From 4129693f563feaec085f326112948d1acb0a1a70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herv=C3=A9=20Boutemy?= <herve.boutemy@free.fr>
Date: Wed, 15 May 2019 18:20:08 -0400
Subject: [PATCH] little improvements while preparing a workshop (#4)

* cleanup

* skip rat by default in pom.xml

* roll back to 2.5.10

* improved README

* added link to Struts rest showcase source
---
 .DS_Store   | Bin 6148 -> 0 bytes
 .README.swp | Bin 12288 -> 0 bytes
 .gitignore  |   6 ------
 Jenkinsfile |   4 ++--
 README.md   |  30 +++++++++++++++++-------------
 pom.xml     |  29 +++++++++++++++--------------
 6 files changed, 34 insertions(+), 35 deletions(-)
 delete mode 100644 .DS_Store
 delete mode 100644 .README.swp

diff --git a/.DS_Store b/.DS_Store
deleted file mode 100644
index a2642c8fd79ed76c285d70e7fec747729309f37b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 6148
zcmeHKJ8r`;3?&<*2#_UXMqME{5RCK$xj;WovJ^1TxVxvGt4HhOXGq|5bB6|x0QDq_
zPlDcHnj)g@XSWqui^vjgC|@>A&GyYF_K*<;!g0nyhGTbrd+q!8N%rl4aUW%n7x|FW
zCEqq^RDcRl0V+TRsKD$BWQkp_W<Qw+QUNOP-xaX$LxCIC#4*r69T>a?05%A_VeY*I
zuvh?C6URVAU>a0lP&Hc&4Laf_^J?N47<AEWJ~VIE>`>Hi$N9z6MQb2ODnJFU6<EY_
zZT0^N{!9OVP2!3QP=UKrK%3ou*WyW8TPKgRT3g`HaLf6In_=!03|@|bUXHP_a=h`R
b$SXF-eoY($osPKEf&3XTU1(I`uNC+K_F)x`

diff --git a/.README.swp b/.README.swp
deleted file mode 100644
index f6d9ea3484fdd726b48e13a0c983fa1c4ef2e5de..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 12288
zcmeI%%L;-(6oBEeeH8TqUDj%sMbWOvMGGSW+nYs%lBMIeUbBZONUMQ}+PM+_0X@uN
z=5YLA7K7`~YGyZvMn|Nhn!R3QFxSLB@O@V%QF7QGRQ^|-W$R+ycD+d$`uZXYjUe>g
z;Ct=)v!J=#OEZ>HBIBMOd0TU7ji<Kty@xph2;?PDcKW^U^QgC5%|^ZE<W-nD2q1s}
z0tg_000IagPyhjW)Wjw2v-Iv&MeRLTu>hY!iwGcq00IagfB*srAb<b@2q5rBz}*OO
rtq5^TpX~p?y8qu*?$18b2q1s}0tg_000IagfB*srAW#s2(Mdc2DQ+h$

diff --git a/.gitignore b/.gitignore
index ea47897..6b7c8cd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,3 @@
-/target/antrun/
-/target/classes/
-/target/generated-*/
-/target/maven-*/
-/target/struts2*/
-/target/test-classes/
 /.apt_generated/
 .settings/
 .vscode/
diff --git a/Jenkinsfile b/Jenkinsfile
index b2177c9..a4e1d27 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -23,9 +23,9 @@ node () {
       // Run the maven build
       try{
         if (isUnix()) {
-           sh "./mvnw  -B -Dmaven.test.failure.ignore -Drat.skip=true -f pom.xml clean package -U"
+           sh "./mvnw  -B -Dmaven.test.failure.ignore clean package"
         } else {
-           bat(/mvnw.cmd -B -Dmaven.test.failure.ignore -Drat.skip=true clean package/)
+           bat("mvnw.cmd -B -Dmaven.test.failure.ignore clean package")
         }
         
         currentBuild.result = 'SUCCESS'
diff --git a/README.md b/README.md
index 9cf672b..b5d6e73 100644
--- a/README.md
+++ b/README.md
@@ -5,34 +5,37 @@
 Completely based on https://github.com/piesecurity/apache-struts2-CVE-2017-5638
 
