CVE-2017-12149 PoC — Red Hat JBoss Enterprise Application Platform Jboss Application Server 安全漏洞

Source

https://github.com/VVeakee/CVE-2017-12149

Associated Vulnerability

Title: Red Hat JBoss Enterprise Application Platform Jboss Application Server 安全漏洞 (CVE-2017-12149)
Description:In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Readme

# CVE-2017-12149
## 非常感谢yunxu1师傅的源码

## 说明:
```
  删掉了图形化页面
  修复了识别系统错误导致的命令执行失败
  修改成了交互式的shell
```

## 使用

输入url回车会自动执行两个系统的whoami

看结果判断是什么操作系统

输入系统linux or windows

然后就是输入要执行命令了

![image](https://user-images.githubusercontent.com/85714114/163669131-07ed5a84-6763-421b-941e-a68927b86324.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →