Add PoC exploit for CVE-2018-11776

[postmodern]

Add a PoC exploit for CVE-2018-11776, remote code execution in Apache Struts versions 2.3 - 2.3.34 and 2.5 - 2.5.16.

Reference PoCs

• https://gitee.com/mirrors_mazen160/struts-pwn_CVE-2018-11776/blob/master/struts-pwn.py#L174
• https://gitee.com/chenjiew/CVE-2018-11776-Python-PoC (contains Dockerfile)
  • https://gitee.com/chenjiew/CVE-2018-11776-Python-PoC/blob/master/exploitS2-057-cmd.py
• https://github.com/freshdemo/ApacheStruts-CVE-2018-11776 (contains Dockerfile)
  • https://github.com/freshdemo/ApacheStruts-CVE-2018-11776/blob/master/exploit.py

Vuln App

• https://github.com/vulhub/vulhub/tree/639e32be6c0425b11d7d56594761c5e599a6a9d5/struts2/s2-057
• https://gitee.com/chenjiew/CVE-2018-11776-Python-PoC
• https://github.com/freshdemo/ApacheStruts-CVE-2018-11776

How to Submit a PoC

See the CONTRIBUTING file for instructions on how to submit a PoC exploit.