WeblogicScan

Enhanced version of WeblogicScan, modified from rabbitmask's WeblogicScan V1.2. Original source project: https://github.com/rabbitmask/WeblogicScan

DEFF

• Supports Python3
• Fixed vulnerability detection false positives, vulnerability detection results are more accurate
• Added CVE-2019-2729, CVE-2019-2618 vulnerability detection
• Plugin-based vulnerability scanning components
• Added color printing

INSTALL

pip3 install -r requirements.txt

Usage

python3 WeblogicScan.py 192.168.1.1 7001

Supported CVEs

• CVE-2014-4210

• CVE-2016-0638

• CVE-2016-3510

• CVE-2017-3428

• CVE-2017-3506

• CVE-2017-10271

• CVE-2018-2628

• CVE-2018-2893

• CVE-2018-2894

• CVE-2019-2618

• CVE-2019-2725

• CVE-2019-2729

EXTENDS

To add other CVEs or Weblogic vulnerabilities, simply fill in the plugin according to the following rules:

#!/usr/bin/env python
# _*_ coding:utf-8 _*_

import logging
import sys
import requests

from ..platform import ManageProcessor,Color

logging.basicConfig(filename='Weblogic.log',
                    format='%(asctime)s %(message)s',
                    filemode="w", level=logging.INFO)

headers = {'user-agent': 'ceshi/0.0.1'}


@ManageProcessor.plugin_register('CVE201XXXXX')
class CVE201XXXXX(object):
    def process(self,ip,port):
        self.run(ip,port)

    def run(self,url,port):
        ......
        your POC payload ......
        if (success):
             print(Color.OKGREEN+'[+]CVE201XXXXX vulnerability exists'+Color.ENDC)

Then add the filename under app/plugins/__init__.py.

__init__.py

#!/usr/bin/env python
# _*_ coding:utf-8 _*_

__all__ = ['WeblogicConsole', 'CVE-2019-2618','CVE-2014-4210','CVE-2019-2725','CVE-2019-2729','CVE-2017-10271','CVE-2017-3506','CVE-2018-2894','CVE-2018-2628','CVE-2018-2893','CVE-2016-0638','CVE-2016-3510','CVE-2017-3248','CVE-201X-XXXX']

Thanks

Thanks to Daybreak for the CVE-2019-2618 detection script.

UPDATES

Fixed some issues in POCs. Please clone the new code in time. Since the script was modified hastily, if you find any bugs, please feel free to submit an issue for gradual improvement.

NOTES

Currently does not support CVE-2019-2729 vulnerability detection for Weblogic 10.3.6, Weblogic 12.1.3.0.0, Weblogic 12.2.1.3.0, and JDK 1.7.