Vision energy OA system JAVA deserialization: getshell Command Execution

Vision energy OA system JAVA deserialization: getshell Command Execution

Getshell and Intranet roaming

Vision Energy Technology Co., Ltd. OA system

Url: http://oa.envisioncn.com
 

One sentence address: http://oa.envisioncn.com/tk/tx.jsp

Password 110
 

Threat Intranet
 

 

Lcx forwarding Logon
 

Vision Energy Technology Co., Ltd. OA system

Url: http://oa.envisioncn.com
 

One sentence address: http://oa.envisioncn.com/tk/tx.jsp

Password 110
 

Threat Intranet
 

 

Lcx forwarding Logon
 

 

Solution:

You know