CVE-2020-7961 PoC — Liferay Portal 代码问题漏洞

Source

Associated Vulnerability

Description

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS)

Readme

# CVE-2020-7961-payloads
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS)



Step 1) Write Your payload in LifExp.java <br/>
Step 2) Compile it with javac <br/>
Step 3) make your log server (Maybe you want to use "Burp Collaborator Client")<br/>
Step 4) Run poc.py <br/>
<br/>
....enjoy it ;)   :innocent:
<br/>
<br/>
poc Code Writed by mzer0one  :pray: <br/>
https://github.com/mzer0one/CVE-2020-7961-POC

File Snapshot

 [4.0K]  /data/pocs/26b736a4217282c6dd7f44a687bbafb9eb44d100
├── [ 654]  Liferay_linux_payload.txt
├── [ 691]  Liferay_Windows_payload.txt
├── [ 211]  LifExp.java
├── [6.0K]  poc.py
└── [ 513]  README.md

0 directories, 5 files

Remarks