截止4月11日hvv情報分享
作者：護網(wǎng)專題小組 編輯：白帽子社區(qū)運營團隊
"白帽子社區(qū)在線CTF靶場BMZCTF，歡迎各位在這里練習(xí)、學(xué)習(xí)，BMZCTF全身心為網(wǎng)絡(luò)安全賽手提供優(yōu)質(zhì)學(xué)習(xí)環(huán)境，鏈接（http://www.bmzclub.cn/）
"
HW專題篇（二）
首先還是先送上一部分封禁IP信息，相當可靠
119.45.165.175 |
218.28.13.98 |
118.190.103.114 |
120.77.244.249 |
61.148.244.78 |
120.77.244.249 |
221.122.70.7 |
221.122.70.6 |
221.122.70.5 |
221.122.70.3 |
221.122.70.2 |
121.4.173.142 |
223.104.39.176 |
218.206.233.26 |
212.32.236.219 |
38.68.37.88 |
目前可信度較高漏洞如下：
1 | 天擎前臺SQL注入 |
2 | 泛微OA v8前臺SQL注入 |
3 | 奇安信NS-NGFW 網(wǎng)康防火墻 前臺RCE |
4 | 致遠OA命令執(zhí)行漏洞 |
5 | 用友NC6.5版本存在反序列化命令執(zhí)行漏洞 |
6 | 泛微OA v9命令執(zhí)行 |
7 | 億郵電子郵件遠程命令執(zhí)行 |
8 | 泛微OA8的泛微e-mobile命令執(zhí)行漏洞 |
9 | 金山終端安全系統(tǒng)存在文件上傳漏洞 |
10 | 奇治堡壘機任意用戶登錄 |
11 | 浪潮 ClusterEngineV4.0 任意命令執(zhí)行 |
附帶部分脫敏exp：
Host: X.X.X.XUser-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko) Version/12.0.3 Safari/605.1.15Content-Length: 155Content-Type:application/jsonX-Requested-With:XMLHttpRequestAccept-Encoding: gzip{"action":"SSLVPN_Resource","method":"此處手動屏蔽payload信息","data": [{"data":["此處手動屏蔽payload信息"]}],"type":"此處手動屏蔽payload信息","tid": 17}
POST/webadm/?q=moni_detail.do&action=gragh HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT10.0; WOW64; rv:46.0) Gecko/20100101Firefox/46.0Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language:zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateDNT: 1Connection: closeContent-Type:application/x-www-form-urlencodedContent-Length: 25type=此處手動屏蔽payload信息
POST /login HTTP/1.1Host: 127.0.0.1:8443User-Agent: Mozilla/5.0 (Windows NT10.0; WOW64; rv:46.0) Gecko/20100101Firefox/46.0Accept: application/json,text/javascript, */*; q=0.01Accept-Language:zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateDNT: 1Content-Type:application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestReferer:https://118.26.69.83:8443/module/login/login.htmlContent-Length: 43Cookie:Connection: closeop=此處手動屏蔽payload信息&username=此處手動屏蔽payload信息
評論
圖片
表情