Sploitus

Exploit for Server-Side Request Forgery in Apache Axis

CVE-2019-0227

githubexploit · 2019-10-27

Exploit Code

README15 lines
## https://sploitus.com/exploit?id=7C6A25CE-E02A-57D4-B020-A998CFA24D76
# cve-2019-0227 
Apache Axis1.4 remote code execution vulnerability 
It is necessary to set up listening on the local MSF server. Additionally, modifications are required at lines 24–30 of the code. 

# You need to change these variables to match your configuration. 
myip = “192.168.0.117” # IP address of your machine. 
target = “192.168.0.102” # Target IP address. 
 = “192.168.0.1” # Default gateway. 
targetport = “8080” # Port where the target Axis service runs (possibly 8080). 
pathtoaxis = “http://192.168.0.102:8080/axis” # This is the custom Axis installation path; it’s the default path here. 
spoofinterface = “eth0” # The interface used for spoofing. 
jspwritepath = “webapps\\axis\\exploit.jsp” # The relative path to the JSP payload on the target machine. This is the default path if Tomcat is installed.

[source-iocs-preserved url=http://192.168.0.102:8080/axis]