=Start=<\/p>\n
\u8bb0\u5f97\u6211\u521a\u6bd5\u4e1a\u7684\u65f6\u5019Struts2\u7206\u51fa\u4e86\u4e00\u4e2a\u9ad8\u5371\u6f0f\u6d1e(Struts2-016)\uff0c\u4ece\u6b64\uff0cStruts2\u6846\u67b6\u5c31\u8d70\u8fdb\u4e86\u6211\u7684\u89c6\u7ebf\uff0c\u6ca1\u60f3\u52304\u5e74\u8fc7\u53bb\u4e86\uff0c\u5b83\u4f9d\u7136\u4fdd\u6301\u7740\u6bcf\u5e74\u51e0\u4e2a\u9ad8\u5371\u6f0f\u6d1e\u7684\u9891\u7387\u548c\u8d8b\u52bf\uff0c\u4e0d\u8d1f\u300c\u6f0f\u6d1e\u4e4b\u738b\u300d\u7684\u79f0\u53f7\u3002<\/p>\n
\u8fd9\u7bc7\u6587\u7ae0\u4e3b\u8981\u5c31\u662f\u8bb0\u5f55\u4e00\u4e0b\u8fd1\u5e74\u6765\u51fa\u73b0\u7684\u548cStruts2\u76f8\u5173\u7684\u9ad8\u5371\u6f0f\u6d1e\uff0c\u4ee5\u53ca\u4e00\u4e9b\u6f0f\u6d1e\u9a8c\u8bc1POC\/EXP\uff0c\u65b9\u4fbf\u5e73\u65f6\u8fdb\u884c\u6d4b\u8bd5\u3002<\/p>\n
Struts2-Security_Bulletins\uff08Struts2\u6846\u67b6\u7684\u6f0f\u6d1e\u516c\u544a\u677f\uff09 S2-016 \u2014 A vulnerability introduced by manipulating parameters prefixed with “action:”\/”redirect:”\/”redirectAction:” allows remote command execution<\/strong><\/span> S2-029 \u2014 Forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution<\/strong><\/span>. S2-032 \u2014 Remote Code Execution can be performed<\/span> via method: prefix when Dynamic Method Invocation is enabled. S2-033 \u2014 Remote Code Execution can be performed<\/span> when using REST Plugin with ! operator when Dynamic Method Invocation is enabled. S2-036 \u2014 Forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution<\/span><\/strong> (similar to S2-029) S2-037 \u2014 Remote Code Execution can be performed<\/span> when using REST Plugin. S2-045 \u2014 Possible Remote Code Execution<\/strong><\/span> when performing file upload based on Jakarta Multipart parser. S2-046 \u2014 Possible RCE<\/strong><\/span> when performing file upload based on Jakarta Multipart parser (similar to S2-045) ==== [\u66f4\u65b0]Struts2\u518d\u7206\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08S2-016\uff09 Struts2\u6700\u8fd1\u51e0\u4e2a\u6f0f\u6d1e\u5206\u6790&\u7a33\u5b9a\u5229\u7528Payload Struts2 S2-029\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u521d\u63a2 Struts2 S2 \u2013 032\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u5206\u6790 \u6f0f\u6d1e\u9884\u8b66\uff1aStruts 2\u518d\u66dd\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1eS2-037\uff08CVE-2016-4438\uff09 \u3010\u6f0f\u6d1e\u9884\u8b66\u3011Apache Struts2\u518d\u66dd\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08S2-046 \u9644PoC\uff09 Struts2 \u5386\u53f2 RCE \u6f0f\u6d1e\u56de\u987e\u4e0d\u5b8c\u5168\u7cfb\u5217 StrutsHoneypot\uff1aStruts2\u7684\u871c\u7f50 \u5feb\u901f\u642d\u5efaStruts2\u6f0f\u6d1e\u6f14\u793a\u73af\u5883(S2-032\/033\/037\/devMode) \u3010\u6f0f\u6d1e\u9884\u8b66\u3011Struts 2 \u88ab\u7206\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e S2-045 Struts 2\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u6f0f\u6d1eS2-046 VulApps: \u5feb\u901f\u642d\u5efa\u5404\u79cd\u6f0f\u6d1e\u73af\u5883 Struts2 \u5386\u53f2\u7248\u672c\u7684\u6f0f\u6d1e\u73af\u5883 Struts2\u547d\u4ee4\u6267\u884c\u5404\u7248\u672c\u8bb0\u5f55 Struts2 S2-045 \u6f0f\u6d1e\u73af\u5883 \u652f\u6301\u5bf9\u4ee5\u4e0b\u7248\u672c\u7684\u68c0\u6d4b: ST2-005 ST2-009 ST2-013 ST2-016 ST2-019 ST2-devmode ST2-032 ST2-037 ST2-045 ====<\/p>\n s2-016,s2-019,s2-020 https:\/\/github.com\/tony1016\/s2-032-exploit<\/a><\/p>\n https:\/\/github.com\/tengzhangchao\/Struts2_045-Poc<\/a><\/p>\n https:\/\/github.com\/jas502n\/st2-046-poc<\/a><\/p>\n