orwagodfather/cve-2022-22954Proof-of-concept exploit for CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access via SSTI injection. Includes Shodan and Zoomeye dork integration for target discovery.
VMware Workspace ONE Access and Identity Manager RCE via SSTI.
CVE-2022-22954 - PoC SSTI
Usage:
CVE-2022-22954.py [-h] -m SET_MODE [-i IP] [-c CMD]
optional arguments:
-h, --help show this help message and exit
-m SET_MODE, --mode SET_MODE
Available modes: shodan | file | manual
-i IP, --ip IP Host IP
-c CMD, --cmd CMD Command string
This is just a PoC. Use it at wour own risk and not in production nor real environments. Don't ask me why the code is like this or if it's good or bad, I don't care. I'm not a cool programmer and my code is ugly.
zoomeye search 'iconhash:-1250474341' -num 780 -filter=ip,port
shodan search "http.favicon.hash:-1250474341" --fields=ip_str,port --separator ":" --limit 1000 | grep ''
shodan search 'title:"Workspace ONE Access"' --fields=ip_str,port --separator ":" --limit 1000 | grep ''