关联漏洞
标题：
Apache Struts 输入验证错误漏洞
(CVE-2018-11776)
描述：Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架，其体系结构与Struts 1差别较大。 Apache Struts 2.3版本至2.3.34版本和2.5版本至2.5.16版本中存在输入验证漏洞
描述
Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776.
介绍
# Apache Struts Vulnerability Demo (CVE-2018-11776)
## Description
Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776.
## Getting Started
To bring up the test environment, run the following command:
```
aws cloudformation create-stack \
--template-body file://cfn.yml \
--stack-name <STACK_NAME> \
--parameters \
ParameterKey=Ec2KeyName,ParameterValue=<KEY_NAME> \
ParameterKey=Linux2Ami,ParameterValue=<AMAZON_LINUX2_AMI_ID>
```
## Usage
1. Retrieve the victim and attacker IPs. Initiate SSH sessions to both:
```
# Victim public IP
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`VictimPublicIp`].OutputValue' --output text
# Attacker public IP
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`AttackerPublicIp`].OutputValue' --output text
```
2. Retrieve the command used to to check if the victim is vulnerable. Execute it on the attacker session:
```
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`CheckVuln`].OutputValue' --output text
```
3. (Optional) Retrieve the command used to see if the exploit works. Execute it on the attacker session:
```
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`RunExploit`].OutputValue' --output text
```
4. Set up the attacker machine to listen for reverse tunnels:
```
nc -lvp 31337
```
5. Retrieve the command used to force the victim initiate a reverse tunnel to the attacker:
```
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`RunReverseShell`].OutputValue' --output text
```
6. Open an additional SSH session to the attacker machine. Then, run the command retrieved in the previous step.
Return to the reverse tunnel session. You now have CLI access to the victim machine.
## Clean up
To destroy the test environment, issue the following command:
```
aws cloudformation delete-stack --stack-name <STACK_NAME>
```
# Credit
This demo is based off [hook-s3c's CVE-2018-11776-Python-PoC](https://github.com/hook-s3c/CVE-2018-11776-Python-PoC) PoC code.
文件快照
[4.0K] /data/pocs/9dd18d40980b7ff14cf934a8cf1a86e12dfcc222
├── [5.5K] cfn.yml
├── [4.0K] commands
│ ├── [ 102] download_attack_script.txt
│ ├── [ 114] run_attacks.txt
│ └── [ 79] start_container.txt
└── [2.2K] README.md
1 directory, 5 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。