https:\/\/github.com\/coffeehb\/Some-PoC-oR-ExP\/tree\/master\/Struts2<\/a> # s2-017\/020\/032\/033\/037<\/p>\n https:\/\/github.com\/crown-prince\/Go_Struts2<\/a><\/p>\n [\u539f\u521b]K8 Struts2 Exp 20170310 S2-045(Struts2\u7efc\u5408\u6f0f\u6d1e\u5229\u7528\u5de5\u5177) =END=<\/p>\n","protected":false},"excerpt":{"rendered":" =Start= \u7f18\u7531\uff1a \u8bb0\u5f97\u6211\u521a\u6bd5\u4e1a\u7684\u65f6\u5019Struts2\u7206\u51fa\u4e86\u4e00\u4e2a\u9ad8\u5371\u6f0f\u6d1e(Struts2-016)\uff0c\u4ece\u6b64\uff0cS […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,25],"tags":[672,784,781,37,782],"class_list":["post-3282","post","type-post","status-publish","format-standard","hentry","category-knowledgebase-2","category-security","tag-exp","tag-poc","tag-rce","tag-security","tag-struts2"],"views":10848,"_links":{"self":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/comments?post=3282"}],"version-history":[{"count":1,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3282\/revisions"}],"predecessor-version":[{"id":3283,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3282\/revisions\/3283"}],"wp:attachment":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/media?parent=3282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/categories?post=3282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/tags?post=3282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nhttps:\/\/struts.apache.org\/docs\/security-bulletins.html<\/a><\/p>\n
\nhttps:\/\/struts.apache.org\/docs\/s2-016.html<\/a><\/p>\n
\nhttps:\/\/struts.apache.org\/docs\/s2-029.html<\/a><\/p>\n
\nhttps:\/\/struts.apache.org\/docs\/s2-032.html<\/a><\/p>\n
\nhttps:\/\/struts.apache.org\/docs\/s2-033.html<\/a><\/p>\n
\nhttps:\/\/struts.apache.org\/docs\/s2-036.html<\/a><\/p>\n
\nhttps:\/\/struts.apache.org\/docs\/s2-037.html<\/a><\/p>\n
\nhttps:\/\/struts.apache.org\/docs\/s2-045.html<\/a><\/p>\n
\nhttps:\/\/struts.apache.org\/docs\/s2-046.html<\/a><\/p>\n
\nsite:freebuf.com struts2 \u8fdc\u7a0b \u4ee3\u7801 \u6267\u884c
\nStruts2 exp genxor
\n====<\/p>\n
\nhttp:\/\/www.freebuf.com\/vuls\/11220.html<\/a>
\nhttps:\/\/struts.apache.org\/docs\/s2-016.html<\/a> # S2-016 (2013-07-17)<\/p>\n
\nhttp:\/\/www.freebuf.com\/articles\/web\/25337.html<\/a><\/p>\n
\nhttp:\/\/www.freebuf.com\/vuls\/99234.html<\/a>
\nS2-029 Struts2 \u6807\u7b7e\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u5206\u6790\uff08\u542bPOC\uff09
\nhttp:\/\/www.freebuf.com\/vuls\/99432.html<\/a><\/p>\n
\nhttp:\/\/www.freebuf.com\/vuls\/102836.html<\/a><\/p>\n
\nhttp:\/\/www.freebuf.com\/news\/106954.html<\/a><\/p>\n
\nhttp:\/\/www.freebuf.com\/vuls\/129871.html<\/a><\/p>\n
\nhttp:\/\/rickgray.me\/2016\/05\/06\/review-struts2-remote-command-execution-vulnerabilities.html<\/a><\/p>\n
\nhttp:\/\/www.mottoin.com\/99098.html<\/a><\/p>\n
\nhttp:\/\/www.mottoin.com\/85519.html<\/a><\/p>\n
\nhttp:\/\/www.mottoin.com\/97954.html<\/a><\/p>\n
\nhttp:\/\/www.mottoin.com\/98591.html<\/a><\/p>\n
\nhttp:\/\/www.mottoin.com\/88838.html<\/a><\/p>\n
\nhttps:\/\/github.com\/0kami\/Struts2Environment<\/a><\/p>\n
\nhttp:\/\/blog.0kami.cn\/2017\/01\/13\/Struts2-history-payload\/<\/a><\/p>\n
\nhttps:\/\/github.com\/mottoin\/S2-045<\/a><\/p>\n
\nhttps:\/\/github.com\/Lucifer1993\/struts-scan<\/a><\/p>\n
\nhttps:\/\/github.com\/zj–2095\/struts2-exp<\/a><\/p>\n
\n# \u652f\u6301\u6f0f\u6d1e (S2-045 devMode S2-032 s2-020 s2-019 s2-016 s2-013 s2-009 S2-005)
\nhttp:\/\/qqhack8.blog.163.com\/blog\/static\/1141479852014631102759126\/<\/a><\/p>\n\u53c2\u8003\u94fe\u63a5\uff1a<\/h5>\n
\n