Target from: CVE Network

Advanced, Rootable

CVE-2018-11776 / 0.0.0.0

5: Flags (other, 2:system, env, root)
2: Services
1,500 pts

A direct implementation of the CVE-2018-11776 for Apache Struts 2.3.34/2.5.16
#headshot

Level 7 / Senior Securitas

ElleuchX1 / 299th Place

5: Flags found
2: Services discovered
1,500 pts
201 minutes

No bio...

This is a target with direct implementation of the CVE-2018-11776 for Apache Struts 2.3.34/2.5.16 and is here to assist in developing exploits for this vulnerability.

Description

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin).

Environment details

The system is accessible at 10.0.200.169 and runs Apache Tomcat on port 8080/tcp.

JMX Service at on port 8009/tcp.

Flags can be found at:

  • /root/ETSCTF
  • /etc/passwd gecos
  • /etc/shadow password hash
  • env variable
  • http://10.0.200.169:8080/ETSCTF.html url which is also available under /usr/local/tomcat/webapps/ROOT/ETSCTF.html

NOTE: The target IS exploitable, you just need to try harder!!

References

19 Headshots (newer first)

M4sk0ff, Dych0t0m0us, AshBorn77, kobbycber, jaxafed, PufferOverflow, Muzec, Grosik, JDgodd, ElleuchX1, hacker, Pegasus, biba22, sn1per, r0b0tG4nG, TheCyberGeek, AKMalware, abosaif, hitmanalharbi

Activity Stream

Latest activity on the platform

ElleuchX1 managed to headshot [CVE-2018-11776], 37 months ago
ElleuchX1 Discovered the hidden resource of a web server for 100 points, 37 months ago
ElleuchX1 Discovered the ETSCTF username flag under an authentication database file of a server for 300 points, 37 months ago
ElleuchX1 Discovered the ETSCTF flag from a password file of a server for 300 points, 37 months ago
ElleuchX1 Gained access to data stored in environmental variables of CVE-2018-11776 for 300 points, 37 months ago
ElleuchX1 Got access to the /root folder of CVE-2018-11776 for 500 points, 37 months ago
ElleuchX1 Discovered a JMX service, 37 months ago
ElleuchX1 Discovered a web service, 37 months ago