关联漏洞
标题:Apache Struts 输入验证错误漏洞 (CVE-2018-11776)Description:Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。Apache Struts 2是Apache Struts的下一代产品，是在Struts 1和WebWork的技术基础上进行了合并的全新Struts 2框架，其体系结构与Struts 1差别较大。 Apache Struts 2.3版本至2.3.34版本和2.5版本至2.5.16版本中存在输入验证漏洞
Description
Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776.
介绍
# Apache Struts Vulnerability Demo (CVE-2018-11776)
## Description
Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776.
## Getting Started
To bring up the test environment, run the following command:
```
aws cloudformation create-stack \
--template-body file://cfn.yml \
--stack-name <STACK_NAME> \
--parameters \
ParameterKey=Ec2KeyName,ParameterValue=<KEY_NAME> \
ParameterKey=Linux2Ami,ParameterValue=<AMAZON_LINUX2_AMI_ID>
```
## Usage
1. Retrieve the victim and attacker IPs. Initiate SSH sessions to both:
```
# Victim public IP
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`VictimPublicIp`].OutputValue' --output text
# Attacker public IP
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`AttackerPublicIp`].OutputValue' --output text
```
2. Retrieve the command used to to check if the victim is vulnerable. Execute it on the attacker session:
```
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`CheckVuln`].OutputValue' --output text
```
3. (Optional) Retrieve the command used to see if the exploit works. Execute it on the attacker session:
```
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`RunExploit`].OutputValue' --output text
```
4. Set up the attacker machine to listen for reverse tunnels:
```
nc -lvp 31337
```
5. Retrieve the command used to force the victim initiate a reverse tunnel to the attacker:
```
aws cloudformation describe-stacks --stack-name=<STACK_NAME> \
--query 'Stacks[0].Outputs[?OutputKey==`RunReverseShell`].OutputValue' --output text
```
6. Open an additional SSH session to the attacker machine. Then, run the command retrieved in the previous step.
Return to the reverse tunnel session. You now have CLI access to the victim machine.
## Clean up
To destroy the test environment, issue the following command:
```
aws cloudformation delete-stack --stack-name <STACK_NAME>
```
# Credit
This demo is based off [hook-s3c's CVE-2018-11776-Python-PoC](https://github.com/hook-s3c/CVE-2018-11776-Python-PoC) PoC code.
文件快照
[4.0K] /data/pocs/9dd18d40980b7ff14cf934a8cf1a86e12dfcc222
├── [5.5K] cfn.yml
├── [4.0K] commands
│ ├── [ 102] download_attack_script.txt
│ ├── [ 114] run_attacks.txt
│ └── [ 79] start_container.txt
└── [2.2K] README.md
1 directory, 5 files
备注
1. 建议优先通过来源进行访问。
2. 本地 POC 快照面向订阅用户开放；当原始来源失效或无法访问时，本地镜像作为订阅权益的一部分提供。
3. 持续抓取、验证、维护这份 POC 档案需要不少投入，因此本地快照已纳入付费订阅。您的订阅是让这份资料能继续走下去的关键，由衷感谢。 查看订阅方案 →