{"id":90,"date":"2021-01-22T10:44:21","date_gmt":"2021-01-22T02:44:21","guid":{"rendered":"http:\/\/bbs.hisui.cn\/?p=90"},"modified":"2024-12-01T21:41:59","modified_gmt":"2024-12-01T13:41:59","slug":"imedical%e4%b8%ad%e8%b0%83%e7%94%a8%e6%9c%ac%e5%9c%b0%e7%a8%8b%e5%ba%8f%e8%af%b4%e6%98%8e","status":"publish","type":"post","link":"http:\/\/hisui.cn\/?p=90","title":{"rendered":"iMedical\u4e2d\u8c03\u7528\u672c\u5730\u7a0b\u5e8f\u8bf4\u660e"},"content":{"rendered":"

iMedical\u7cfb\u7edf\u4e2d\u8c03\u7528\u672c\u5730\u7a0b\u5e8f\u8bf4\u660e<\/h3>\n

\u5728IE\u6d4f\u89c8\u5668\u4e2d\u4f7f\u7528ActiveX\u529f\u80fd\u53ef\u4ee5\u8c03\u7528\uff0c\u5176\u5b83\u73b0\u4ee3\u6d4f\u89c8\u5668\u5229\u7528Chrome\u4e2d\u95f4\u4ef6\u529f\u80fd\u8c03\u7528\u3002<\/h4>\n
    \n
  1. \u5f15\u7528..\/scripts\/websys.js<\/li>\n
  2. CSP\u6e90\u4ee3\u7801head\u4e2d\u52a0\u5165<\/li>\n<\/ol>\n
    <ADDINS require=\"CmdShell\"><\/ADDINS>\n<\/code><\/pre>\n
      \n
    1. \u8c03\u7528\u672c\u5730\u7a0b\u5e8f<\/li>\n<\/ol>\n
      \/\/\u6253\u5f00\u672c\u5730\u8ba1\u7b97\u5668\nexec('calc.exe')\n<\/code><\/pre>\n
      \/\/\/\u4f7f\u7528IE\u6253\u5f00\u767e\u5ea6\u7f51\u7ad9\nexec('\"C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe\" \"http:\/\/www.hisui.cn\"');\n<\/code><\/pre>\n
        \n
      1. \u4f7f\u7528\u73af\u5883\u53d8\u91cf\u6253\u5f00<\/li>\n<\/ol>\n
        \/\/\u4f7f\u7528IE\u6253\u5f00hisui.cn\nexec('\"%PROGRAMFILES%\\\\Internet Explorer\\\\iexplore.exe\" \"http:\/\/www.hisui.cn\"');\n\/\/\u4f7f\u7528chrome\u6253\u5f00hisui.cn\nexec('\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Google Chrome.lnk\" \"http:\/\/www.hisui.cn\"');\n\/\/\u4f7f\u7528chrome\u6253\u5f00hisui.cn\nexec('\"%LOCALAPPDATA%\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\" \"http:\/\/www.hisui.cn\"');\nexec('\"%USERPROFILE%\\\\desktop\\\\\u4e1c\u534e\u7cfb\u7edf.lnk\" \"https:\/\/www.hisui.cn\"');\n<\/code><\/pre>\n
        \n  Window\u64cd\u4f5c\u7cfb\u7edf\u4e0b\u6709\u4ee5\u4e0b\u7279\u6027<\/p>\n\n\n\n\n\n\n\n
        \u73af\u5883\u53d8\u91cf<\/th>\n\u771f\u5b9e\u8def\u5f84<\/th>\n<\/tr>\n<\/thead>\n
        APPDATA<\/td>\nC:\\Users\\\u7528\u6237\u540d\\AppData\\Roaming<\/td>\n<\/tr>\n
        LOCALAPPDATA<\/td>\nC:\\Users\\\u7528\u6237\u540d\\AppData\\Local<\/td>\n<\/tr>\n
        PROGRAMFILES<\/td>\nC:\\Program Files<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/blockquote>\n
          \n
        1. exec\u57fa\u672c\u6e90\u4ee3\u7801\u5982\u4e0b<\/li>\n<\/ol>\n
          function exec(command) {\n    if (websys_isIE){\n        window.oldOnError=window.onerror;\n        window._command=command;\n        window.onerror= function(err){\n            if(err.indexOf('utomation')>-1) {\n                alert('\u547d\u4ee4'+window._command+'\u5df2\u7ecf\u88ab\u7528\u6237\u7981\u6b62\uff01');\n                return true;\n            }else{\n                return false;\n            };\n        };\n        var wsh=new ActiveXObject('WScript.Shell');\n        if (wsh) {\n            wsh.Run(command);\n        }\n        window.onerror = window.oldOnError;\n    }else{\n        if (CmdShell){\n            CmdShell.clear();\n            CmdShell.notReturn=1;\n            CmdShell.Run(command);\n        }\n    }\n }\n<\/code><\/pre>\n
