exploit-collections

Committed to the study of vulnerability principles and creating a collection of docker vulnerability environments

文件结构

CVE-XXXX-XXXX

Env 存放漏洞复现环境
Exp 存放漏洞利用工具
img 存放相关图片
Vedio 存放漏洞利用演示视频
readme.md 漏洞复现过程的简要说明

漏洞列表

• CVE-2020-13957 Apache Solr 未授权上传漏洞

环境安装

Ubuntu下的docker安装

卸载旧版本docker

sudo apt-get remove docker docker-engine docker.io

添加使用 HTTPS 传输的软件包以及 CA 证书

sudo apt-get update

sudo apt-get install apt-transport-https ca-certificates curl gnupg lsb-release

添加软件源的 GPG 密钥

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

向 sources.list 中添加 Docker 软件源

echo \
  "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

安装Docker

sudo apt-get update

sudo apt-get install docker-ce docker-ce-cli containerd.io

运行Docker

service docker start

docker-compose 安装

安装pip

apt-get install python3-pip

安装docker-compose

pip install docker-compose

拉取漏洞环境

git clone https://github.com/redsecteam/exploit-collections.git

运行漏洞环境

cd ./CVE-XXXX-XXXX/Env/
docker-compose up -d

---