记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

万户ezOFFICE无限制任意文件上传可getshell3(7处打包)

2014-09-05 22:50

1、

defaultroot/public/editor/tpsc.jsp

2、

defaultroot/public/editor/1_tpsc.jsp

3、

defaultroot/work_flow/formOptJSPUpload.jsp (上传后路径:/defaultroot/work_flow/文件名)

4、

defaultroot/work_flow/formStartJSPUpload.jsp(上传后路径:/defaultroot/work_flow/文件名)

5、

http://oa.polyfilm.net:7001/defaultroot/govezoffice/custom_documentmanager/smartUpload.jsp?path=innerMailbox&fileName=innerMailFileName&saveName=innerMailSaveName&tableName=innerMaildisplaytable&fileMaxSize=0&fileMaxNum=0&fileType=&fileMinHeight=0&fileMinWidth=0&fileMaxHeight=0&fileMaxWidth=0

6、

http://hljxwjtheb.vicp.cc:7001/defaultroot/custom_form/smartUpload.jsp?path=innerMailbox&fileName=innerMailFileName&saveName=innerMailSaveName&tableName=innerMaildisplaytable&fileMaxSize=0&fileMaxNum=0&fileType=&fileMinHeight=0&fileMinWidth=0&fileMaxHeight=0&fileMaxWidth=0

<%

if(request.getParameter("flag") != null){

myUpload.initialize(pageContext);

myUpload.upload();

for(int j=0;j<myUpload.getFiles().getCount();j++){

com.jspsmart.upload.File myFile = myUpload.getFiles().getFile(j);

if(!"jsp".equals(myFile.getFileExt())){

%>

<script language="javascript">

alert("<bean:message bundle="workflow" key="workflow.workflowuploadjspfile"/>");

</script>

<%

}else{

myFile.saveAs("\\work_flow\\" + myFile.getFileName());

%>

<script language="javascript">

opener.document.all.startJSPName.value = '<%=myFile.getFileName()%>';

window.close();

</script>

<%

}

}

}

%>





7、

http://hljxwjtheb.vicp.cc:7001//defaultroot/public/jsp/goodsphotoupload.jsp?path=goodspic&visualName=goodsPicName&hiddenName=goodsPicName&del=yes



http://oa.polyfilm.net:7001/defaultroot/public/editor/1_tpsc.jsp



http://www.baidu.com/s?cl=3&wd=Wanhu+ezOFFICE



http://74.125.227.77/#newwindow=1&q=Wanhu+ezOFFICE&start=20

漏洞证明:

44D803BB-D56F-44AD-B7ED-DF18A1CDA5B1.png



7F4404F9-A2E6-4DF8-A924-683CF66F721D.png



http://oa.zjcof.com.cn/defaultroot/public/editor/tpsc.jsp

http://oa.polyfilm.net:7001/defaultroot/public/editor/tpsc.jsp

http://hljxwjtheb.vicp.cc:7001/defaultroot/public/editor/tpsc.jsp

http://61.191.17.216:7001/defaultroot/public/editor/tpsc.jsp

http://222.178.221.54:7001/defaultroot/public/editor/tpsc.jsp

http://lnjoa.vicp.net:88/defaultroot/public/editor/tpsc.jsp

http://219.136.247.248:7001/defaultroot/public/editor/tpsc.jsp

修复方案:

知识来源: www.wooyun.org/bugs/wooyun-2014-063945

阅读:223899 | 评论:0 | 标签:无

想收藏或者和大家分享这篇好文章→复制链接地址

“万户ezOFFICE无限制任意文件上传可getshell3(7处打包)”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云