Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multistage to use in dockerfile => Made life even more easyer and jdk… #10

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Multistage to use in dockerfile => Made life even more easyer and jdk… #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
FROM maven:3-jdk-10-slim AS build
COPY src /usr/src/app/src
COPY pom.xml /usr/src/app
RUN mvn -f /usr/src/app/pom.xml clean package

FROM tomcat:7
MAINTAINER piesecurity <[email protected]>
ENV ADMIN_USER="mark"
Expand All @@ -6,5 +11,5 @@ ENV ADMIN_PASSWORD="jigsawroxx"
RUN set -ex \
&& rm -rf /usr/local/tomcat/webapps/* \
&& chmod a+x /usr/local/tomcat/bin/*.sh
COPY target/struts2-rest-showcase.war /usr/local/tomcat/webapps/ROOT.war
COPY --from=build /target/struts2-rest-showcase.war /usr/local/tomcat/webapps/ROOT.war
EXPOSE 8080
9 changes: 4 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,16 @@
Completely based on https://github.com/piesecurity/apache-struts2-CVE-2017-5638

### Usage:
Pre-requisites: have python, docker, maven and a jdk installed
Pre-requisites: have python, docker 17.03 =>

1. clone this repo
1. run mvn clean package in project root
1. run docker build -t hack \.
1. run docker run -d -p 8080:8080 hack
1. once container comes online - verify by running in browser

To begin testing RCE - run the exploit.py file.
To begin testing RCE - run the exploit.py file.

1. python exploit.py http://myserver:8080/orders/3 "CMD"
1. python exploit.py http://myserver:8080/orders/3 "CMD"

Try with different CMDs like
* pwd - where are we?
Expand All @@ -30,7 +29,7 @@ README.txt - Rest Showcase Webapp

Rest Showcase is a simple example of REST app build with the REST plugin.

For more on getting started with Struts, see
For more on getting started with Struts, see

* http://cwiki.apache.org/WW/home.html

Expand Down