CVE-2020-14882 PoC — Oracle WebLogic Server 安全漏洞

Source

https://github.com/qianniaoge/CVE-2020-14882_Exploit_Gui

Associated Vulnerability

Title:Oracle WebLogic Server 安全漏洞 (CVE-2020-14882)
Description:Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Readme

# CVE-2020-14882_Exploit_Gui


### 工具仅供授权状态下使用,如发生刑事案件,非授权攻击行为于本人无关.望大家熟知《网络安全法》
一次打点中遇到14882，没找到好用的GUI的POC，所以重构了一下。个人更倾向于GUI的一些POC。

v1版本中10.3.6版本，不可用。

v2版本添加10.3.6版本支持，10.3.6版本仅支持反弹shell，需要将linux.xml挂在在web中并vps进行nc监听。

v2.1 修复窗口崩溃问题

v2.2 添加代理功能

Weblogc_exploit_v1.0演示:
![SZOJDOTU~BGI@`B3)N`V$%7](https://user-images.githubusercontent.com/42479546/113846973-98a36d80-97c9-11eb-907e-8dd4edcda0d4.png)


![$72_ESIS25J9IF$SXOFDNE3](https://user-images.githubusercontent.com/42479546/113846995-9ccf8b00-97c9-11eb-8a22-a47f90d02255.png)



Weblogc_exploit_v2.0:

![image](https://user-images.githubusercontent.com/42479546/114578821-d9125800-9caf-11eb-9084-c51632e852d9.png)


Weblogc_exploit_v2.1:

debug:修复窗体崩溃问题

Weblogc_exploit_v2.2:

debug:修复窗体崩溃问题
新增socket、http代理功能
修改gui风格

![image](https://user-images.githubusercontent.com/42479546/114861235-92dc0680-9e1f-11eb-8bac-7a76198333d2.png)


动动小手点点star吧！！！


![IGECJ~01F2(LF0CDOU}_W2U](https://user-images.githubusercontent.com/42479546/113851082-b377e100-97cd-11eb-9bbd-2cf5df0e2a61.jpg)

File Snapshot


 [4.0K]  /data/pocs/fd235e9ccf91ac2ed1ea26ae87a065c62c23cba0
├── [ 554]  linux.xml
├── [1.3K]  README.md
└── [ 524]  windows.xml

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!