z92g/cve-2021-31805S2-061/S2-062 Struts2 远程命令执行漏洞 POC&EXP
Struts2 Remote Command Execution Vulnerability (CVE-2020-17530 & CVE-2021-31805) POC & EXP
-u target url
-m [dnslog|exp] //Default echo interface character check
-n [s2-062] //Default s2-061
-s [windows] //Default linux
-p vulnerable parameter
Struts2RCE -u http://127.0.0.1:8080 //Default s2-061 detection
Please register ceye yourself, and configure ceye.ini
Struts2RCE -u http://127.0.0.1:8080 -m dnslog -n s2-062 //s2-062 dnslog detection, detection speed depends on network and ceye server. Different URLs need to clear dnslog records, otherwise it may cause false positives.
If a vulnerability exists, you can directly input the vulnerability parameter for verification
Struts2RCE -u http://127.0.0.1:8080 -m exp -p id //s2-061 vulnerability, parameter id verification, input q to exit
This tool is only for learning, research, and self-inspection. It should not be used for illegal purposes. Please comply with relevant laws and regulations. Any risk arising from the use of this tool is not my responsibility!