cucadili/cve-2018-11776Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications.
Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications.
Install and Exploiting https://github.com/hook-s3c/CVE-2018-11776-Python-PoC
In the file "test.rules " presents a rule for the Suricata utility. The rule allows network traffic to detect exploitable vulnerabilities.
The rule is connected in the /etc/suricata/suricata file.yaml:
default-rule-path: /etc/suricata
rule-files:
- test.rules
RUN:
suricata -c /etc/suricata/suricata.yaml –i docker0
Log /var/log/suricata/fast.log
The kernel module blocks malicious network packets and writes to a log file. The module handles only incoming traffic. The processing function finds TCP packets, identifies in the data field whether the HTTP request is a GET request, and if it is, checks whether the packet contains a previously defined signature. Install
sudo insmod module_kernel.ko
Output results
sudo dmesg