# Spring4Shell: CVE-2022-22965

{% embed url="<https://tryhackme.com/room/spring4shell>" %}
<https://tryhackme.com/room/spring4shell>
{% endembed %}

| Room Attributes       | Value                                                                  |
| --------------------- | ---------------------------------------------------------------------- |
| Subscription Required | <mark style="color:green;background-color:green;">False</mark> \[Free] |
| Type                  | Walkthrough                                                            |
| Difficulty            | <mark style="color:blue;background-color:blue;">Info</mark>            |
| Tags                  | Spring4Shell, Vulnerability, RCE, Java, CVE-2022-22965                 |

## Task 1 - <mark style="color:green;background-color:green;">Info</mark> Introduction and Deploy

### Deploy the target machine by clicking the green button at the top of this task!

{% hint style="info" %}
**Note:** This machine will take 2-3 minutes to start up completely!
{% endhint %}

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 2 - <mark style="color:purple;background-color:purple;">Tutorial</mark> Vulnerability Background

### Read the task information and understand how Spring4Shell works at a high level.

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 3 - <mark style="color:orange;background-color:orange;">Practical</mark> **Exploitation**

### Follow the steps in the task to exploit Spring4Shell and obtain a webshell.

{% hint style="success" %}
No answer needed
{% endhint %}

### **\[**<mark style="color:purple;">**Bonus Question: Optional**</mark>**]** Use your webshell to obtain a reverse/bind shell on the target.

{% hint style="success" %}
No answer needed
{% endhint %}

### What is the flag in `/root/flag.txt`?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{NjAyNzkyMjU0MzA1ZWMwZDdiM2E5YzFm}`

</details>

## Task 4 - <mark style="color:green;background-color:green;">Info</mark> Conclusion

### I understand and can abuse Spring4Shell!

{% hint style="success" %}
No answer needed
{% endhint %}
