¡¾·ì϶¹«¸æ¡¿MiniWeb HTTP Server ÎļþÉÏ´«·ì϶(CVE-2013-10047)

°ä²¼¹¦·ò 2025-08-04

Ò»¡¢·ì϶¸ÅÊö


·ìϼûû³Æ

MiniWeb HTTP Server ÎļþÉÏ´«·ì϶

CVE   ID

CVE-2013-10047

·ì϶ÀàÐÍ

δÊÚȨÎļþÉÏ´«

·¢ÏÖ¹¦·ò

2025-08-04

·ì϶ÆÀ·Ö

9.3

·ì϶µÈ¼¶

ÑϳÁ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ÀûÓÃÄѶÈ

µÍ

Óû§½»»¥

²»±ØÒª

PoC/EXP

Òѹ«¿ª

ÔÚÒ°ÀûÓÃ

δ·¢ÏÖ


MiniWeb HTTP Server ÊÇÒ»¿îÇáÁ¿¼¶µÄ¿ªÔ´ Web ·þÎñÆ÷£¬£¬£¬£¬£¬£¬Ö¼ÔÚÌṩ¸ßЧ¡¢¼ò½àµÄ HTTP ·þÎñ¡£¡£¡£¡£¡£ËüÖ§³Ö¸ù»ùµÄ Web ÒªÇó´¦Ö㬣¬£¬£¬£¬£¬ºÏÓÃÓÚǶÈëʽÉ豸ºÍ×ÊÔ´ÊÜÏ޵Ļ·¾³¡£¡£¡£¡£¡£MiniWeb ÓµÓнÏÓ×µÄÄÚ´æÕ¼Óúͼ±¾çµÄÏìÓ¦Ëٶȣ¬£¬£¬£¬£¬£¬ÊʺÏÓÃ×÷Ó×ÐÍÍøÕ¾»ò IoT É豸µÄ Web ·þÎñ¡£¡£¡£¡£¡£


2025Äê8ÔÂ4ÈÕ£¬£¬£¬£¬£¬£¬8827Ì«Ñô¼¯Íż¯ÍÅVSRC¼à²âµ½MiniWeb HTTP Server ¡Ü Build 300ÖеÄÒ»ÏîÑϳÁ·ì϶£¬£¬£¬£¬£¬£¬ÔÊÐíδ¾­Éí·ÝÑéÖ¤µÄÔ¶³Ì¹¥»÷ÕßÉÏ´«ËÁÒâÎļþ¡£¡£¡£¡£¡£¹¥»÷Õß¿Éͨ¹ýõ辶±éÀú·ì϶ÉÏ´«¶ñÒâ.exeÎļþÖÁϵͳĿ¼£¨ÈçSystem32£©£¬£¬£¬£¬£¬£¬²¢½øÒ»²½ÉÏ´«.mofÎļþÖÁWMIĿ¼£¬£¬£¬£¬£¬£¬ÀûÓÃWindowsÖÎÀí¹¤¾ß·þÎñÒÔSYSTEMȨÏÞÖ´ÐжñÒâ´úÂë¡£¡£¡£¡£¡£¸Ã·ì϶½öÓ°ÏìWindows Vista֮ǰµÄ°æ±¾¡£¡£¡£¡£¡£·ì϶ÆÀ·Ö9.3·Ö£¬£¬£¬£¬£¬£¬·ì϶¼¶±ðÑϳÁ¡£¡£¡£¡£¡£


¶þ¡¢Ó°ÏìÁìÓò


Miniweb Http Server <= Build 300£¬£¬£¬£¬£¬£¬½öÓ°ÏìWindows Vista֮ǰµÄ°æ±¾¡£¡£¡£¡£¡£


Èý¡¢°²È«´ëÊ©


3.1 Éý¼¶°æ±¾


ÏÞ¶ÈÉÏ´«ÎļþÀàÐÍ£º²»ÈÝÉÏ´«.exe, .mofµÈ¿ÉÖ´ÐÐÎļþºÍ¾ç±¾Îļþ£¬£¬£¬£¬£¬£¬Ö»ÔÊÐíÉÏ´«·ÇÖ´ÐÐÎļþ£¨Èç.jpg, .pngµÈ£©¡£¡£¡£¡£¡£
õ辶±éÀú·À»¤£º¶ÔÉÏ´«µÄÎļþõ辶½øÐÐÑϸñУÑ飬£¬£¬£¬£¬£¬È·±£ÎļþÎÞ·¨Í¨¹ýõ辶±éÀú£¨Èç../£©ÉÏ´«µ½ÏµÍ³Ãô¸ÐĿ¼¡£¡£¡£¡£¡£¿£¿£¿£¿£Äܹ»Ê¹Óù̶¨Ä¿Â¼Ï޶Ȼòõ辶¹æ·¶»¯»úÔì¡£¡£¡£¡£¡£
¼ÓÇ¿Îļþ´æ´¢ÖÎÀí£º½«ÉÏ´«Îļþ´æ´¢ÔÚ¸ôÀëĿ¼ÖУ¬£¬£¬£¬£¬£¬²¢È·±£¸ÃĿ¼²»³ÉÖ´ÐУ¬£¬£¬£¬£¬£¬Ô¤·ÀÎļþ±»ÎóÖ´ÐС£¡£¡£¡£¡£³ö¸ñÊÇÔÚsystem32ºÍwbemµÈϵͳĿ¼ÖУ¬£¬£¬£¬£¬£¬²»ÈÝÎļþдÈë¡£¡£¡£¡£¡£
ÈÕÖ¾¼Í¼ÓëÉó¼Æ£º¼ÓÇ¿ÎļþÉÏ´«²Ù×÷µÄÈÕÖ¾¼Í¼£¬£¬£¬£¬£¬£¬²¢¶¨ÆÚÉó¼ÆÉÏ´«¼Ç¼£¬£¬£¬£¬£¬£¬ÊµÊ±·¢ÏÖ²¢ÏìӦDZÔڵĶñÒâÎļþÉÏ´«ÐÐΪ¡£¡£¡£¡£¡£


3.2 һʱ´ëÊ©


ÔÝÎÞ¡£¡£¡£¡£¡£


3.3 ͨÓý¨Òé


?¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¡£¡£¡£¡£¬£¬£¬£¬£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬£¬£¬£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£¡£¡£¡£
?¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÔ죬£¬£¬£¬£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬£¬£¬£¬£¬¹Ø¹Ø·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬£¬£¬£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬£¬£¬£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£¡£¡£¡£
?ʹÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£¡£¡£¡£
?¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÔìºÍ×îÓ×ȨÏÞ×¼Ôò£¬£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£
?ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/miniweb_upload_wbem.rb
https://www.exploit-db.com/exploits/27607