMLHttpReqtmp.open("POST", url, true);
...
385 {
386 XMLHttpReq=null;
387: setTimeout("AjaxGetWan1State();",2000);
388 }
389 else
...
399 if (XMLHttpReq)
400 {
401: var url = "AJAX/ajaxget";
402 var msg="ajaxmsg=aspGetGroup(Wan1Ping)";
403 XMLHttpReq.open("POST", url+"?IsVersionCheck=1", true);
通过已知的可利用接口在IDA直接搜索字符串，并追踪。
交叉引用继续跟进，
发现存在很多的接口，这些都是可以调用的函数方法，可以通过此处打印出一些信息，初步尝试打印出了系统的日志文件。
在观察和不断读取泄露信息时，发现了自己的宽带账号和密码！！！
POC：
————————————————————————————————— 获取宽带账号 ———————————————————————————————————
POST /AJAX/ajaxget HTTP/1.1
Host: 192.168.124.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36 Edg/99.0.1150.55
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 78430
Origin: http://192.168.124.1
Connection: close
Referer: http://192.168.124.1/AJAX/ajaxget
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
ajaxmsg=#####此处因为涉及真机，暂时不公开exp######
———————————————————————————————————获取宽带密码————————————————————————————————————
POST /AJAX/ajaxget HTTP/1.1
Host: 192.168.124.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36 Edg/99.0.1150.55
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 78430
Origin: http://192.168.124.1
Connection: close
Referer: http://192.168.124.1/AJAX/ajaxget
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
ajaxmsg=#####此处因为涉及真机，暂时不公开exp######
end
招新小广告
ChaMd5 Venom 招收大佬入圈
新成立组IOT+工控+样本分析 长期招新
原文始发于微信公众号（ChaMd5安全团队）：新华三magicR100存在未授权访问
