Proof-of-Concept exploit for Apache Struts S2-052 (CVE-2017-9805) XML Deserialization Remote Code Execution. Created while solving the INE eWPTX Practice Range lab. Includes custom payloads, reverse shell exploit script, and step-by-step exploitation examples.
This repository demonstrates exploitation of Apache Struts S2-052 (CVE-2017-9805) using malicious XML deserialization.
The exploit was developed while solving the INE eWPTX Practice Range – Struts XML Deserialization RCE lab.
Apache Struts REST plugin uses XStream to deserialize XML requests.
When the application processes XML with:
Content-Type: application/xml
An attacker can supply a malicious serialized object graph which triggers execution of arbitrary commands via:
java.lang.ProcessBuilder
This results in Remote Command Execution (RCE).
Client Request ↓ Struts REST Plugin ↓ XStream XML Deserialization ↓ Malicious Object Graph ↓ ProcessBuilder.start() ↓ Remote Code Execution
Platform: INE eWPTX Practice Range
Challenge: Struts XML Deserialization RCE
Struts 2.1.6 – 2.3.33 Struts 2.5 – 2.5.12
