damingshidashi/cve-2020-2551Use shell to build weblogic debug environment for CVE-2020-2551
The setup script of this project has been tested on version 10.3.6, version 12 has not been tested.
kali+weblogic10.3.6+jdk6u25
Ensure the machine deploying
weblogichas at least1.5Gof memory, because the script specifies-x1024min its parameters.
Enter the corresponding version directory, see the corresponding READEME for details.
Visit http://ip:7001/console, there is an initialization process on the first visit!
Default username and password:
weblogic/admin@123
Use the project marshalsec_docker to set up the docker version of marshalsec, or you can set it up locally.
The default payload of marshalsec_docker is ExportObject.java. After successful exploitation, an empty file poc-cve-2020-2551.x will be generated in the /tmp directory.
It is recommended to reproduce all operations on a single machine to avoid failure due to network issues!
Use Y4er's project to generate the weblogic_CVE_2020_2551.jar package, which is a payload sender. After sending the packet, this jar will definitely report errors like NamingServer, ignore them; the error information in the weblogic log is more important.
If weblogic reports these two errors, it is most likely successful:
Omitted.
Please strictly follow the versions specified in the documentation for testing. There is no cleanup script, it is strongly recommended to take a system snapshot before using!
Try to perform all operations on a single machine and ensure the same
jdkversion is used to avoid network issues orjavaversion incompatibility.
