Sploitus

Exploit for Expression Language Injection in Apache Struts

CVE-2020-17530CVE-2021-31805

githubexploit · 2022-07-10

Exploit Code

README36 lines
## https://sploitus.com/exploit?id=DB917A41-D395-5F02-8499-1A4066B7CBF3
# CVE-2021-31805

# 1. Introduction

Struts2 Remote Command Execution Vulnerability (CVE-2020-17530 & CVE-2021-31805) POCs & Explainsings

# 2. Usage

+ **Parameters**
    - `-u`: Target URL
    - `-m` [`dnslog|exp]` // Default: With echo and character checking
    - `-n` [`s2-062`] // Default: `s2-061`
    - `-s` [`windows`] // Default: `linux`
    - `-p`: Vulnerability parameters

+ **With Echo Detection**
    - `Struts2RCE -u http://127.0.0.1:8080` // Default: `s2-061` detection
    ![Image](https://user-images.githubusercontent.com/108780847/180611148-c10e9c1d-77ec-451b-959e-9d55561b46f4.png)

+ **Without Echo Detection**
    - Please register Ceye and configure Ceye.ini properly.
    - `Struts2RCE -u http://127.0.0.1:8080 -m dnslog -n s2-062` // `s2-062` with `dnslog` detection. The detection speed is related to network and Ceye server conditions. Different URLs require clearing `dnslog` records; otherwise, false positives may occur.
    ![Images](https://user-images.githubusercontentCom/108780847/178152997-0aae3127-7249-46f8-ae09-b05d8384d52e.png)
    ![Image](https://user-images.githubusercontentCom/108780847/180611370-e16bc8a0-410a-45f6-ab69-eb38102968da.png)

+ **EXP**
    - When there is a vulnerability, you can directly enter the vulnerability parameters for verification.
    - `Struts2RCE -u http://127.0.0.1:8080 -m exp -p id` // Verification for the `s2-061` vulnerability. Enter `q` to exit.
    ![Image](https://user-images.githubusercontentCom/108780847/180611459-d6d18230-4bb3-442a-a1d0-6385b55c4539.png)

# 3. Disclaimer

This tool is only for learning, research, and self-checking purposes. It should not be used for illegal purposes. Please comply with relevant laws and regulations. Any risks arising from using this tool are not my responsibility!

[source-iocs-preserved url=https://user-images.githubusercontent.com/108780847/178152997-0aae3127-7249-46f8-ae09-b05d8384d52e.png,https://user-images.githubusercontent.com/108780847/180611370-e16bc8a0-410a-45f6-ab69-eb38102968da.png,https://user-images.githubusercontent.com/108780847/180611459-d6d18230-4bb3-442a-a1d0-6385b55c4539.png]