Sploitus

Exploit for CVE-2023-34468

kitploit Β· 2026-08-31

Exploit Code

MARKDOWN29 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OZCANPNG-CVE-2023-34468
# CVE-2023-34468 β€” Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC

νŽΈμ§‘ κ°€λŠ₯ν•œ Apache NiFi ExecuteSQL ν”„λ‘œμ„Έμ„œλ₯Ό μ•…μš©ν•˜μ—¬ H2 `RUNSCRIPT` νŽ˜μ΄λ‘œλ“œλ‘œ Bash λ¦¬λ²„μŠ€ 셸을 ν†΅ν•œ 원격 λͺ…λ Ή 싀행을 νŠΈλ¦¬κ±°ν•˜λŠ” κ°„λ‹¨ν•œ Python PoCμž…λ‹ˆλ‹€.

> **승인된 ν…ŒμŠ€νŠΈ 및 연ꡬ λͺ©μ μœΌλ‘œλ§Œ μ‚¬μš©ν•˜μ‹­μ‹œμ˜€. μ†Œμœ ν•˜μ§€ μ•Šμ•˜κ±°λ‚˜ ν…ŒμŠ€νŠΈμ— λŒ€ν•œ λͺ…μ‹œμ  ν—ˆκ°€λ₯Ό 받지 μ•Šμ€ μ‹œμŠ€ν…œμ—λŠ” μ‚¬μš©ν•˜μ§€ λ§ˆμ‹­μ‹œμ˜€.**

* * *

## λ™μž‘ 방식

root@kitploit:~
    
    
    ExecuteSQL processor update -> H2 RUNSCRIPT fetch -> Bash reverse shell -> processor restore
    

  1. 단일 ExecuteSQL ν”„λ‘œμ„Έμ„œλ₯Ό μžλ™μœΌλ‘œ νƒμƒ‰ν•˜κ±°λ‚˜ `--processor-id`λ₯Ό μˆ˜λ™μœΌλ‘œ ν—ˆμš©ν•©λ‹ˆλ‹€.
  2. Java 기반 μ…Έ μ‹€ν–‰ 별칭을 μ •μ˜ν•˜κ³  ν˜ΈμΆœν•˜λŠ” 둜컬 `rce.sql` νŽ˜μ΄λ‘œλ“œλ₯Ό μž‘μ„±ν•©λ‹ˆλ‹€.
  3. 직접 `nc` λ¦¬μŠ€λ„ˆμ™€ HTTP μ„œλ²„λ₯Ό μ‹œμž‘ν•˜λ„λ‘ μ•ˆλ‚΄ν•©λ‹ˆλ‹€.
  4. H2 `RUNSCRIPT`λ₯Ό 톡해 `rce.sql`을 κ°€μ Έμ˜€λ„λ‘ ν”„λ‘œμ„Έμ„œ 쿼리λ₯Ό μ—…λ°μ΄νŠΈν•©λ‹ˆλ‹€.
  5. λ¦¬λ²„μŠ€ 셸을 νŠΈλ¦¬κ±°ν•˜κΈ° μœ„ν•΄ ν”„λ‘œμ„Έμ„œλ₯Ό μ‹œμž‘ν•©λ‹ˆλ‹€.
  6. μ…Έ 연결을 ν™•μΈν•œ ν›„ μ›λž˜ ν”„λ‘œμ„Έμ„œ ꡬ성을 λ³΅μ›ν•©λ‹ˆλ‹€.



* * *

## μŠ€ν¬λ¦°μƒ·