zangcc/cve-2022-22965-rexbbCVE-2022-22965\Spring-Core-RCE核弹级别漏洞的rce图形化GUI一键利用工具，基于JavaFx开发，图形化操作更简单，提高效率。
SpringBoot Core command execution vulnerability. CVE-2022-22965 exploitation tool, developed based on JavaFx, making graphical operation simpler and improving efficiency.
I have been doing vulnerability reproduction these days and suddenly realized that I had missed many classic vulnerabilities in the past, including this Spring Core RCE. So I looked up a lot of materials online and found it quite interesting. However, packet capture and sending are really troublesome (actually not troublesome, I'm just lazy — editing the request packet every time is especially annoying), so this graphical CVE-2022-22965 exploitation tool came about — Rexbb.jar❤️.
The appearance is not overly flashy; it simply implements the most basic automatic webshell writing + arbitrary command execution. The tool is developed based on JDK 1.8, i.e., Java 8. Since JDK 8 has a wider range of applicability, I didn't use a higher JDK version for development.
Previously, many friends said my other tools couldn't run 😤. Later, after private messaging each one, I found that it was because of Java environment issues on your own computers 😁. To avoid similar situations, I always run JDK 1.8 in a virtual machine before uploading to GitHub, and also run it on other people's computers. There are no issues. If you still tell me the Java version is the same but it won't run, then it's a Java environment problem on your computer 🤔.
① Here I use the vulfocus range for testing. After starting the environment, enter the URL and click the "Send payload" button first.
② After clicking send payload, the HTML content of the response packet will be displayed, and then the complete URL will be displayed in the second text box. 📢 Note!! This text box is set to read-only and users cannot modify it. I'm afraid that random changes will cause the subsequent command execution to fail, so editing is simply not allowed; it is for display only. As shown below:
③ After the URL is displayed, you can click the second button for RCE detection. It directly executes whomai and echoes the command execution result into the large text box, as shown below:
④ If you want to execute other commands, you can do so in the small text box below. Here I directly run ls /tmp, and the command executes successfully, yielding the flag. Other commands also work.
If you want to learn about the principles and development ideas behind this tool, or the vulnerability principle and specific steps, please refer to my blog post. It contains the BP packet capture reproduction of this vulnerability and the general development approach. Criticism is welcome for any shortcomings 🙏
