CVE-2017-5638 PoC — Apache Struts 2 输入验证错误漏洞

Source

Associated Vulnerability

Description

This script is intended to validate Apache Struts 2 vulnerability (CVE-2017-5638), AKA Struts-Shock.

Readme

# CVE-2017-5638

This script is intended to validate Apache Struts 2 vulnerability (CVE-2017-5638), AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable

Because of its multithread capability, it's able to run 2.5k+ applications spread around the globe in less than 10 minutes. So, it can be very handy to validate enterprise applications in large scale.

# cve-2017-5638
cve-2017-5638 Vulnerable site sample

This project aims to demonstrate the CVE-2017-5638 exploitation for educational purpose.
For more informations, see [https://cwiki.apache.org/confluence/display/WW/S2-045](https://cwiki.apache.org/confluence/display/WW/S2-045)

## Legal Disclaimer

This project is made for educational and ethical testing purposes only. Attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

## Getting started

1. Start the docker container :

`docker run -d -p 8080:8080 jrrdev/cve-2017-5638:latest`

2. Download the exploit script on the attacker machine [here](https://github.com/jrrdev/cve-2017-5638/blob/master/exploit/exploit.py)

3. Run the python exploit script from the attacker machine :

`python exploit.py http://<DOCKER_HOST>:8080/hello "ls -l"`


## Usage
There are two ways to run this script, with and without threading, the only difference will the execution time. To enable the threading feature, just need to pass the thread parameter.
The first parameter must be a TXT file containing all targeted URL, one per line. Please note that these URL should be complete, for example, ```https://target.com/admin/myStrutsPage.action```


Here is a usage example without threading:
```python
struts-shock-validation.py target_urls.txt
```

Now using threads capability:
```python
struts-shock-validation.py target_urls.txt thread
```

# CVE-2017-5638
http://struts.apache.org/docs/s2-016.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017

Metasploit Framework Exploit Module for Apache Struts Content-Type exploit
Have not tested against a windows server but tested against a linux server using the payload of generic/shell_bind_tcp

# CVE-2017-5638 PoC Code in Python | DORK: ext:action
Example PoC Code for CVE-2017-5638 | Apache Struts Exploit | DORK: ext:action

USAGE: python struts.py https://victim.site dir

The initial Python Script that was Posted didn't correctly format the Content-Type Header.
I recoded the Content Type Header to properly format Content-Type:%20{Exploit}.
I also added a logging and Requests, then dumped the Object Properties to stdout.

SAMPLE OUTPUT

Check for CVE-2017-5638 by XSS.Cx

Volume in drive D has no label.
Volume Serial Number is 2A7B-A245
Directory of d:\Program Files\Apache Software Foundation\Tomcat 9.0

# CVE-2017-5638

## Table of Contents
1. [Overview](#section-features)
2. [Dependencies](#section-dependencies)
3. [Usage](#section-usage)

## [Overview](id:section-featuers)

This project is a prove-of-concept for the Apache Struts vulnerabilty.
The goal was to create software that can generate and test random IPs for the vulnerabilty described above.


Use this project on your own risk and for educational purpose only.

## [Dependencies](id:section:dependencies)

* cURL
  * cURL is used to send the crafted header to a certain IP address on a certain Port.
  
* Nmap
  * Nmap is used to create the random IP addresses that contains an open port 80 or 443.

## [Usage](id:section-usage)

**Generate random IPs and save them to a text file.**
```bash
./get_ip.sh [Number of hosts to scan] [What port to scan] [Filename to write output]
```

```bash
./get_ip.sh 10000 80 output.txt
```

**Check for vulnerability for a specific IP address.**
```bash
./struts_check.sh [ip address] [port]
```

```bash
./struts_check.sh 127.0.0.1 80
```

**Check for vulnerability for a list of IP addresses.**
```bash
./main.sh [Text file containing IP adresses] [Port]
```

```bash
./main.sh output.txt 443
```

**Execute a command on a server without the Apache struts vulnerability patch**
```bash
./struts_attack.sh [IP Adres] [Command]
```

```bash
./struts_attack.sh https://127.0.0.1 whoami

# CVE-2017-5638 PoC Code in Python | DORK: ext:action
Example PoC Code for CVE-2017-5638 | Apache Struts Exploit | DORK: ext:action

USAGE: python struts.py https://victim.site dir

The initial Python Script that was Posted didn't correctly format the Content-Type Header.
I recoded the Content Type Header to properly format Content-Type:%20{Exploit}.
I also added a logging and Requests, then dumped the Object Properties to stdout.

SAMPLE OUTPUT

Check for CVE-2017-5638 by XSS.Cx

Volume in drive D has no label.
Volume Serial Number is 2A7B-A245
Directory of d:\Program Files\Apache Software Foundation\Tomcat 9.0

## Results
it will automatically create a folder called results, and on each execution will create a dated folder containing the execution outcome. If threading is enabled, it will create on file per thread named thread_<number>, which can be ignored because when it completes it will consolidate all threads result on single TXT file with the same name (date/timestamp) as its execution folder.

File Snapshot

 [4.0K]  /data/pocs/1f64e6801a4e93da660256327db22dc33cf01a32
├── [ 931]  curl-poc-for-cve-2017-5638.txt
├── [3.0K]  cve-2017-5638.py
├── [4.0K]  docker
│   └── [  78]  entry-point.sh
├── [ 640]  Dockerfile
├── [ 99K]  example-exploit-catalina-dump-file-example-public-domain-logfile.txt
├── [4.0K]  exploit
│   └── [2.0K]  exploit.py
├── [1.1K]  LICENSE
├── [ 954]  one-line-poc.py
├── [2.1K]  pom.xml
├── [5.3K]  README.md
├── [2.9K]  sample-output.txt
├── [4.0K]  src
│   ├── [ 965]  get_ip.sh
│   ├── [4.0K]  main
│   │   ├── [4.0K]  java
│   │   │   └── [4.0K]  com
│   │   │       └── [4.0K]  github
│   │   │           └── [4.0K]  jrrdev
│   │   │               ├── [1.8K]  AppConfiguration.java
│   │   │               ├── [1.6K]  Application.java
│   │   │               └── [1.5K]  HelloWorldAction.java
│   │   └── [4.0K]  resources
│   │       ├── [ 411]  log4j2.xml
│   │       ├── [4.0K]  META-INF
│   │       │   └── [4.0K]  resources
│   │       │       ├── [4.0K]  pages
│   │       │       │   └── [ 144]  helloworld.jsp
│   │       │       └── [4.0K]  WEB-INF
│   │       │           └── [ 475]  web.xml
│   │       └── [ 555]  struts.xml
│   ├── [1.5K]  main.sh
│   ├── [1.4K]  struts_attack.sh
│   └── [1.9K]  struts_check.sh
├── [ 44K]  stdin.pl
├── [4.7K]  struts_content_type_cmd_injection.rb
├── [6.9K]  struts-pwn.py
└── [8.7K]  struts-shock-validation.py

13 directories, 26 files

Remarks