pixel-defaultbr/cve-2023-50164
This exploit was developed specifically for the Strutted lab from HackTheBox, aiming to exploit the vulnerability CVE-2023-50164 in Apache Struts 2. The flaw allows path traversal through a fault in handling file upload parameters. The exploit was created with the purpose of demonstrating how an attacker can upload malicious files and achieve remote code execution (RCE).
This exploit was developed exclusively for educational purposes within the controlled environment of HackTheBox and should not be used on real systems without explicit permission. Exploiting vulnerabilities without consent is illegal and unethical.
The objective of this exploit is to demonstrate how the flaw in Apache Struts 2, specifically in the file upload endpoint, can be exploited to:
The vulnerability CVE-2023-50164 is associated with incorrect handling of file upload parameters, allowing an attacker to manipulate the uploaded file name to perform path traversal.
HTTP Parameter Manipulation: The exploit modifies HTTP parameters to include directory traversal characters (../), allowing the upload of a malicious file to an unauthorized folder.
Malicious File Upload: The exploit sends a malicious file using the POST method to the /upload.action endpoint, exploiting the case sensitivity flaw of HTTP parameters.
Remote Code Execution: The attacker can inject malicious code that will be executed on the server after the upload.
Below is an example of an HTTP request that can be used to exploit the vulnerability:
POST /upload.action HTTP/1.1
Host: vulnerable-server.com
Content-Type: multipart/form-data; boundary=------------------------abcdef
--------------------------abcdef
Content-Disposition: form-data; name="Upload"; filename="img.png"
Content-Type: application/octet-stream
PNG
--------------------------abcdef
Content-Disposition: form-data;
Content-Type: application/octet-stream
../../shell.jsp
--------------------------abcdef--