rapid7/metasploit-framework — pull request #3343 by FireFart (2014-05-08 20:49:31+00:00)
Title: fixed CVE-2011-3923 - struts_code_exec_parameters 

I encountered this when participating in a hacking challenge with a vulnerable server setup. The exploit was not working correctly so I modified it and it worked. This needs to be tested, since this removes the abbility to supply additional GET parameters. I think the Problem here is, not all characters are correctly URI escaped.

You can also participate in the challenge by calling http://www.verbotengut.at/ and click on "Jetzt Anmelden" (it's free). Then you can download the LiveCD or connect your Kali via VPN to the vulnerable server.

Also the JAVA Target was not working on this one. Maybe the java target part needs some work too.

##### System Information
struts 2.3.1.1 / tomcat 5 / linux 64 bit

##### Vulnerable Web App downloaded
https://mega.co.nz/#!elhREDTA!SngiiaBC1LD_r7KyKmDrUxR-m1wd1qloU2ByGRTDJDY
the `login` webapp is vulnerable to CVE-2011-3923
Valid Username: `Peter`, Password: `Password`
I also included the libs (I zipped the whole /usr/share/tomcat5/ directory without the gemoney webapp)

##### Additional System Info:
```
sh-3.2$ java --version
java version "1.4.2"
gij (GNU libgcj) version 4.1.2 20080704 (Red Hat 4.1.2-51)

Copyright (C) 2006 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
```
```
meterpreter > sysinfo
Computer : ebanking.hacking-lab.com
OS : Linux ebanking.hacking-lab.com 2.6.18-274.18.1.el5 #1 SMP Thu Feb 9 12:45:44 EST 2012 (x86_64)
Architecture : x86_64
Meterpreter : x86/linux
```
```
sh-3.2$ cat /etc/issue
CentOS release 5.7 (Final)
Kernel \r on an \m
```