Merge pull request #85 from fengyehack/master

Merge pull request #1 from fofapro/master
fofapro · Jun 19, 2020 · 35105c6 · 35105c6
2 parents 4b47a91 + 9751964
commit 35105c6
Show file tree

Hide file tree

Showing 23 changed files with 145 additions and 0 deletions.
diff --git a/writeup/CVE-2017-8046/CVE-2017-8046.md b/writeup/CVE-2017-8046/CVE-2017-8046.md
@@ -0,0 +1,51 @@
+# Spring Data REST PATCH请求代码执行漏洞
+
+## 一、漏洞描述
+
+Spring Data REST是Spring Data项目的一部分，可以轻松地在Spring Data存储库之上构建超媒体驱动的REST Web服务。
+
+恶意的PATCH请求使用精心构造的JSON数据提交到spring-data-rest服务可以执行任意JAVA代码  
+
+## 二、漏洞影响范围
+
+Spring Data REST versions prior to 2.5.12, 2.6.7, 3.0 RC3
+
+可以查看spring-data-rest-webmvc jar包的版本
+
+## 三、漏洞复现
+
+启动Vulfocus靶场
+
+![](./image-20200614163341.png)
+
+访问
+
+![](./image-20200614165319492.png)
+
+
+
+先利用 POST 请求添加一个数据
+
+Content-Type: application/json
+
+{"firstName": "Vulfocus", "lastName": "Vulfocus"}
+
+![](./image-20200614174222206.png)
+
+
+PATCH请求
+
+Content-Type: application/json-patch+json
+
+利用代码执行漏洞 反弹shell
+
+![](./image-20200614184142866.png)
+
+成功
+
+![](./image-20200614184235237.png)
+
+
+获取flag
+
+![](./image-20200614184505493.png)
diff --git a/writeup/CVE-2017-8046/image-20200614163341.png b/writeup/CVE-2017-8046/image-20200614163341.png
diff --git a/writeup/CVE-2017-8046/image-20200614165319492.png b/writeup/CVE-2017-8046/image-20200614165319492.png
diff --git a/writeup/CVE-2017-8046/image-20200614174222206.png b/writeup/CVE-2017-8046/image-20200614174222206.png
diff --git a/writeup/CVE-2017-8046/image-20200614184142866.png b/writeup/CVE-2017-8046/image-20200614184142866.png
diff --git a/writeup/CVE-2017-8046/image-20200614184235237.png b/writeup/CVE-2017-8046/image-20200614184235237.png
diff --git a/writeup/CVE-2017-8046/image-20200614184505493.png b/writeup/CVE-2017-8046/image-20200614184505493.png
diff --git a/writeup/CVE-2018-1273/CVE-2018-1273.md b/writeup/CVE-2018-1273/CVE-2018-1273.md
@@ -0,0 +1,51 @@
+# Spring Data Commons 代码执行漏洞
+
+## 一、漏洞描述
+
+Spring Data是Spring框架中提供底层数据访问的项目模块，Spring Data Commons是一个共用的基础模块。此模块对特殊属性处理时会使用SpEl表达式，导致攻击者可以通 过构造特殊的URL请求，造成服务端远程代码执行。
+
+
+
+## 二、漏洞影响版本
+
+Spring Data Commons 1.13 - 1.13.10(Ingalls SR10)
+
+Spring Data REST 2.6 - 2.6.10 (Ingalls SR10)
+
+Spring Data Commons 2.0 - 2.0.5 (Kay SR5)
+
+Spring Data REST 3.0 - 3.0.5 (Kay SR5)
+
+已不支持的旧版本
+
+
+
+## 三、漏洞复现
+
+启动Vulfocus
+
+![](./image-20200614190741458.png)
+
+访问/users
+
+![](./image-20200614191635397.png)
+
+填写信息 点击Register user 然后抓包
+
+利用存在的代码执行漏洞反弹shell：
+
+下载nc命令脚本
+![](./image-20200614200135920.png)
+
+
+再执行该脚本
+![](./image-20200614200341186.png)
+
+反弹成功
+
+![](./image-20200614200415902.png)
+
+获取flag
+
+![](./image-20200614200816753.png)
+
diff --git a/writeup/CVE-2018-1273/image-20200614190741458.png b/writeup/CVE-2018-1273/image-20200614190741458.png
diff --git a/writeup/CVE-2018-1273/image-20200614191635397.png b/writeup/CVE-2018-1273/image-20200614191635397.png
diff --git a/writeup/CVE-2018-1273/image-20200614200135920.png b/writeup/CVE-2018-1273/image-20200614200135920.png
diff --git a/writeup/CVE-2018-1273/image-20200614200341186.png b/writeup/CVE-2018-1273/image-20200614200341186.png
diff --git a/writeup/CVE-2018-1273/image-20200614200415902.png b/writeup/CVE-2018-1273/image-20200614200415902.png
diff --git a/writeup/CVE-2018-1273/image-20200614200816753.png b/writeup/CVE-2018-1273/image-20200614200816753.png
diff --git a/writeup/README.md b/writeup/README.md
@@ -48,3 +48,8 @@
 
