CVE-2022-22965 poc including reverse-shell and password support. Feel free to add more stuff 🙂 $ docker run -p 9090:8080 vulfocus/spring-core-rce-2022-03-29 # run vulnerable docker $ python3 exploit.py -c id –password 1234 –shell_name big0us $ python3 exploit.py –help # for more usages I refactored the code of the original exploit and add some features reverse shell suport password support shell name support GitHub View Github    

This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it’s a simple hello world that’s based off Spring tutorials. Details: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities Requirements Docker Python3 + requests library Instructions Clone the repository Build and run the container: docker build . […]

The README from the alleged appears confirmed! 0day dropped on 2022-03-29 has been translated to English and cleaned up slightly to assist in your analysis and replication. If you manage to create a demo application that folks could use to independently validate and deep-dive, please let me know via GitHub Issues so I can link it! Please note that this is a different issue than CVE-2022-22963! Major cybersecurity news outlets, including ThreatPost, have gotten this fact wrong – and this […]

Python3 code to exploitCVE-2021-4034(PWNKIT).This was an exercise in “can I make this work in Python?”, and not meantas a robust exploit. It Works For Me, there are problaby bugs. The default payload starts a shell as root, generated from msfvenom: msfvenom -p linux/x64/exec -f elf-so PrependSetuid=true | base64 I’ve tested linux/x64/shell_reverse_tcp as well. Make sure you includethe PrependSetuid=true argument to msfvenom, otherwise you’ll just geta shell as the user and not root. The code is cribbed from blasty, the orginal […]

Description This repository detects a system vulnerable to CVE-2022-21907 (CVSS:3.1 9.8), protects against this vulnerability if desired and exploit it with python and powershell (a payload is available). I offer 2 powershell codes in 1 line. Codes Only detect $ErrorActionPreference=”SilentlyContinue”;$_=($(Get-ItemProperty -Path HKLM:SystemCurrentControlSetServicesHTTPParameters -Name EnableTrailerSupport).EnableTrailerSupport -or $(Write-Host “Not vulnerable to CVE-2022-2190”)) -and $(Write-Host “$env:computername vulnerable to CVE-2022-2190 !”)