### 简要描述： ### 详细说明： 无需登录，通杀用友办公平台。。。 http://oa.bamatea.com http://oa.moonbasa.com http://oa.etonetech.com http://oa.ztcz.cn http://218.249.130.74 http://119.146.190.170:9988 http://zhidao.baidu.com http://wenku.baidu.com http://223.4.22.36 http://222.243.160.83:9090 http://www.chipshow.cn http://116.205.96.170:9090 http://www.sxjbjt.com:9090 http://122.225.203.168:8888 http://oa.chinabed.com http://oa.lutongnet.com http://oa.zetacn.com:9090 http://oa.zhcpt.edu.cn http://www.doc88.com http://oa.sinodata.com.cn http://www.docin.com http://www.koyochem.com:8080 http://61.186.155.27 http://oa.nyinn.cn http://115.236.65.115:9090 http://119.146.190.118:8089 http://219.137.250.133 http://123.133.29.174:9090 http://koa.ecp888.com http://www.cting.com.cn http://oa.suncorps.cn http://59.41.47.211 http://oa.bamatea.com:9090 http://oa.zhenaiws.com http://www.koyochem.com:9191 http://60.208.131.46:9090 http://219.131.221.174:9090 http://oa.bnuz.edu.cn:8080 http://183.238.59.61:9090...
### 简要描述： ### 详细说明： 无需登录，通杀用友办公平台。。。 http://oa.bamatea.com http://oa.moonbasa.com http://oa.etonetech.com http://oa.ztcz.cn http://218.249.130.74 http://119.146.190.170:9988 http://zhidao.baidu.com http://wenku.baidu.com http://223.4.22.36 http://222.243.160.83:9090 http://www.chipshow.cn http://116.205.96.170:9090 http://www.sxjbjt.com:9090 http://122.225.203.168:8888 http://oa.chinabed.com http://oa.lutongnet.com http://oa.zetacn.com:9090 http://oa.zhcpt.edu.cn http://www.doc88.com http://oa.sinodata.com.cn http://www.docin.com http://www.koyochem.com:8080 http://61.186.155.27 http://oa.nyinn.cn http://115.236.65.115:9090 http://119.146.190.118:8089 http://219.137.250.133 http://123.133.29.174:9090 http://koa.ecp888.com http://www.cting.com.cn http://oa.suncorps.cn http://59.41.47.211 http://oa.bamatea.com:9090 http://oa.zhenaiws.com http://www.koyochem.com:9191 http://60.208.131.46:9090 http://219.131.221.174:9090 http://oa.bnuz.edu.cn:8080 http://183.238.59.61:9090 http://218.205.208.22:9090 http://oa.xhlbdc.com http://124.193.165.174:9090 http://218.75.87.186:9090 http://oa.eva-group.com:511 http://113.106.92.16:9090 http://oa.cqmsy.com http://cting.com.cn http://220.231.158.211 http://oa.tiholding.cn http://124.172.170.141:9090 http://oa.hengdigroup.com:9090 http://www1.elkay.com.cn:9090 http://www.gzpiano.com http://oa.zaffer.cn http://oa.gdisg.com 依然是上传问题，这次在femail/uploadAccessory.jsp中 <%@ page contentType="text/html; charset=GBK" language="java"%> <%@ page import="fe.util.BaseFunc,fe.ufmail.MailServer"%> <jsp:directive.page import="fe.upload.UploadFile"/> <jsp:directive.page import="java.io.File" /> <html> <head> <title>${FE_SYS_TITLE }</title> <link href="/style1.css" rel="stylesheet" type="text/css"> <meta http-equiv="Content-Type" content="text/html; charset=GBK"> <style type="text/css"> <!-- body { margin-left: 0px; margin-right: 0px; margin-top: 0px; background-color: #EEEEEE; } --> </style> </head> <script language="javascript" src="/js/BaseFunc.js"></script> <script language="javascript" src="/js/BaseFun.js"></script> <body> <% String flelst = request.getParameter("fileList"); String action = request.getParameter("action"); String strpath = BaseFunc.ISOToGBK(request.getParameter("temppath"));//获取路径。。。这里可以自定义，构造好我们的路径即可。。。 int saveFlag = -1; if ( flelst != null && flelst.length() > 0 ) flelst = BaseFunc.ISOToGBK(flelst); else flelst = ""; /* int allowsize = MailServer.getDefaultAccessSize(); if ( flelst.length() > 0 ){ String file[] = flelst.split(";;"); for ( int i = 0; i < file.length; i++ ){ String fleinfo[] = file[i].split(";"); File file1=new File(strpath,fleinfo[0]); allowsize=allowsize-(int)file1.length(); } } */ String msgStr = ""; int allowsize = MailServer.getDefaultAccessSize()+1024*1024*10; //original value 10M if (action!=null && action.equals("save")){ 这里将temppath 定义为../../jboss/server/default/deploy/fe.war/ 即可，这里即可将我们的马直接写到网站根目录当中 [<img src="https://images.seebug.org/upload/201405/1515524997f084524c03c70d6794b9fbb000b5c5.jpg" alt=")6UU_IW@J~J8U`LKZH6`IVN.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1515524997f084524c03c70d6794b9fbb000b5c5.jpg) 然后上传成功之后，右击源代码，即可看到shell地址 [<img src="https://images.seebug.org/upload/201405/151553489e52f463f65881401d464113cf97ef7e.jpg" alt="SQI%S9CWE$D{[H73~{T8`EO.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/151553489e52f463f65881401d464113cf97ef7e.jpg) 连接www.xxx.com/1400082691416.jsp 即是shell，目前通杀。。。。 如 [<img src="https://images.seebug.org/upload/201405/151554575703fbcb358438a34b72f61e467ad3eb.jpg" alt="CG6`ZR`]{{{18E7%Z{3U5UR.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/151554575703fbcb358438a34b72f61e467ad3eb.jpg) 直接即可添加管理员（因为都是administrator权限，直接执行系统命令，获取服务器），如图： [<img src="https://images.seebug.org/upload/201405/15155531c4321d50cdeb820c7132b7b7f369bdbb.jpg" alt="{O}QDQ%R)J0}$G@)2~0C](A.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/15155531c4321d50cdeb820c7132b7b7f369bdbb.jpg) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201405/151554575703fbcb358438a34b72f61e467ad3eb.jpg" alt="CG6`ZR`]{{{18E7%Z{3U5UR.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/151554575703fbcb358438a34b72f61e467ad3eb.jpg) 直接即可添加管理员（因为都是administrator权限，直接执行系统命令，获取服务器），如图： [<img src="https://images.seebug.org/upload/201405/15155531c4321d50cdeb820c7132b7b7f369bdbb.jpg" alt="{O}QDQ%R)J0}$G@)2~0C](A.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/15155531c4321d50cdeb820c7132b7b7f369bdbb.jpg)
