apache-tomcat_8_weak-password

本文详细描述了ApacheTomcat8中的一个高危弱口令漏洞,指出默认情况下存在安全风险,可通过特定步骤复现和利用,包括GetShell攻击。建议及时更新或配置安全措施以防止漏洞被利用。

Apache-Tomcat_8_weak-password

说明内容
漏洞编号
漏洞名称Apache-Tomcat8 弱口令
漏洞评级高危
影响范围Apache-Tomcat 7+
漏洞描述存在默认口令
修复方案

漏洞描述

正常安装的情况下,tomcat8中默认没有任何用户,且manager页面只允许本地IP访问。只有管理员手工修改了某些属性,才可以进行攻击。

漏洞等级

高危

影响版本

  • apache-tomcat 7+

漏洞复现

基础环境

组件版本
OSkali-linux
Web Serverchrome
apache-tomcat8

漏洞扫描

使用nacs可以扫描到漏洞

sudo ./nacs -h 192.168.117.163 -pa 80

在这里插入图片描述

漏洞验证

启动环境,访问主页,使用默认账号密码登录

tomcat
tomcat

在这里插入图片描述

在这里插入图片描述

深度利用

GetShell

可以将木马做成war包进行上传

在这里插入图片描述

  1. 进入java目录

    cd tools/java/jdk1.8.0_65/bin
    
  2. 将jshell.jsp复制过来

    cp /home/kali/tools/webshell/jsp/jshell.jsp ./
    
  3. 用jar命令进行压缩

    ./jar cvf jshell.war jshell.jsp
    

    在这里插入图片描述

  4. 上传war包,会生成路径

    在这里插入图片描述

  5. 访问路径即完成getshell

漏洞挖掘

网络测绘

tomcat 8

修复建议

_DEBUG_HTTPD_CC_LEVEL=1 -DINCLUDE_DEBUG_HTTPD_RUN_LEVEL=1 -DINCLUDE_DEBUG_COS_CC_LEVEL=1 -DINCLUDE_DEBUG_COS_RUN_LEVEL=1 -DINCLUDE_DEBUG_DNSPX_CC_LEVEL=1 -DINCLUDE_DEBUG_DNSPX_RUN_LEVEL=1 -DINCLUDE_DEBUG_CWMP_CC_LEVEL=1 -DINCLUDE_DEBUG_CWMP_RUN_LEVEL=1 -DINCLUDE_DEBUG_TPAPP_CC_LEVEL=1 -DINCLUDE_DEBUG_TPAPP_RUN_LEVEL=1 -DINCLUDE_DEBUG_MESH_CC_LEVEL=1 -DINCLUDE_DEBUG_MESH_RUN_LEVEL=1 -DINCLUDE_DEBUG_OAM_CC_LEVEL=1 -DINCLUDE_DEBUG_OAM_RUN_LEVEL=1 -DINCLUDE_DEBUG_CATCHNS_CC_LEVEL=1 -DINCLUDE_DEBUG_CATCHNS_RUN_LEVEL=1 -DINCLUDE_DEBUG_DIAG_CC_LEVEL=1 -DINCLUDE_DEBUG_DIAG_RUN_LEVEL=1 -DINCLUDE_DEBUG_TR143_CC_LEVEL=1 -DINCLUDE_DEBUG_TR143_RUN_LEVEL=1 -DINCLUDE_DEBUG_RCSH_CC_LEVEL=1 -DINCLUDE_DEBUG_RCSH_RUN_LEVEL=1 -DINCLUDE_DEBUG_QOE_CC_LEVEL=1 -DINCLUDE_DEBUG_QOE_RUN_LEVEL=1 -DINCLUDE_DEBUG_IPSEC_CC_LEVEL=1 -DINCLUDE_DEBUG_IPSEC_RUN_LEVEL=1 -DINCLUDE_DEBUG_NTPC_CC_LEVEL=1 -DINCLUDE_DEBUG_NTPC_RUN_LEVEL=1 -DINCLUDE_DEBUG_WANCONN_CC_LEVEL=1 -DINCLUDE_DEBUG_WANCONN_RUN_LEVEL=1 -DINCLUDE_DEBUG_CLOUD_CC_LEVEL=1 -DINCLUDE_DEBUG_CLOUD_RUN_LEVEL=1 -DINCLUDE_DEBUG_MOBILE_CC_LEVEL=1 -DINCLUDE_DEBUG_MOBILE_RUN_LEVEL=1 -DINCLUDE_DEBUG_CMD_CC_LEVEL=1 -DINCLUDE_DEBUG_CMD_RUN_LEVEL=1 -DINCLUDE_DEBUG_CMGR_CC_LEVEL=1 -DINCLUDE_DEBUG_CMGR_RUN_LEVEL=1 -DINCLUDE_LED_SCHEDULE=y -DLED_SCHEDULE_CFG="" -DINCLUDE_REBOOT_SCHEDULE=y -DPOWER_SCHEDULE_CFG="" -DINCLUDE_NO_ISP=y -DINCLUDE_DATA_MODEL_SPEC_OPTIONS=y -DDEV2_WIFI_RADIO_MAX_INST=2 -DWIFI_RADIO_STATS_MAX_INST=2 -DDEV2_WIFI_DIAGNOSTICRESULT_MAX_INST=128 -DDEV2_WIFI_SSID_MAX_INST=14 -DWIFI_SSID_STATS_MAX_INST=14 -DDEV2_WIFI_AP_MAX_INST=14 -DDEV2_WIFI_SECURITY_MAX_INST=14 -DDEV2_WIFI_WPS_MAX_INST=14 -DDEV2_WIFI_ASSOC_DEV_MAX_INST=256 -DDEV2_WIFI_ASSOC_DEV_STAT_MAX_INST=256 -DDEV2_WIFI_AC_MAX_INST=56 -DDEV2_WIFI_SCHEDULE_MAX_INST=14 -DDEV2_WIFI_ACL_MAX_INST=14 -DDEV2_WIFI_MACTABLE_MAX_INST=128 -DDEV2_WIFI_CONTROLFUNCTION_MAX_INST=14 -DDEV2_X_PCCWCPE_CONTROL_MAX_INST=14 -DDEV2_WIFI_WDSBRIDGE_MAX_INST=2 -DDEV2_WIFI_ENDPOINT_WPS_MAX_INST=2 -DDEV2_WIFI_APDEV_MAX_INST=16 -DDEV2_WIFI_APDEV_RADIO_MAX_INST=32 -DDEV2_WIFI_APDEV_AP_MAX_INST=256 -DDEV2_WIFI_APDEV_ASSOCDEV_MAX_INST=256 -DDEV2_WIFI_APDEV_STATS_MAX_INST=256 -DDEV2_WIFI_APDEV_STESTATS_MAX_INST=256 -DDEV2_WIFI_APDEV_STEHISTORY_MAX_INST=256 -DDEV2_WIFI_APDEV_ETHERNET_MAX_INST=16 -DDEV2_WIFI_APDEV_ETHASSOCDEV_MAX_INST=64 -DDEV2_WIFI_APDEV_MEMSTATUS_MAX_INST=16 -DDEV2_WIFI_APDEV_QOE_MAX_INST=16 -DDEV2_WIFI_APDEV_INTERFACE_MAX_INST=256 -DDEV2_WIFI_APDEV_COMPONENT_MAX_INST=256 -DDEV2_WIFI_APDEV_WPS_MAX_INST=16 -DDEV2_TS_POLICY_MAX_INST=8 -DDEV2_TS_ETH_POLICY_MAX_INST=8 -DDEV2_WIFI_DE_DEV_MAX_INST=16 -DDEV2_WIFI_DE_RADIO_MAX_INST=32 -DDEV2_WIFI_DE_CUROPCLASSPROF_MAX_INST=128 -DDEV2_WIFI_DE_BSS_MAX_INST=256 -DDEV2_WIFI_DE_STA_MAX_INST=256 -DDEV2_STA_X_TP_QOE_MAX_INST=256 -DDEV2_STA_X_TP_QOE_FACTOR_MAX_INST=256 -DDEV2_WIFI_DE_BACKHAUL_STA_MAX_INST=32 -DDEV2_WIFI_DE_CAP_MAX_INST=32 -DDEV2_WIFI_DE_CAP_PROF_MAX_INST=256 -DDEV2_WIFI_DE_SCAN_RESULT_MAX_INST=256 -DDEV2_WIFI_DE_OPCLASS_SCAN_MAX_INST=256 -DDEV2_WIFI_DE_CHANNEL_SCAN_MAX_INST=256 -DDEV2_WIFI_DE_NEIGHBORBSS_MAX_INST=256 -DDEV2_WIFI_DE_UNASSOCSTA_MAX_INST=256 -DDEV2_DEVICE_X_TP_QOE_MAX_INST=16 -DDEV2_DEVICE_X_TP_QOE_FACTOR_MAX_INST=16 -DDEV2_WIFI_DE_ASSOC_DATA_MAX_INST=128 -DDEV2_WIFI_DE_DISASSOC_DATA_MAX_INST=128 -DDEV2_MULTIMODE_AP_MAX_INST=2 -DDEV2_MULTIMODE_RE_MAX_INST=2 -DDEV2_MULTIMODE_ROUTER_MAX_INST=2 -DDEV2_BRIDGE_MAX_INST=8 -DINCLUDE_SEC_DROPBEAR_DISABLE_WEAK_ALGO=y -DINCLUDE_SEC_DROPBEAR_USE_ECDSA_HOSTKEY=y -DINCLUDE_SEC_NO_RENEGOTIATION_HTTPD=y -DINCLUDE_HTTPS_TR02102=y -DINCLUDE_HTTPS_CIPHER_LIST="ALL:!RSA:!aNULL:!eNULL:HIGH:!PSK:!DSS:!SHA1:!AESCCM8:!ARIA:@STRENGTH" -DINCLUDE_HTTPS_TLS_SIGALGS_LIST="rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512" -DINCLUDE_HTTPS_TLS_GROUPS_LIST="P-521:P-384:P-256" -DINCLUDE_SEC_DISABLE_CLOUD_WEAK_TLS_CIPHERS=y -DINCLUDE_CLOUD_TLS_CIPHER_LIST="ALL:!RSA:!aNULL:!eNULL:HIGH:!PSK:!DSS:!SHA1:!AESCCM8:!ARIA:@STRENGTH" -DINCLUDE_CLOUD_TLS_SIGALGS_LIST="rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pkcs1_sha256:rsa_pkcs1_sha384:rsa_pkcs1_sha512" -DINCLUDE_CLOUD_TLS_GROUPS_LIST="P-521:P-384:P-256" -DINCLUDE_TP_TRUST_KEY=y -DINCLUDE_BACKUP_RESTORE_WITH_PASSWORD=y -DINCLUDE_CONFIG_BACKUP_RESTORE_WITH_PASSWORD_FORCE=y -DINCLUDE_CONFIG_PASSWD_FAIL_WAIT_TIME="2" -DINCLUDE_SEC_DISABLE_DDNS_WEAK_TLS_CIPHERS=y -DINCLUDE_DDNS_TLS_CIPHER_LIST="ALL:!RSA:!aNULL:!eNULL:HIGH:!PSK:!DSS:!SHA1:!AESCCM8:!ARIA:@STRENGTH" -DINCLUDE_DDNS_TLS_SIGALGS_LIST="rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pkcs1_sha256:rsa_pkcs1_sha384:rsa_pkcs1_sha512" -DINCLUDE_DDNS_TLS_GROUPS_LIST="P-521:P-384:P-256" -DINCLUDE_SEC_CONSOLE_ADMIN_SHA256_HASH=y -DINCLUDE_NX511v " make[2]: Entering directory '/home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk' make -C /home/bba/work/NX511v/bba_3_0_platform/sdk/ipq5018_11.5_cs/qsdk/build_dir/target-arm_cortex-a7_musl-1.1.16_eabi/linux-ipq_ipq50xx/linux-4.4.60/ M=`pwd` modules make[3]: Entering directory '/home/bba/work/NX511v/bba_3_0_platform/sdk/ipq5018_11.5_cs/qsdk/qca/src/linux-4.4' CC [M] /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/tp_trust_key.o <command-line>:0:0: warning: "CONFIG_TP_IMAGE" redefined <command-line>:0:0: note: this is the location of the previous definition /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/tp_trust_key.c:42:33: warning: backslash and newline separated by space #define TRK_DEBUG(fmt, args...) \ ^ /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/tp_trust_key.c:49:33: warning: backslash and newline separated by space #define TRK_ERROR(fmt, args...) \ ^ /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/tp_trust_key.c: In function 'get_dev_info': /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/tp_trust_key.c:210:6: warning: the address of 'l_device_id' will always evaluate as 'true' [-Waddress] if (l_device_id && l_device_id[0]) ^ /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/tp_trust_key.c: At top level: /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/tp_trust_key.c:92:12: warning: 'get_dev_info_from_flash' declared 'static' but never defined [-Wunused-function] static int get_dev_info_from_flash(char *dev_id); ^ LD [M] /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/ktrk.o Building modules, stage 2. MODPOST 1 modules CC /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/ktrk.mod.o <command-line>:0:0: warning: "CONFIG_TP_IMAGE" redefined <command-line>:0:0: note: this is the location of the previous definition LD [M] /home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk/ktrk.ko make[3]: Leaving directory '/home/bba/work/NX511v/bba_3_0_platform/sdk/ipq5018_11.5_cs/qsdk/qca/src/linux-4.4' arm-openwrt-linux-muslgnueabi-strip --strip-unneeded ktrk.ko make[2]: Leaving directory '/home/bba/work/NX511v/bba_3_0_platform/platform/modules/private/trk' make[1]: Leaving directory '/home/bba/work/NX511v/bba_3_0_platform/platform/build' bba@ubuntu:~/work/NX511v/bba_3_0_platform/platform/build$ 这个编译成功了吗
最新发布
12-16
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

cwangc000

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值