Forked from Y4er
I added some changes so the code can be built into a simple .jar with simple arguments (host, port, command, http/s), to build please replace coherence.jar with the version according to your target.
The .jar present in Releases is built for 12.1.3, as is easy to guess.
Usage:
java -jar 12_1_3.jar -H [Host] -P [Port] -C [Command] -https [optional]
The command is executed with "/bin/bash -c". If another command is needed this can be changed at CVE_2020_2555.java line 87.
# CVE-2020-2555
Weblogic com.tangosol.util.extractor.ReflectionExtractor RCE
com.supeream.CVE_2020_2555
```
/*
* author:Y4er.com
*
* gadget:
* BadAttributeValueExpException.readObject()
* com.tangosol.util.filter.LimitFilter.toString()
* com.tangosol.util.extractor.ChainedExtractor.extract()
* com.tangosol.util.extractor.ReflectionExtractor.extract()
* Method.invoke()
* ...
* Runtime.getRuntime.exec()
*/
```
# Require
This only works in JDK 8u76 and WITHOUT a security manager, because of `BadAttributeValueExpException` in here:
https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70
And Please replace `coherence.jar` with your weblogic version, if not, you will get serialVersionUID inconsistent error.
Only test on Centos jdk8u202 Weblogic 12.2.1.4.
# Reference
1. https://www.thezdi.com/blog/2020/3/5/cve-2020-2555-rce-through-a-deserialization-bug-in-oracles-weblogic-server
2. https://www.youtube.com/watch?v=VzmZTYbm4Zw
3. https://github.com/5up3rc/weblogic_cmd/
[4.0K] /data/pocs/d7c95ca0898f5b299f1435ab57b739d05a784a11
├── [4.0K] lib
│ ├── [8.2M] coherence.jar
│ ├── [ 53K] commons-cli-1.4.jar
│ ├── [546K] commons-collections-3.1.jar
│ ├── [395K] jsafeFIPS.jar
│ ├── [1.1K] wlcipher.jar
│ └── [ 56M] wlfullclient.jar
├── [1.7K] README.md
└── [4.0K] src
├── [4.0K] com
│ └── [4.0K] supeream
│ ├── [5.0K] CVE_2020_2555.java
│ ├── [8.6K] Main.java
│ ├── [4.0K] payload
│ │ ├── [1.1K] PayloadTest.java
│ │ └── [3.0K] RemoteImpl.java
│ ├── [4.0K] serial
│ │ ├── [2.3K] BytesOperation.java
│ │ ├── [1.1K] Reflections.java
│ │ ├── [ 12K] SerialDataGenerator.java
│ │ └── [ 987] Serializables.java
│ ├── [4.0K] ssl
│ │ ├── [1003] SocketFactory.java
│ │ ├── [ 618] TrustManagerImpl.java
│ │ └── [ 341] WeblogicTrustManager.java
│ └── [4.0K] weblogic
│ ├── [1.2K] BypassPayloadSelector.java
│ ├── [ 819] ObjectTest.java
│ ├── [4.8K] T3ProtocolOperation.java
│ ├── [8.5K] T3Test.java
│ └── [1.8K] WebLogicOperation.java
├── [4.0K] META-INF
│ └── [ 53] MANIFEST.MF
└── [4.0K] weblogic
├── [4.0K] jms
│ └── [4.0K] common
│ └── [ 36K] StreamMessageImpl.java
├── [4.0K] security
│ └── [4.0K] utils
│ ├── [ 27K] SSLSetup.java
│ └── [7.6K] SSLTrustValidator.java
└── [4.0K] socket
└── [6.6K] ChannelSSLSocketFactory.java
15 directories, 28 files