The exploit abuses the Weblogic monitor credential test feature. An authenticated admin uploads a malicious weblogic.jar file to the expected Weblogic library path. When the credential test is triggered, ManageEngine loads weblogic.jndi.Environment from the uploaded JAR via JarLoader.loadClass() and newInstance(), executing arbitrary Java code.

Requirements

System

• Python 3.x
• Java JDK (javac and jar on PATH)
• nc (netcat) for catch reverse shell

Python Dependencies

Usage

1. Start Listener

2. Run Exploit

Examples

Exploit Flow

1. Login - Authenticate with admin credentials, obtain session cookie
2. Enumerate - Retrieve the ManageEngine base installation directory
3. Build JAR - Compile a malicious Java class (weblogic.jndi.Environment) containing a reverse shell into weblogic.jar
4. Upload - Upload the JAR to classes/weblogic/version8/ via directory traversal (fallback: create a scheduled task to move it)
5. Trigger - Invoke the Weblogic credential test at /testCredential.do, which loads and instantiates the malicious class
6. Shell - Reverse shell connects back to listener

Default Credentials

Troubleshooting

References

• NVD - CVE-2020-14008
• Exploit-DB #48793
• ManageEngine Advisory

Disclaimer

This tool is provided for authorized penetration testing and security research only. Unauthorized use against systems you do not own or have permission to test is illegal.