kiralab/text4shell-scanA fully automated, accurate, and extensive scanner for finding text4shell RCE CVE-2022-42889
Heavily based off Fullhunts old Log4j scanner from 2021 (MAJOR CREDIT TO THEM), this scanning tool is used now for discovering and fuzzing for Text4Shell RCE CVE-2022-42889. This shall be used by security teams to scan their infrastructure for Text4Shell RCE, and also test for WAF bypasses that can result in achieving code execution on the organization's environment.
It supports DNS OOB callbacks out of the box, there is no need to set up a DNS callback server. Note interact.sh been slow so it is not recommended to use at this time.
https://nvd.nist.gov/vuln/detail/CVE-2022-42889
$ python3 text4shell-scan.py -h
[•] CVE-2022-42889 - Apache Commons Text RCE Scanner
[•] Scanner provided by @securekomodo
usage: text4shell-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]
[--wait-time WAIT_TIME] [--waf-bypass] [--custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD]
[--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST] [--disable-http-redirects]
optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Check a single URL.
-p PROXY, --proxy PROXY
send requests through proxy
-l USEDLIST, --list USEDLIST
Check a list of URLs.
--request-type REQUEST_TYPE
Request Type: (get, post) - [Default: get].
--headers-file HEADERS_FILE
Headers fuzzing list - [default: headers.txt].
--run-all-tests Run all available tests on each URL.
--exclude-user-agent-fuzzing
Exclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.
--wait-time WAIT_TIME
Wait time after all URLs are processed (in seconds) - [Default: 5].
--waf-bypass Extend scans with WAF bypass payloads.
--custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD
Test with custom WAF bypass payload.
--dns-callback-provider DNS_CALLBACK_PROVIDER
DNS Callback provider (Options: dnslog.cn, interact.sh) - [Default: interact.sh].
--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST
Custom DNS Callback Host.
--disable-http-redirects
Disable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have a higher chance of reaching vulnerable systems.
$ python3 text4shell-scan.py -u https://<enter URL here>
$ python3 text4shell-scan.py -u https://<enter URL here> --run-all-tests
$ python3 text4shell-scan.py -u https://<enter URL here> --waf-bypass
$ python3 text4shell-scan.py -u https://<enter URL here> --custom-dns-callback-host <copy collaborator host here>
$ python3 text4shell-scan.py -l urls.txt
$ pip3 install -r requirements.txt
git clone [https://github.com/securekomodo/text4shell-scan.git](https://github.com/securekomodo/text4shell-scan.git)
cd text4shell-scan
sudo docker build -t text4shell-scan .
sudo docker run -it --rm text4shell-scan
# With URL list "urls.txt" in current directory
docker run -it --rm -v $PWD:/data text4shell-Scan -l /data/urls.txt
This project is made for educational and ethical testing purposes only. Usage of text4shell-scan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
The project is licensed under MIT License.
Bryan Smith