Sploitus

Exploit for CVE-2020-1938

kitploit · 2026-08-25

Exploit Code

MARKDOWN35 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-H7HAC9-CVE-2020-1938
# CVE-2020-1938

## Suricata правила обнаружения

root@kitploit:~
    
    
    # CNVD-2020-10487 CVE-2020-1938
    alert tcp any any -> any 8009 (msg:"CNVD-2020-10487 Ghostcat"; content:"javax|2e|servlet|2e|include|2e|request_uri"; content:"javax|2e|servlet|2e|include|2e|path_info"; content:"javax|2e|servlet|2e|include|2e|servlet_path"; reference:url,www.anquanke.com/post/id/199351; classtype:tomcat; sid:202002211; rev:1;)
    

## Bro правила обнаружения

root@kitploit:~
    
    
    module EXPLOIT;
    
    event tcp_packet(c: connection, is_orig: bool, flags: string, seq: count, ack: count, len: count, payload: string)
    {
        if ( (c$id$resp_p == 8009/tcp) && /javax\.servlet\.include\.request_uri/ in payload && /javax\.servlet\.include\.path_info/ in payload && /javax\.servlet\.include\.servlet_path/ in payload)
        {
            local rec: EXPLOIT::Info = [$ts=c$start_time,
                                        $src_ip=c$id$orig_h,
                                        $src_port=c$id$orig_p,
                                        $dst_ip=c$id$resp_h,
                                        $dst_port=c$id$resp_p,
                                        $vul_payload=payload,
                                        $vul_describe="CVE-2020-1938 Ghostcat",
                                        $vul_refer="https://www.anquanke.com/post/id/199351",
                                        $vul_level="high"];
            Log::write(EXPLOIT::LOG, rec);
        }
    }