Sploitus

Exploit for Deserialization of Untrusted Data in Apache Log4J

gitee Β· 2020-01-08

Exploit Code

MARKDOWN10 lines
## https://sploitus.com/exploit?id=54D59088-9DCE-57C9-BF53-6B38DD0EFB35
CVE-2019-17571 is a vulnerability in the Apache Commons FileUpload library. It allows an attacker to upload a malicious file with a .class extension, which can be used to execute arbitrary code on the server. The vulnerability is caused by the library not properly validating the file extension before uploading it.

The exploit module for this vulnerability is written in Python and uses the Burp Suite extension to send a malicious file to the server. The module first checks if the server is vulnerable by sending a request with a .class file. If the server responds with a 200 status code, it means the server is vulnerable and the module proceeds to upload the malicious file.

The module uses the Burp Suite extension to send the request and receives the response. If the response contains the malicious file, the module extracts the file and saves it to a file on the local machine.

The module also includes a function to check if the server is vulnerable by sending a request with a .class file. This function returns a boolean value indicating whether the server is vulnerable or not.

The module can be used to exploit the vulnerability and upload a malicious file to the server. However, it is essential to note that this module should only be used for testing and should not be used to exploit the vulnerability in a production environment