题目环境

Dockerfile

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
FROM tomcat:8.5-jre8

RUN apt-get update && apt-get install -y curl netcat && rm -rf /var/lib/apt/lists/*

COPY S2-005.war /usr/local/tomcat/webapps/ROOT.war

RUN echo '#!/bin/bash\n\
if [ -n "$FLAG" ]; then\n\
    echo "$FLAG" > /flag\n\
    chmod 444 /flag\n\
    echo "[+] Flag written to /flag"\n\
else\n\
    echo "[-] FLAG environment variable is empty!" > /flag\n\
fi\n\
exec catalina.sh run' > /docker-entrypoint.sh && \
chmod +x /docker-entrypoint.sh


ENTRYPOINT ["/docker-entrypoint.sh"]

EXPOSE 8080

docker-compose.yml

1
2
3
4
5
6
7
8
9
10
11
version: '3.8'
services:
  struts2-s2-005:
    build: .
    image: 10.0.8.32:5000/qsnctf/struts2-s2-005:flag
    container_name: s2-005-flag
    ports:
      - "8080:8080"
    environment:
      - FLAG=flag{qsnctf} 
    restart: unless-stopped

启动环境

1
2
docker-compose build
docker-compose up

漏洞利用