Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit ce4740e

Browse files
committed
add three rce environment
1 parent 8c7a68f commit ce4740e

File tree

22 files changed

+813
-0
lines changed

22 files changed

+813
-0
lines changed

‎README.md

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,13 +96,15 @@ Spring Boot 相关漏洞学习资料,利用方法和技巧合集,黑盒安
9696
* [步骤五:发送恶意 payload](#%E6%AD%A5%E9%AA%A4%E4%BA%94%E5%8F%91%E9%80%81%E6%81%B6%E6%84%8F-payload)
9797
* [漏洞原理:](#%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86-6)
9898
* [漏洞分析:](#%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90-5)
99+
* [漏洞环境:](#%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83-4)
99100
* [0x06:h2 database query RCE](#0x06h2-database-query-rce)
100101
* [利用条件:](#%E5%88%A9%E7%94%A8%E6%9D%A1%E4%BB%B6-8)
101102
* [利用方法:](#%E5%88%A9%E7%94%A8%E6%96%B9%E6%B3%95-8)
102103
* [步骤一:设置 spring\.datasource\.hikari\.connection\-test\-query 属性](#%E6%AD%A5%E9%AA%A4%E4%B8%80%E8%AE%BE%E7%BD%AE-springdatasourcehikariconnection-test-query-%E5%B1%9E%E6%80%A7)
103104
* [步骤二:重启应用](#%E6%AD%A5%E9%AA%A4%E4%BA%8C%E9%87%8D%E5%90%AF%E5%BA%94%E7%94%A8)
104105
* [漏洞原理:](#%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86-7)
105106
* [漏洞分析:](#%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90-6)
107+
* [漏洞环境:](#%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83-5)
106108
* [0x07:mysql jdbc deserialization RCE](#0x07mysql-jdbc-deserialization-rce)
107109
* [利用条件:](#%E5%88%A9%E7%94%A8%E6%9D%A1%E4%BB%B6-9)
108110
* [利用方法:](#%E5%88%A9%E7%94%A8%E6%96%B9%E6%B3%95-9)
@@ -114,6 +116,7 @@ Spring Boot 相关漏洞学习资料,利用方法和技巧合集,黑盒安
114116
* [步骤六:恢复正常 jdbc url](#%E6%AD%A5%E9%AA%A4%E5%85%AD%E6%81%A2%E5%A4%8D%E6%AD%A3%E5%B8%B8-jdbc-url)
115117
* [漏洞原理:](#%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86-8)
116118
* [漏洞分析:](#%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90-7)
119+
* [漏洞环境:](#%E6%BC%8F%E6%B4%9E%E7%8E%AF%E5%A2%83-6)
117120

118121

119122

@@ -1031,6 +1034,18 @@ nc -lvp 443
10311034

10321035

10331036

1037+
#### 漏洞环境:
1038+
1039+
[repository/springboot-jolokia-logback-rce](https://github.com/LandGrey/SpringBootVulExploit/tree/master/repository/springboot-jolokia-logback-rce)
1040+
1041+
正常访问:
1042+
1043+
```
1044+
http://127.0.0.1:9094/env
1045+
```
1046+
1047+
1048+
10341049
### 0x06:h2 database query RCE
10351050

10361051
#### 利用条件:
@@ -1104,6 +1119,18 @@ Content-Type: application/json
11041119

11051120

11061121

1122+
#### 漏洞环境:
1123+
1124+
[repository/springboot-h2-database-rce](https://github.com/LandGrey/SpringBootVulExploit/tree/master/repository/springboot-h2-database-rce)
1125+
1126+
正常访问:
1127+
1128+
```
1129+
http://127.0.0.1:9096/actuator/env
1130+
```
1131+
1132+
1133+
11071134
### 0x07:mysql jdbc deserialization RCE
11081135

11091136
#### 利用条件:
@@ -1226,3 +1253,22 @@ Content-Type: application/json
12261253
​ [New-Exploit-Technique-In-Java-Deserialization-Attack](https://i.blackhat.com/eu-19/Thursday/eu-19-Zhang-New-Exploit-Technique-In-Java-Deserialization-Attack.pdf)
12271254

