all InfoSec news
Spring4Shell-Poc - Spring Core RCE 0-day Vulnerability
May 10, 2022, 9:30 p.m. | noreply@blogger.com (Unknown)
KitPloit - PenTest Tools! www.kitploit.com
Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html
Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC
Steps to Build/Run
Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60
- Run mvn clean package to build the application
- Rename demo-0.0.1-SNAPSHOT.war to spring-poc.war and copy this .war file to Tomcat's webapps directory
- Run python exp.py --url http://localhost:8080/spring-poc/greeting
- If successful, the message 漏洞存在,shell地址为:http://localhost:8080/spring-poc/tomcatwar.jsp?pwd=j&cmd=whoami will be logged.
- You should now see the file tomcatwar.jsp written to Tomcat's webapps/spring-poc directory. This directory can be changed by modifying exp.py.
- Go to …
0-day vulnerability poc rce spring spring4shell spring4shell-poc spring core springshell vulnerability
More from www.kitploit.com / KitPloit - PenTest Tools!
VectorKernel - PoCs For Kernelmode Rootkit Techniques Research
5 days, 16 hours ago |
www.kitploit.com
Cookie-Monster - BOF To Steal Browser Cookies & Credentials
6 days, 16 hours ago |
www.kitploit.com
Jobs in InfoSec / Cybersecurity
SOC 2 Manager, Audit and Certification
@ Deloitte | US and CA Multiple Locations
Check Team Members / Cyber Consultants / Pen Testers
@ Resillion | Birmingham, United Kingdom
Security Officer Field Training Officer- Full Time (Harrah's LV)
@ Caesars Entertainment | Las Vegas, NV, United States
Cybersecurity Subject Matter Expert (SME)
@ SMS Data Products Group, Inc. | Fort Belvoir, VA, United States
AWS Security Engineer
@ IntelliPro Group Inc. | Palo Alto, CA
Information Security Analyst
@ Freudenberg Group | Alajuela