Exploit for CVE-2018-3252

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GO-SPIDER-CVE-2018-3252
# CVE-2018-3252

1、Декомпиляция WebLogic

root@kitploit:~
    
    
     private void handleDataTransferRequest(HttpServletRequest paramHttpServletRequest, HttpServletResponse paramHttpServletResponse, AuthenticatedSubject paramAuthenticatedSubject)
                throws IOException {
            if (isDebugEnabled()) {
                debug("Received DataTransferRequest : ");
            }
            String str1 = readOrConstructPeerVersion(paramHttpServletRequest);
            if (isDebugEnabled()) {
                debug("Peer Version : " + str1);
            }
            String str2 = paramHttpServletRequest.getHeader("deployment_request_id");
            long l = str2 != null ? Long.parseLong(str2) : -1L;
    
            String str3 = mimeDecode(paramHttpServletRequest.getHeader("serverName"));
    
            DeploymentObjectInputStream localDeploymentObjectInputStream = null;//создаём новый объект DeploymentObjectInputStream
            try {
                localDeploymentObjectInputStream = new DeploymentObjectInputStream(paramHttpServletRequest.getInputStream(), str1);
                DataTransferRequest localDataTransferRequest = (DataTransferRequest) localDeploymentObjectInputStream.readObject();//читаем переданный объект из POST и десериализуем его
    
                localObject1 = DataHandlerManager.getInstance().getHttpDataTransferHandler().getDataAsStream(localDataTransferRequest);
    
                localObject2 = localDataTransferRequest.getLockPath();
                FileLock localFileLock = null;
                try {
                    if ((localObject2 != null) && (((String) localObject2).length() > 0)) {
                        localFileLock = lockFile((String) localObject2);
                    }
                    MultipartResponse localMultipartResponse = new MultipartResponse(paramHttpServletResponse, (MultiDataStream) localObject1);
                    localMultipartResponse.write();
                } finally {
                    unlockFile(localFileLock);
                }
            } catch (Throwable localThrowable) {
                Object localObject1 = StackTraceUtils.throwable2StackTrace(localThrowable);
                if (isDebugEnabled()) {
                    debug("DeploymentServiceServlet error - " + localThrowable.getMessage() + " " + (String) localObject1);
                }
                Object localObject2 = DeploymentServiceLogger.logExceptionInServletRequestForDatatransferMsgLoggable(l, str3, (String) localObject1);
    
                ((Loggable) localObject2).log();
    
                localObject2 = DeploymentServiceLogger.logExceptionInServletRequestForDatatransferMsgLoggable(l, str3, localThrowable.getMessage());
    
                sendError(paramHttpServletResponse, 500, ((Loggable) localObject2).getMessage());
                return;
            } finally {
                if (localDeploymentObjectInputStream != null) {
                    localDeploymentObjectInputStream.close();
                }
            }
        }