注：本文中提到的漏洞验证 poc 或工具仅用于授权测试，任何未经授权的测试均属于非法行为。任何人不得利用本文中的技术手段或工具进行非法攻击和侵犯他人的隐私和财产权利。一旦发生任何违法行为，责任自负。
HTTP/1.1200OKServer: nginx/1.22.1Date: Wed, 14 Jun 2023 13:23:43 GMTContent-Type: application/jsonContent-Length: 47114Connection: closeX-Frame-Options: DENYVary: CookieX-Content-Type-Options: nosniffReferrer-Policy: same-originSet-Cookie: sessionid=7jx0s7b5jyrvecvam2iazqjzox44t0pe; expires=Wed, 28 Jun 2023 13:23:43 GMT; HttpOnly; Max-Age=1209600; Path=/; SameSite=Lax{"code":0,"data": {"ID":1,"NAME":"u7ba1u7406u5458","USERNAME":"admin","PASSWORD":"cfcd208495d565ef66e7dff9f98764da","OID":2,"OCODE":null,"ONAME":"u603bu52a1u5904","MOID":2,"MOCODE":null,"MONAME":"u603bu52a1u5904","MRID":null,"MRNAME":null,"TYPE_CODE":null,"TYPE_NAME":null,"POSITION":null,"ACADEMIC":"u9ad8u7ea7u5de5u7a0bu5e08","ACADEMIC_LEVEL":"10","EDUCATION":"u535au58ebu540e","DEGREE":"u535au58eb","DRG_STUDING":0,"SCHOOL":null,"MAJOR":null,"POLITICS":"u4e2du5171u515au5458","SUBJECT":null,"DIS_ID1":95,"DISCIPLINE1":"u5730u7403u79d1u5b66","DIS_ID2":104,"DISCIPLINE2":"u5730u8d28u5b66","DIS_ID3":null,"DISCIPLINE3":null,"HONORARY":null,"BIRTHDAY":"2022-06-24","GENDER":"1","CARDNO":null,"ADDRESS":null,"POSTCODE":null,"TELEPHONE":null,"MOBILE":"12313124553532","EMAIL":null,"QQ":null,"WEIXIN":null,"SIGNATURE":null,"PHOTO":null,"BANK_INFO":null,"TOKEN":null,"STATUS":null,"WORK_TYPE":null,"LOGIN_TIMES":null,"LOGIN_IP":"127.0.0.1","LOGIN_TIME":"2022-12-12T13:53:41","LOGIN_BROWSER":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36","CODE":null,"SPEC":null,"ADDSRC":null,"NATION":null,"WEIXIN_OPENID":null,"SFZ":null,"PT_USER_ID":null,"JOID":null.....}
直接放包即可进入管理员权限页面，获取超管权限。
还有后续，下次再给大家叙述。
原文始发于微信公众号（扫地僧的茶饭日常）：【渗透实战】记一次针对一个edu厂商的相爱相杀（二）
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论