12281255

1256+
1257+
#### 漏洞环境:
1258+
1259+
> 需要配置 application.properties 中的 spring.datasource.url、spring.datasource.username、spring.datasource.password,保证可以正常连上 mysql 数据库,否则程序启动时就会报错退出
1260+
1261+
[repository/springboot-mysql-jdbc-rce](https://github.com/LandGrey/SpringBootVulExploit/tree/master/repository/springboot-mysql-jdbc-rce)
1262+
1263+
正常访问:
1264+
1265+
```
1266+
http://127.0.0.1:9097/actuator/env
1267+
```
1268+
1269+
发送完 payload 后触发漏洞:
1270+
1271+
```
1272+
http://127.0.0.1:9097/product/list
1273+
```
1274+
Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>org.example</groupId>
8+
<artifactId>springboot-h2-database-rce</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
<parent>
11+
<groupId>org.springframework.boot</groupId>
12+
<artifactId>spring-boot-starter-parent</artifactId>
13+
<version>2.2.1.RELEASE</version>
14+
</parent>
15+
16+
<properties>
17+
<java.version>1.8</java.version>
18+
</properties>
19+
20+
<dependencies>
21+
<dependency>
22+
<groupId>org.springframework.boot</groupId>
23+
<artifactId>spring-boot-starter-web</artifactId>
24+
</dependency>
25+
26+
<dependency>
27+
<groupId>org.springframework.boot</groupId>
28+
<artifactId>spring-boot-starter-actuator</artifactId>
29+
</dependency>
30+
31+
<dependency>
32+
<groupId>org.springframework.cloud</groupId>
33+
<artifactId>spring-cloud-starter-config</artifactId>
34+
</dependency>
35+
36+
<dependency>
37+
<groupId>org.springframework.boot</groupId>
38+
<artifactId>spring-boot-starter-data-jpa</artifactId>
39+
</dependency>
40+
41+
<dependency>
42+
<groupId>com.h2database</groupId>
43+
<artifactId>h2</artifactId>
44+
</dependency>
45+
46+
</dependencies>
47+
48+
<dependencyManagement>
49+
<dependencies>
50+
<dependency>
51+
<groupId>org.springframework.cloud</groupId>
52+
<artifactId>spring-cloud-dependencies</artifactId>
53+
<version>Hoxton.SR1</version>
54+
<type>pom</type>
55+
<scope>import</scope>
56+
</dependency>
57+
</dependencies>
58+
</dependencyManagement>
59+
60+
<build>
61+
<plugins>
62+
<plugin>
63+
<groupId>org.springframework.boot</groupId>
64+
<artifactId>spring-boot-maven-plugin</artifactId>
65+
</plugin>
66+
</plugins>
67+
</build>
68+
69+
</project>
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module type="JAVA_MODULE" version="4" />
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package code.landgrey;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
@SpringBootApplication
7+
public class Application {
8+
public static void main(String[] args){
9+
SpringApplication.run(Application.class,args);
10+
}
11+
}
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package code.landgrey.controller;
2+
3+
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
4+
import org.springframework.web.bind.annotation.RequestMapping;
5+
import org.springframework.web.bind.annotation.RestController;
6+
7+
@RestController
8+
@EnableAutoConfiguration
9+
public class Article {
10+
@RequestMapping("/article")
11+
public String hello(String id){
12+
int total = 100;
13+
String message = String.format("You've read %s books, and there are %d left", id, total - Integer.valueOf(id));
14+
return message;
15+
}
16+
}
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
server.port=9096
2+
server.address=127.0.0.1
3+
4+
# ensure h2 database rce
5+
spring.jpa.database = MYSQL
6+
spring.jpa.database-platform=org.hibernate.dialect.MySQL5Dialect
7+
8+
# vulnerable configuration set 0: spring boot 1.0 - 1.4
9+
# all spring boot versions 1.0 - 1.4 expose actuators by default without any parameters
10+
# no configuration required to expose them
11+
12+
# safe configuration set 0: spring boot 1.0 - 1.4
13+
#management.security.enabled=true
14+
15+
# vulnerable configuration set 1: spring boot 1.5+
16+
# spring boot 1.5+ requires management.security.enabled=false to expose sensitive actuators
17+
#management.security.enabled=false
18+
19+
# safe configuration set 1: spring boot 1.5+
20+
# when 'management.security.enabled=false' but all sensitive actuators explicitly disabled
21+
