Authentication Bypass in Apache OFBiz

This repository is a graphical exploit tool targeting Apache Ofbiz CVE-2023-51467, a remote code execution vulnerability. The project is implemented in Java and provides a GUI (via Swing) for users to exploit the vulnerability using two main methods: Java deserialization (CommonsBeanutils1 chain, TomcatCmdEcho) and Groovy script-based command execution. The tool allows users to specify the target URL, select the exploitation method, and optionally configure proxy settings (HTTP/SOCKS, with authentication). It supports setting custom Host headers, which may be required for some vulnerable configurations. The core exploit logic is in 'HttpsPostRequestExample.java', which handles HTTP(S) POST requests, disables SSL verification, and processes responses to extract command execution results (often base64-encoded and wrapped in custom XML tags). The GUI logic is in 'UI.java' and 'Proxy_GUI.java', providing user interaction for payload selection, command input, and proxy configuration. The tool is operational, providing working payloads and the ability to customize deserialization chains (e.g., via ysoserial). No hardcoded C2 or external endpoints are present, but the tool is designed for interactive exploitation of user-specified targets. The repository includes all necessary code and resources for building and running the exploit as a standalone Java application.

This repository contains a single Metasploit module (modules/exploits/linux/http/apache_ofbiz_deserialization.rb) that exploits a Java deserialization vulnerability in Apache OFBiz's XML-RPC endpoint. The exploit targets the /webtools/control/xmlrpc endpoint, which is accessible over HTTP(S), and leverages unauthenticated or authentication-bypassed access to achieve remote code execution. The module supports multiple payloads, including command execution and Meterpreter reverse shells, and automatically selects the appropriate gadget chain (ROME or CommonsBeanutils1) based on the detected OFBiz version. The exploit is weaponized, allowing for easy payload customization and reliable exploitation. The module references several CVEs (CVE-2020-9496, CVE-2023-49070, CVE-2023-51467) and is suitable for targeting vulnerable Apache OFBiz installations on Linux platforms.

This repository contains a Python exploit (exploit.py) and a README.md for Apache OFBiz vulnerabilities CVE-2023-49070 and CVE-2023-51467. The exploit targets Apache OFBiz versions 18.12.10 and below, leveraging a pre-authentication RCE via a vulnerable XML-RPC endpoint. The script first checks if the target is vulnerable by sending a request to the /webtools/control/ping endpoint and looking for a 'PONG' response. If vulnerable, it prompts the user for their IP and port, then uses ysoserial-all.jar to generate a Java deserialization payload that executes a base64-encoded bash reverse shell. This payload is sent to the /webtools/control/xmlrpc endpoint, which, if successful, results in a reverse shell connection to the attacker's machine. The exploit requires the ysoserial-all.jar file and Java to be present on the attacker's system. The repository is structured simply, with the main logic in exploit.py and usage/documentation in README.md.

This repository is a Java-based GUI tool (OFBiz-Attack) designed to exploit two vulnerabilities in Apache OFBiz: CVE-2023-49070 (XML-RPC deserialization) and CVE-2023-51467 (authentication bypass/command execution). The tool is structured as a desktop application with three main modules: vulnerability detection, command execution, and memory shell (webshell) injection. The detection module verifies if the target is vulnerable by sending crafted HTTPS requests to specific OFBiz endpoints. The command execution module leverages CVE-2023-51467 to run arbitrary system commands on the target via a Groovy shell, returning the output to the user. The memory shell injection module uses CVE-2023-49070 to inject either a custom command shell or a Behinder shell into the target's /webtools/* filter, providing persistent access. The codebase is organized into listeners for each module, utility classes for HTTP requests and vulnerability checks, and a main GUI class. The tool is operational, providing both detection and exploitation capabilities, and is intended for use against vulnerable Apache OFBiz instances accessible over HTTPS.

This repository provides an operational exploit and detection script for two critical authentication bypass vulnerabilities in Apache OFBiz (CVE-2023-51467 and CVE-2023-49070). The main exploit script (exploit.py) can both scan for vulnerable instances and execute arbitrary commands on a compromised server by leveraging a Java deserialization attack using ysoserial's CommonsBeanutils1 gadget. The exploit works by sending a specially crafted, base64-encoded Java serialized object to the /webtools/control/xmlrpc/ endpoint, exploiting the authentication bypass to achieve remote code execution. The detection script (xdetection.py) is a simplified version that only checks for vulnerability by probing the /webtools/control/ping endpoint. The repository is structured with clear separation between exploitation and detection, and requires the ysoserial-all.jar file for payload generation. The exploit targets Apache OFBiz instances accessible over HTTP/HTTPS and does not require authentication due to the nature of the vulnerabilities.

This repository contains a Go-based exploit for Apache OFBiz CVE-2023-51467. The main exploit logic resides in 'cve-2023-51467.go', which implements target validation, version detection, and exploitation routines. The exploit targets the '/webtools/control/ProgramExport/' HTTP endpoint of OFBiz, delivering a double base64-encoded Nashorn JavaScript reverse shell payload via a Groovy wrapper. The payload can be sent as an encrypted or unencrypted reverse shell, depending on configuration, and leverages Nashorn's ScriptEngine for in-memory execution. The exploit supports both direct Go compilation and Docker-based builds, as described in the Makefile and README. The repository is operational and provides a working exploit with customizable C2 options, targeting vulnerable Apache OFBiz instances accessible over the network.

This repository contains a Python exploit script (ofbiz_exploit.py) targeting authentication bypass and remote code execution vulnerabilities in Apache OFBiz versions prior to 18.12.10 (CVE-2023-49070 and CVE-2023-51467). The exploit works by sending specially crafted XML-RPC requests to the OFBiz 'webtools/control/xmlrpc' endpoint, leveraging a Java deserialization vulnerability via a payload generated by ysoserial (CommonsBeanutils1 gadget). The script supports two main actions: executing arbitrary commands (rce) and spawning a reverse shell (shell) to an attacker-controlled host. It also includes a function to check if the target is vulnerable by sending a request to the 'webtools/control/ping' endpoint. The repository consists of the main exploit script and a README with usage instructions and references. The exploit requires the ysoserial-all.jar file and Java to generate the payloads. No hardcoded IPs or domains are present, but the endpoints used are specific to the vulnerable OFBiz application.