spring4shell环境搭建及漏洞（CVE-2022-22965）复现

May 30, 2023#漏洞复现 #渗透测试465

AI-generated summary

This is a guide on how to set up a Spring4Shell environment using Docker. The original project lacked the necessary Tomcat environment, so modifications were made to the Dockerfile. After building and running the Docker container, the vulnerable app can be accessed and exploited using a Python script. The guide includes the necessary commands and links to the relevant repositories.

spring4shell 环境搭建#

docker 搭建，原项目如下：https://github.com/jbaines-r7/spring4shell_vulnapp
docker 目录结构如下：
src 目录下是编译后的 app

原项目无法构建成功，少了 tomcat 的环境

修改后的 dockerfile 如下：

FROM --platform=linux/amd64 openjdk:11

EXPOSE 8080

RUN apt update

ADD . / /springy
WORKDIR /springy

COPY apache-tomcat-8.5.77.zip /springy
RUN unzip apache-tomcat-8.5.77.zip
RUN chmod +x apache-tomcat-8.5.77/bin/*.sh

RUN cp src/vulnerable-1.0.0.0.war apache-tomcat-8.5.77/webapps/

CMD ["./apache-tomcat-8.5.77/bin/catalina.sh", "run"]

docker 构建

docker build -t spring4shell .
docker run -itd -P spring4shell:latest

# 访问
http://192.168.101.154:32769/vulnerable-1.0.0.0/rapid7

漏洞利用#

项目地址：https://github.com/reznok/Spring4Shell-POC

python3 exploit.py --url http://192.168.101.154:32769/vulnerable-1.0.0.0/rapid7

漏洞利用成功