#management.security.enabled=false
22+
23+
## vulnerable configuration set 2: spring boot 2+
24+
#management.security.enabled=false
25+
#management.endpoint.refresh.enabled=true
26+
#management.endpoints.web.exposure.include=env,restart,refresh
27+
management.endpoints.web.exposure.include=*
28+
management.endpoint.restart.enabled=true
Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>org.example</groupId>
8+
<artifactId>springboot-mysql-jdbc-rce</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
11+
<properties>
12+
<java.version>1.8</java.version>
13+
</properties>
14+
15+
<parent>
16+
<groupId>org.springframework.boot</groupId>
17+
<artifactId>spring-boot-starter-parent</artifactId>
18+
<version>2.2.1.RELEASE</version>
19+
</parent>
20+
21+
<dependencies>
22+
<dependency>
23+
<groupId>mysql</groupId>
24+
<artifactId>mysql-connector-java</artifactId>
25+
<version>8.0.12</version>
26+
</dependency>
27+
28+
<dependency>
29+
<groupId>commons-collections</groupId>
30+
<artifactId>commons-collections</artifactId>
31+
<version>3.2.1</version>
32+
<scope>runtime</scope>
33+
</dependency>
34+
35+
<dependency>
36+
<groupId>org.springframework.boot</groupId>
37+
<artifactId>spring-boot-starter-thymeleaf</artifactId>
38+
</dependency>
39+
40+
<dependency>
41+
<groupId>org.springframework.boot</groupId>
42+
<artifactId>spring-boot-starter-web</artifactId>
43+
</dependency>
44+
<dependency>
45+
<groupId>org.springframework.boot</groupId>
46+
<artifactId>spring-boot-starter-test</artifactId>
47+
<scope>test</scope>
48+
</dependency>
49+
<dependency>
50+
<groupId>org.springframework.cloud</groupId>
51+
<artifactId>spring-cloud-starter-config</artifactId>
52+
</dependency>
53+
<dependency>
54+
<groupId>org.springframework.boot</groupId>
55+
<artifactId>spring-boot-starter-actuator</artifactId>
56+
</dependency>
57+
<dependency>
58+
<groupId>org.springframework.cloud</groupId>
59+
<artifactId>spring-cloud-starter</artifactId>
60+
</dependency>
61+
<dependency>
62+
<groupId>org.springframework.boot</groupId>
63+
<artifactId>spring-boot-starter-data-jpa</artifactId>
64+
</dependency>
65+
</dependencies>
66+
67+
<dependencyManagement>
68+
<dependencies>
69+
<dependency>
70+
<groupId>org.springframework.cloud</groupId>
71+
<artifactId>spring-cloud-dependencies</artifactId>
72+
<version>Greenwich.SR4</version>
73+
<type>pom</type>
74+
<scope>import</scope>
75+
</dependency>
76+
</dependencies>
77+
</dependencyManagement>
78+
79+
<build>
80+
<plugins>
81+
<plugin>
82+
<groupId>org.springframework.boot</groupId>
83+
<artifactId>spring-boot-maven-plugin</artifactId>
84+
<configuration>
85+
<fork>false</fork><!--这里注意这里必须是 false 调试-->
86+
</configuration>
87+
</plugin>
88+
</plugins>
89+
</build>
90+
91+
</project>
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module type="JAVA_MODULE" version="4" />
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package code.landgrey;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
7+
@SpringBootApplication
8+
public class Application {
9+
10+
11+
public static void main(String[] args) {
12+
SpringApplication.run(Application.class, args);
13+
}
14+
}
Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
package code.landgrey.commands;
2+
3+
4+
import java.math.BigDecimal;
5+
6+
7+
public class ProductForm {
8+
private Long id;
9+
private String description;
10+
private BigDecimal price;
11+
private String imageUrl;
12+
13+
public Long getId() {
14+
return id;
15+
}
16+
17+
public void setId(Long id) {
18+
this.id = id;
19+
}
20+
21+
public String getDescription() {
22+
return description;
23+
}
24+
25+
public void setDescription(String description) {
26+
this.description = description;
27+
}
28+
29+
public BigDecimal getPrice() {
30+
return price;
31+
}
32+
33+
public void setPrice(BigDecimal price) {
34+
this.price = price;
35+
}
36+
37+
public String getImageUrl() {
38+
return imageUrl;
39+
}
40+
41+
public void setImageUrl(String imageUrl) {
42+
this.imageUrl = imageUrl;
43+
}
44+
}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /