### 简要描述：
### 详细说明：
无需登录，通杀用友办公平台。。。
http://oa.bamatea.com
http://oa.moonbasa.com
http://oa.etonetech.com
http://oa.ztcz.cn
http://218.249.130.74
http://119.146.190.170:9988
http://zhidao.baidu.com
http://wenku.baidu.com
http://223.4.22.36
http://222.243.160.83:9090
http://www.chipshow.cn
http://116.205.96.170:9090
http://www.sxjbjt.com:9090
http://122.225.203.168:8888
http://oa.chinabed.com
http://oa.lutongnet.com
http://oa.zetacn.com:9090
http://oa.zhcpt.edu.cn
http://www.doc88.com
http://oa.sinodata.com.cn
http://www.docin.com
http://www.koyochem.com:8080
http://61.186.155.27
http://oa.nyinn.cn
http://115.236.65.115:9090
http://119.146.190.118:8089
http://219.137.250.133
http://123.133.29.174:9090
http://koa.ecp888.com
http://www.cting.com.cn
http://oa.suncorps.cn
http://59.41.47.211
http://oa.bamatea.com:9090
http://oa.zhenaiws.com
http://www.koyochem.com:9191
http://60.208.131.46:9090
http://219.131.221.174:9090
http://oa.bnuz.edu.cn:8080
http://183.238.59.61:9090
http://218.205.208.22:9090
http://oa.xhlbdc.com
http://124.193.165.174:9090
http://218.75.87.186:9090
http://oa.eva-group.com:511
http://113.106.92.16:9090
http://oa.cqmsy.com
http://cting.com.cn
http://220.231.158.211
http://oa.tiholding.cn
http://124.172.170.141:9090
http://oa.hengdigroup.com:9090
http://www1.elkay.com.cn:9090
http://www.gzpiano.com
http://oa.zaffer.cn
http://oa.gdisg.com
依然是上传问题，这次在femail/uploadAccessory.jsp中
<%@ page contentType="text/html; charset=GBK" language="java"%>
<%@ page import="fe.util.BaseFunc,fe.ufmail.MailServer"%>
<jsp:directive.page import="fe.upload.UploadFile"/>
<jsp:directive.page import="java.io.File" />
<html>
<head>
<title>${FE_SYS_TITLE }</title>
<link href="/style1.css" rel="stylesheet" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=GBK">
<style type="text/css">
<!--
body {
margin-left: 0px;
margin-right: 0px;
margin-top: 0px;
background-color: #EEEEEE;
}
-->
</style>
</head>
<script language="javascript" src="/js/BaseFunc.js"></script>
<script language="javascript" src="/js/BaseFun.js"></script>
<body>
<%
String flelst = request.getParameter("fileList");
String action = request.getParameter("action");
String strpath = BaseFunc.ISOToGBK(request.getParameter("temppath"));//获取路径。。。这里可以自定义，构造好我们的路径即可。。。
int saveFlag = -1;
if ( flelst != null && flelst.length() > 0 )
flelst = BaseFunc.ISOToGBK(flelst);
else
flelst = "";
/*
int allowsize = MailServer.getDefaultAccessSize();
if ( flelst.length() > 0 ){
String file[] = flelst.split(";;");
for ( int i = 0; i < file.length; i++ ){
String fleinfo[] = file[i].split(";");
File file1=new File(strpath,fleinfo[0]);
allowsize=allowsize-(int)file1.length();
}
}
*/
String msgStr = "";
int allowsize = MailServer.getDefaultAccessSize()+1024*1024*10;
//original value 10M
if (action!=null && action.equals("save")){
这里将temppath 定义为../../jboss/server/default/deploy/fe.war/
即可，这里即可将我们的马直接写到网站根目录当中
[<img src="https://images.seebug.org/upload/201405/1515524997f084524c03c70d6794b9fbb000b5c5.jpg" alt=")6UU_IW@J~J8U`LKZH6`IVN.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1515524997f084524c03c70d6794b9fbb000b5c5.jpg)
然后上传成功之后，右击源代码，即可看到shell地址
[<img src="https://images.seebug.org/upload/201405/151553489e52f463f65881401d464113cf97ef7e.jpg" alt="SQI%S9CWE$D{[H73~{T8`EO.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/151553489e52f463f65881401d464113cf97ef7e.jpg)
连接www.xxx.com/1400082691416.jsp
即是shell，目前通杀。。。。
如
[<img src="https://images.seebug.org/upload/201405/151554575703fbcb358438a34b72f61e467ad3eb.jpg" alt="CG6`ZR`]{{{18E7%Z{3U5UR.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/151554575703fbcb358438a34b72f61e467ad3eb.jpg)
直接即可添加管理员（因为都是administrator权限，直接执行系统命令，获取服务器），如图：
[<img src="https://images.seebug.org/upload/201405/15155531c4321d50cdeb820c7132b7b7f369bdbb.jpg" alt="{O}QDQ%R)J0}$G@)2~0C](A.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/15155531c4321d50cdeb820c7132b7b7f369bdbb.jpg)
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201405/151554575703fbcb358438a34b72f61e467ad3eb.jpg" alt="CG6`ZR`]{{{18E7%Z{3U5UR.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/151554575703fbcb358438a34b72f61e467ad3eb.jpg)
直接即可添加管理员（因为都是administrator权限，直接执行系统命令，获取服务器），如图：
[<img src="https://images.seebug.org/upload/201405/15155531c4321d50cdeb820c7132b7b7f369bdbb.jpg" alt="{O}QDQ%R)J0}$G@)2~0C](A.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/15155531c4321d50cdeb820c7132b7b7f369bdbb.jpg)
京公网安备 11010502034610号
暂无评论