CVE-2019-2618 PoC — Oracle Fusion Middleware WebLogic Server 访问控制错误漏洞

Source

Associated Vulnerability

Title:Oracle Fusion Middleware WebLogic Server 访问控制错误漏洞 (CVE-2019-2618)
Description:Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N).

Description

增强版WeblogicScan、检测结果更精确、插件化、添加CVE-2019-2618，CVE-2019-2729检测，Python3支持

Readme

# WeblogicScan

增强版WeblogicScan 从rabbitmask大佬的WeblogicScan V1.2 版本修改而来。 修改前源项目地址：https://github.com/rabbitmask/WeblogicScan

![weblogicscan](weblogicscan.png)

# DEFF

* 支持Python3
* 修复漏洞检测误报，漏洞检测结果更精确
* 添加CVE-2019-2729, CVE-2019-2618漏洞检测
* 插件化漏洞扫描组件
* 添加彩色打印

# INSTALL

```
pip3 install -r requirements.txt
```

# Useage

```
python3 WeblogicScan.py 192.168.1.1 7001
```

# 支持CVE

* CVE-2014-4210

* CVE-2016-0638

* CVE-2016-3510

* CVE-2017-3428

* CVE-2017-3506

* CVE-2017-10271

* CVE-2018-2628

* CVE-2018-2893

* CVE-2018-2894

* CVE-2019-2618

* CVE-2019-2725

* CVE-2019-2729

  

  # EXTENDS

  如果想添加其他CVE或其他Weblogic漏洞，只需要按照如下规则填写插件即可：

  ```python
  #!/usr/bin/env python
  # _*_ coding:utf-8 _*_
  
  import logging
  import sys
  import requests
  
  from ..platform import ManageProcessor,Color
  
  logging.basicConfig(filename='Weblogic.log',
                      format='%(asctime)s %(message)s',
                      filemode="w", level=logging.INFO)
  
  headers = {'user-agent': 'ceshi/0.0.1'}
  
  
  @ManageProcessor.plugin_register('CVE201XXXXX')
  class CVE201XXXXX(object):
      def process(self,ip,port):
          self.run(ip,port)
  
      def run(self,url,port):
          ......
          your POC payload ......
          if (success):
  						 print(Color.OKGREEN+'[+]CVE201XXXXX 漏洞存在'+Color.ENDC)
  ```

  

并在 `app/plugins/__init__.py`下添加文件名即可。

`__init__.py`

```
#!/usr/bin/env python
# _*_ coding:utf-8 _*_

__all__ = ['WeblogicConsole', 'CVE-2019-2618','CVE-2014-4210','CVE-2019-2725','CVE-2019-2729','CVE-2017-10271','CVE-2017-3506','CVE-2018-2894','CVE-2018-2628','CVE-2018-2893','CVE-2016-0638','CVE-2016-3510','CVE-2017-3248','CVE-201X-XXXX']
```



# Thanks

感谢Daybreak的CVE-2019-2618 检测脚本

# UPDATES

修复了一些POC存在的问题，请表哥们及时git clone 新的代码。由于脚本改的比较仓促，表哥们发现一些bug可直接发issue，逐步改进。

# NOTES

目前暂不支持Weblogic 10.3.6   Weblogic 12.1.3.0.0和Weblogic12.2.1.3.0  JDK1.7版本的CVE-2019-2729漏洞检测。

