CVE-2018-11776 PoC — Apache Struts 输入验证错误漏洞

Description

Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications.

介绍

# CVE-2018-11776
Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications.

Install and Exploiting
<https://github.com/hook-s3c/CVE-2018-11776-Python-PoC>

# Suricata
In the file "test.rules " presents a rule for the Suricata utility. The rule allows network traffic to detect exploitable vulnerabilities.
The rule is connected in the `/etc/suricata/suricata file.yaml`:
```
    default-rule-path: /etc/suricata 
    rule-files: 
     - test.rules
```
RUN:
```
suricata -c /etc/suricata/suricata.yaml –i docker0
```
Log `/var/log/suricata/fast.log`
![alt text](log.PNG "Screenshot log suricata")

# Kernel module
The kernel module blocks malicious network packets and writes to a log file.
The module handles only incoming traffic. The processing function finds TCP packets, identifies in the data field whether the HTTP request is a GET request, and if it is, checks whether the packet contains a previously defined signature.
Install
```
sudo insmod module_kernel.ko
```
Output results
```
sudo dmesg
```

文件快照

备注