diff --git a/Dockerfile b/Dockerfile index f348b16..86a899b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,3 +1,8 @@ +FROM maven:3-jdk-10-slim AS build +COPY src /usr/src/app/src +COPY pom.xml /usr/src/app +RUN mvn -f /usr/src/app/pom.xml clean package + FROM tomcat:7 MAINTAINER piesecurity ENV ADMIN_USER="mark" @@ -6,5 +11,5 @@ ENV ADMIN_PASSWORD="jigsawroxx" RUN set -ex \ && rm -rf /usr/local/tomcat/webapps/* \ && chmod a+x /usr/local/tomcat/bin/*.sh -COPY target/struts2-rest-showcase.war /usr/local/tomcat/webapps/ROOT.war +COPY --from=build /target/struts2-rest-showcase.war /usr/local/tomcat/webapps/ROOT.war EXPOSE 8080 diff --git a/README.md b/README.md index 415b3fb..bc36c91 100644 --- a/README.md +++ b/README.md @@ -4,17 +4,16 @@ Completely based on https://github.com/piesecurity/apache-struts2-CVE-2017-5638 ### Usage: -Pre-requisites: have python, docker, maven and a jdk installed +Pre-requisites: have python, docker 17.03 => 1. clone this repo -1. run mvn clean package in project root 1. run docker build -t hack \. 1. run docker run -d -p 8080:8080 hack 1. once container comes online - verify by running in browser -To begin testing RCE - run the exploit.py file. +To begin testing RCE - run the exploit.py file. -1. python exploit.py http://myserver:8080/orders/3 "CMD" +1. python exploit.py http://myserver:8080/orders/3 "CMD" Try with different CMDs like * pwd - where are we? @@ -30,7 +29,7 @@ README.txt - Rest Showcase Webapp Rest Showcase is a simple example of REST app build with the REST plugin. -For more on getting started with Struts, see +For more on getting started with Struts, see * http://cwiki.apache.org/WW/home.html