dustblessnotdust/cve-2024-53677-s2-067-threadMulti-threaded exploit for CVE-2024-53677 (Apache Struts S2-067) with file upload endpoint targeting, path traversal testing, and custom JSP payload injection.
Do not use the related technologies in this article for illegal testing. Any direct or indirect consequences and losses caused by the dissemination or use of the information or tools provided in this article are solely the responsibility of the user. All adverse consequences arising from this are unrelated to the author. This article is for learning purposes only.
Proof of Concept, https://github.com/TAM-K592/CVE-2024-53677-S2-067/ The following versions of Apache Struts are affected: 2.0.0 to 2.5.33, 6.0.0 to 6.3.0.2
According to the recent history of the PoC over the past few days, the final version circulating online is the base64 obfuscated version, which emerged yesterday in Chinese (2024.12.18 noon).
I made some modifications based on the original PoC
usage: CVE-2024-53677-S2-067-thread.py [-h] (-u URL | -f FILE) --upload_endpoint UPLOAD_ENDPOINT [--paths PATHS [PATHS ...]]
[--filenames FILENAMES [FILENAMES ...]] [--payload PAYLOAD] [-s THREADS] [-o OUTPUT]
S2-067 Exploit - 多线程文件上传支持并从文件中读取URL
options:
-h, --help show this help message and exit
-u URL, --url URL 目标基础URL（例如：http://example.com）
-f FILE, --file FILE 包含目标基础URL的文件路径，每行一个URL
--upload_endpoint UPLOAD_ENDPOINT
上传端点路径（例如：/uploads.action）
--paths PATHS [PATHS ...]
路径遍历测试路径
--filenames FILENAMES [FILENAMES ...]
自定义载荷文件名
--payload PAYLOAD 自定义JSP载荷内容
-s THREADS, --threads THREADS
使用的线程数量（默认: 5）
-o OUTPUT, --output OUTPUT
输出成功URL的文件路径（默认：success.txt）