 ### Usage:
-Pre-requisites: have docker, and a jre installed
+Pre-requisites: have Docker and a JRE installed, and Python if not on Mac
 
 1. fork this repo
-1. run ./mvnw clean package in project root
-1. run docker build -t hack \.
-1. run docker run -d -p 9080:8080 hack
+1. run `./mvnw clean package` in project root
+1. run `docker build -t hack \.`
+1. run `docker run -d -p 9080:8080 hack`
 1. once container comes online - verify by running in browser http://localhost:9080
 
 To begin testing RCE - run the exploit.py file.
 
-1. python exploit.py http://localhost:9080/orders/3 "CMD" 
+1. `python exploit.py http://localhost:9080/orders/3 "CMD"` or if on a Mac you can run `./dist/exploit http://localhost:9080/orders/3 "CMD"`
 
 Try with different CMDs like
-* pwd - where are we?
-* whomai - what user are we running this?
-* ls -la - what's in my directory?
-* ls / - what's my machine
-* ls /etc - what else we can find?
+* `pwd` - where are we?
+* `whomai` - what user are we running this?
+* `ls -la` - what's in my directory?
+* `ls /` - what's my machine
+* `ls /etc` - what else we can find?
 
 ## How to Fix!
 Use the Nexus Lifecycle Component Information Panel to identify a non-vulnerable version of struts2-core. 
-Update the POM to that version and rebuild.You can also rebuild the docker image and run it to retry the attack.
+Update the POM to that version and rebuild. You can also rebuild the Docker image and run it to retry the attack.
 
 Also, look in the Issues here to see DepShield findings
 
 
-### Original readme
-===========================================================================
+## Original readme
+
+https://github.com/apache/struts/tree/master/apps/rest-showcase
+
+```
 README.txt - Rest Showcase Webapp
 
 Rest Showcase is a simple example of REST app build with the REST plugin.
@@ -48,3 +51,4 @@ in an environment where the default locale is set to English. This means that
 the default messages defined in package.properties are in English. If the default
 locale for your server is different, then rename package.properties to package_en.properties
 and create a new package.properties with proper values for your default locale.
+```
diff --git a/pom.xml b/pom.xml
index e776523..c186d2e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.5.20</version>
+        <version>2.5.10</version>
     </parent>
 
     <artifactId>struts2-rest-showcase</artifactId>
@@ -35,21 +35,21 @@
     <description>Struts 2 Rest Showcase Example</description>
 
     <distributionManagement>
-       <snapshotRepository>
-    <id>nexus</id>
-    <url>http://18.188.100.16:8081/repository/maven-snapshots/</url>
-    </snapshotRepository>
-     <repository>
-    <id>nexus</id>
-    <url>http://18.188.100.16:8081/repository/maven-releases/</url>
-    </repository>
+        <snapshotRepository>
+            <id>nexus</id>
+            <url>http://18.188.100.16:8081/repository/maven-snapshots/</url>
+        </snapshotRepository>
+        <repository>
+            <id>nexus</id>
+            <url>http://18.188.100.16:8081/repository/maven-releases/</url>
+        </repository>
     </distributionManagement>
 
     <dependencies>
         <dependency>
             <groupId>org.apache.struts</groupId>
             <artifactId>struts2-rest-plugin</artifactId>
-	</dependency>
+	    </dependency>
         <dependency>
             <groupId>org.apache.struts</groupId>
             <artifactId>struts2-convention-plugin</artifactId>
@@ -59,10 +59,10 @@
             <artifactId>struts2-config-browser-plugin</artifactId>
         </dependency>
         <dependency>
-        <groupId>com.lowagie</groupId>
-        <artifactId>itext</artifactId>
-        <version>4.2.2</version>
-    </dependency>
+            <groupId>com.lowagie</groupId>
+            <artifactId>itext</artifactId>
+            <version>4.2.2</version>
+        </dependency>
 
         <!-- Logging -->
         <dependency>
@@ -147,5 +147,6 @@
     </build>
     <properties>
     	<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <rat.skip>true</rat.skip>
     </properties>
 </project>