File Snapshot


 [4.0K]  /data/pocs/53ce03009e2fccef27b6e401a8c1274d078cf3f2
├── [4.0K]  app
│   ├── [  68]  __init__.py
│   ├── [ 347]  main.py
│   ├── [1.3K]  platform.py
│   ├── [4.0K]  plugins
│   │   ├── [1.3K]  CVE-2014-4210.py
│   │   ├── [ 11K]  CVE-2016-0638.py
│   │   ├── [ 11K]  CVE-2016-3510.py
│   │   ├── [6.7K]  CVE-2017-10271.py
│   │   ├── [ 11K]  CVE-2017-3248.py
│   │   ├── [2.4K]  CVE-2017-3506.py
│   │   ├── [7.1K]  CVE-2018-2628.py
│   │   ├── [7.8K]  CVE-2018-2893.py
│   │   ├── [1.2K]  CVE-2018-2894.py
│   │   ├── [5.1K]  CVE-2019-2618.py
│   │   ├── [144K]  CVE-2019-2725.py
│   │   ├── [346K]  CVE-2019-2729.py
│   │   ├── [ 269]  __init__.py
│   │   ├── [4.0K]  __pycache__
│   │   │   ├── [1.7K]  CVE-2014-4210.cpython-36.pyc
│   │   │   ├── [1.7K]  cve-2014-4210.cpython-37.pyc
│   │   │   ├── [ 11K]  CVE-2016-0638.cpython-36.pyc
│   │   │   ├── [ 11K]  cve-2016-0638.cpython-37.pyc
│   │   │   ├── [ 11K]  CVE-2016-3510.cpython-36.pyc
│   │   │   ├── [ 11K]  cve-2016-3510.cpython-37.pyc
│   │   │   ├── [6.8K]  CVE-2017-10271.cpython-36.pyc
│   │   │   ├── [6.8K]  cve-2017-10271.cpython-37.pyc
│   │   │   ├── [ 11K]  CVE-2017-3248.cpython-36.pyc
│   │   │   ├── [ 11K]  CVE-2017-3248.cpython-37.pyc
│   │   │   ├── [ 11K]  cve-2017-3428.cpython-37.pyc
│   │   │   ├── [2.6K]  CVE-2017-3506.cpython-36.pyc
│   │   │   ├── [2.6K]  cve-2017-3506.cpython-37.pyc
│   │   │   ├── [7.5K]  CVE-2018-2628.cpython-36.pyc
│   │   │   ├── [7.5K]  cve-2018-2628.cpython-37.pyc
│   │   │   ├── [7.7K]  CVE-2018-2893.cpython-36.pyc
│   │   │   ├── [7.7K]  cve-2018-2893.cpython-37.pyc
│   │   │   ├── [1.6K]  CVE-2018-2894.cpython-36.pyc
│   │   │   ├── [1.6K]  CVE-2018-2894.cpython-37.pyc
│   │   │   ├── [4.6K]  CVE-2019-2618.cpython-36.pyc
│   │   │   ├── [4.7K]  CVE-2019-2618.cpython-37.pyc
│   │   │   ├── [127K]  CVE-2019-2725.cpython-36.pyc
│   │   │   ├── [145K]  cve-2019-2725.cpython-37.pyc
│   │   │   ├── [203K]  CVE-2019-2729.cpython-36.pyc
│   │   │   ├── [346K]  CVE-2019-2729.cpython-37.pyc
│   │   │   ├── [ 417]  __init__.cpython-36.pyc
│   │   │   ├── [ 421]  __init__.cpython-37.pyc
│   │   │   ├── [1.7K]  plugin1.cpython-37.pyc
│   │   │   ├── [ 609]  plugin2.cpython-37.pyc
│   │   │   ├── [1.8K]  WeblogicConsole.cpython-36.pyc
│   │   │   └── [1.8K]  WeblogicConsole.cpython-37.pyc
│   │   └── [1.4K]  WeblogicConsole.py
│   └── [4.0K]  __pycache__
│       ├── [ 199]  __init__.cpython-36.pyc
│       ├── [ 203]  __init__.cpython-37.pyc
│       ├── [ 377]  main.cpython-36.pyc
│       ├── [ 381]  main.cpython-37.pyc
│       ├── [1.6K]  platform.cpython-36.pyc
│       └── [1.6K]  platform.cpython-37.pyc
├── [2.2K]  README.md
├── [   9]  requirements.txt
├── [ 920]  Weblogic.log
├── [387K]  weblogicscan.png
└── [ 835]  WeblogicScan.py

4 directories, 59 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!