Author: Xiao Lactic acid, reproduced in the official account Network Security Journey.
0x01 Preface
Now there are more and more spingboot sites. When testing spingBoot without authorization, 90% of people will turn a blind eye when they see only actuator/health and actuator/info. However, during a daily vulnerability mining process, I saw different actuator/health leaks, and further took down the server permissions.
0x02 Vulnerability background
A public testing campaign, authorized to infiltrate the target subdomain, we call the target target.com.
0x03 Vulnerability mining process
Use theHarvester to collect sub-domain names, and found a background login system, called qwq.target.com, and the fingerprint is spingboot. Log in to capture packets, capture the login url, the url is https://qwq.target.com/common/login. Use dirsearch to perform directory detection on its interface, and the dictionary is a special dictionary for spingboot. It is found that actuator/health and actuator/info are exposed to the outside world. Most of the actuator/health are as follows:
However, the actuator/health this time is as shown in the figure below:
Pay attention to the fourteen parameters under services. Through observation, I found common from these fourteen parameters. Yes, the login interface happens to be this parameter.
OK, a strange idea was born, construct these fourteen parameters into a dictionary, use Wfuzz to detect https://qwq.target.com/FUZZ/actuator/env, fortunately in message-api/actuator/env A 200 status code was returned. So far, spingboot unauthorized reports can be submitted.
However, in the subsequent penetration, when using burp to detect the directory of https://qwq.target.com/common/, it was found that the rememberMe=deleteMe field was found in the message returned by logout. That's right, this system turned out to be the shiro framework.
Download the heapdump file for analysis, we use jvisualvm for analysis, import the downloaded heapdump file into jvisualvm, and search for the field rememberme.
We get a string of numbers and use a script to convert it into a plaintext key.
Successful command execution.
0x04 Manufacturer feedback
This vulnerability also won the highest prize of the project, but this idea provided me with a lot of inspiration in future vulnerability mining.
0x05 summary
1. Pay special attention to points that are different from usual.
2. It is best to bring a directory for fingerprint identification.
3. Observe more and try more.