            \n
          1. exec\u8fd0\u884c\u6761\u4ef6\u8bf4\u660e\n
              \n
            • IE\u6d4f\u89c8\u5668\uff0c\u589e\u52a0\u4fe1\u4efb\u7ad9\u70b9\uff0c\u4e14\u5141\u8bb8ActiveX\u8fd0\u884c<\/li>\n
            • \u975eIE\u6d4f\u89c8\u5668\u4f7f\u7528\u65f6\uff0c\u8bf7\u5728\u5ba2\u6237\u7aef\u5b89\u88c5Chrome\u4e2d\u95f4\u4ef6<\/li>\n
            • cmd\u4e2d&<\/code>\uff0c||<\/code>\uff0c<<\/code>\uff0c><\/code>\u4e3a\u6709\u610f\u601d\u7684\u7279\u6b8a\u5b57\u7b26\u8981\u52a0^<\/code>\u6765\u8f6c\u4e49,\u5982\u679c\u4f7f\u7528\u53cc\u5f15\u53f7”\u5305\u88f9\u5185\u5bb9\u5219\u4e0d\u7528\u8f6c\u4e49,cmd('\"xx.exe\" abc.com?a=1^&b=2')<\/code>\u6216cmd('\"xx.exe\" \"abc.com?a=1&b=2\"')<\/code><\/li>\n<\/ul>\n<\/li>\n
            • \u5e38\u89c1\u95ee\u9898\n
                \n
              • \u57df\u63a7\u4e0b\u8c03\u7528\u5931\u8d25\u95ee\u9898\uff0c\u628a\u73af\u5883\u53d8\u91cf\u4e2d%SystemRoot%\u5411\u4e0b\u79fb\u52a82\u4f4d
                \n\"Path-%SystemRoot%\"<\/li>\n
              • \u5982\u679c\u4f1a\u5feb\u901f\u5f39\u51fa\u7528\u6237\u786e\u8ba4\u6846\uff0c\u8bf7\u5b89\u88c5TweakUAC.exe – \u9009\u3010Leave UAC Off\u3011 – \u5b89\u88c5<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
                iMedical\u4e0bIE\u6d4f\u89c8\u5668\u6216\u975eIE\u6d4f\u89c8\u5668\u4e0b\u6253\u5f00\u5ba2\u6237\u7aef\u7a0b\u5e8f\u65b9\u6cd5\u8bf4\u660e<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[36,21,25,11,62,22,24,23],"class_list":["post-90","post","type-post","status-publish","format-standard","hentry","category-imedical_info","tag-chrome","tag-21","tag-25","tag-11","tag-62","tag-ie","tag-24","tag-23"],"_links":{"self":[{"href":"http:\/\/hisui.cn\/index.php?rest_route=\/wp\/v2\/posts\/90","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/hisui.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/hisui.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/hisui.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/hisui.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=90"}],"version-history":[{"count":0,"href":"http:\/\/hisui.cn\/index.php?rest_route=\/wp\/v2\/posts\/90\/revisions"}],"wp:attachment":[{"href":"http:\/\/hisui.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=90"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/hisui.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=90"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/hisui.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=90"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}