[CVE-2020-35476] OpenTSDB ＜=2.4.0 RCE

安装

条件：

• Zookeeper
• HBase

Zookeeper

wget https://mirrors.tuna.tsinghua.edu.cn/apache/zookeeper/zookeeper-3.6.2/apache-zookeeper-3.6.2.tar.gz
cd conf
cp zoo_sample.cfg zoo.cfg
vi zoo.cfg
# 修改dataDir=data，然后启动
bin/zkServer.sh start

HBase

opentsdb的后端数据存储依赖于HBase，所以需要先安装HBase。

wget https://mirrors.tuna.tsinghua.edu.cn/apache/hbase/1.4.13/hbase-1.4.13-bin.tar.gz
# 网络不行换下面的
wget https://mirrors.bfsu.edu.cn/apache/hbase/1.4.13/hbase-1.4.13-bin.tar.gz

wget https://github.com/OpenTSDB/opentsdb/releases/download/v2.4.0/opentsdb-2.4.0_all.deb
sudo dpkg -i opentsdb-2.4.0_all.deb

# 启动
systemctl start opentsdb

安装之后，设置systemctl启动：

[Unit]

Description=OpenTSDB Service

[Service]

Type=forking

PrivateTmp=yes

ExecStart=/usr/share/opentsdb/etc/init.d/opentsdb start

ExecStop=/usr/share/opentsdb/etc/init.d/opentsdb stop

Restart=on-abort

配置hbase：

vi conf/hbase-env.sh
# export JAVA_HOME=/usr/lib/jvm/java-8-oracle/
vi conf/hbase-site.xml

<configuration>
  <property>

<name>hbase.rootdir</name>

    <value>file:///home/77/hbase</value>

  </property>

  <property>

    <name>hbase.zookeeper.property.dataDir</name>

    <value>/home/77/hbase/zookeeper</value>

  </property>
</configuration>

启动qbase:

bin/start-hbase.sh

创建表：

bin/hbase shell

create 'tsdb',{NAME => 't', VERSIONS => 1, BLOOMFILTER => 'ROW'}
create 'tsdb-uid',{NAME => 'id', BLOOMFILTER => 'ROW'},{NAME => 'name', BLOOMFILTER => 'ROW'}
create 'tsdb-tree',{NAME => 't', VERSIONS => 1, BLOOMFILTER => 'ROW'}
create 'tsdb-meta',{NAME => 'name', BLOOMFILTER => 'ROW'}

最后list一下，确认表创建成功：

hbase-1.4.13这个版本的WEB端口是32809和40139：

http://192.168.85.129:32809/master-status
http://192.168.85.129:40139/rs-status?filter=all

openTSDB

安装参考：
https://www.unixmen.com/how-to-install-and-configure-opentsdb-on-centos-ubuntu-linux-for-hbase-cluster/

git clone git://github.com/OpenTSDB/opentsdb.git
 cd opentsdb
 ./build.sh
cd opentsdb/build
  make install
  whereis tsdb
tsdb: /usr/local/bin/tsdb

配置这个文件：

vi src/opentsdb.conf

内容为：

tsd.http.staticroot = /home/77/repos/opentsdb-master/build/staticroot    # the path to the OpenTSDB static GUI filestsd.network.port = 4242

# The IPv4 network address to bind to, defaults to all addresses
tsd.network.bind = 0.0.0.0
tsd.http.cachedir = /tmp       # the path where it should store the temporary cache files
tsd.storage.hbase.zk_quorum = localhost:2181 

最后创建4张表：

env COMPRESSION=NONE HBASE_HOME=/home/77/repos/hbase-1.4.13 ./src/create_table.sh

最后启动：

./build/tsdb tsd

然后就启动在4242端口了。

参考

• https://nvd.nist.gov/vuln/detail/CVE-2020-35476
• https://github.com/OpenTSDB/opentsdb/issues/2051
• OpenTSDB远程命令执行漏洞分析 -【CVE-2018-12972】
• centos7安装部署opentsdb2.4.0
• opentsdb远程代码执行(CVE-2020-35476)
• http://opentsdb.net/docs/build/html/installation.html#id1
• https://www.cnblogs.com/QuestionsZhang/p/10410455.html
• https://support.huaweicloud.com/usermanual-cloudtable/cloudtable_01_0080.html