 [CVE-2020-1956](./CVE-2020-1956/CVE-2020-1956.md)  by [xiajibaxie](https://github.com/xiajibaxie)
 
+[SpringBoot_SpEL表达式注入漏洞](./SpringBoot_SpEL表达式注入漏洞/SpringBoot_SpEL表达式注入漏洞.md)  by [fengyehack](https://github.com/fengyehack)
+
+[CVE-2018-1273](./CVE-2018-1273/CVE-2018-1273.md)  by [fengyehack](https://github.com/fengyehack)
+
+[CVE-2017-8046](./CVE-2017-8046/CVE-2017-8046.md)  by [fengyehack](https://github.com/fengyehack)
diff --git a/writeup/SpringBoot_SpEL表达式注入漏洞/SpringBoot_SpEL表达式注入漏洞.md b/writeup/SpringBoot_SpEL表达式注入漏洞/SpringBoot_SpEL表达式注入漏洞.md
@@ -0,0 +1,38 @@
+# Spring Boot whitelabel-error-page SpEl 代码执行漏洞
+
+## 一、漏洞描述
+
+Spring是一款轻量级Java开发框架。Spring Boot是Spring 的一个核心子项目，其设计目的是用于简化新Spring应用的初始搭建以及开发过程。 由于SpelView类中的exactMatch参数未严格过滤，Spring Boot framework 对异常处理不当在同时开启whitelabel page，会造成异常请求中注入SPEL执行。当用户采用Spring Boot启动Spring MVC项目后，Spring Boot默认异常模板在处理异常信息时，会递归解析SPEL表达式，可导致SPEL表达式注入并执行。攻击者利用此漏洞，通过SPEL即可在服务器端实现指令注入(执行代码)。
+
+## 二、漏洞影响版本
+
+Spring Boot 1.1-1.3.0的版本
+
+## 三、漏洞复现
+
+启动Vulfocus
+
+![](./image-20200614202736807.png)
+
+![](./image-20200614202901979.png)
+
+点击这个链接，出现了拼接的字符，证明漏洞存在。
+
+![](./image-20200614202940611.png)
+
+直接反弹shell：
+
+出现这个代表代码执行成功
+
+![](./image-20200614204043236.png)
+
+![](./image-20200614204205954.png)
+
+成功拿到shell
+
+![](./image-20200614204135089.png)
+
+获取flag
+
+![](./image-20200614204355178.png)
+
diff --git a/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614202736807.png b/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614202736807.png
diff --git a/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614202901979.png b/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614202901979.png
diff --git a/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614202940611.png b/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614202940611.png
diff --git a/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614204043236.png b/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614204043236.png
diff --git a/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614204135089.png b/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614204135089.png
diff --git a/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614204205954.png b/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614204205954.png
diff --git a/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614204355178.png b/writeup/SpringBoot_SpEL表达式注入漏洞/image-20200614204355178.png