WebLogic Vulnerability Series—Weak Passwords
【Research】WebLogic vulnerability series covering weak passwords, credential decryption, arbitrary file read exploitation, and webshell deployment.
Read in Chinese→【Research】WebLogic Vulnerability Series—Weak Passwords and Decryption
1. Environment
WebLogic version: 10.3.6 (11g)
Java version: 1.6
This environment simulates a real WebLogic environment where the admin console has a weak password and the front end contains an arbitrary file read vulnerability. These two vulnerabilities are used separately to simulate penetration of a WebLogic environment.
After starting the environment, access the WebLogic admin console at http://ip:7001/console
This environment uses the following weak credentials:
weblogic
Oracle@123
2. Principles
3. Affected Versions
WebLogic version: 10.3.6 (11g)
4. Exploitation Process
After starting the environment, access the WebLogic admin console at http://ip:7001/console
This environment uses the following weak credentials:
weblogic
Oracle@123
Exploiting the Arbitrary File Read Vulnerability
Assuming there is no weak password, how can WebLogic be penetrated?
The environment’s front end simulates an arbitrary file download vulnerability. Access http://IP:7001/hello/file.jsp\?path=/etc/passwd可见成功读取passwd文件。
Read the admin user’s encrypted credentials and key file
WebLogic passwords are encrypted using AES (3DES in older versions). Symmetric encryption can be decrypted as long as the user’s ciphertext and the encryption key can be obtained. Both files are located under base_domain and are named SerializedSystemIni.dat and config.xml. In this environment, they are located at ./security/SerializedSystemIni.dat and ./config/config.xml (relative to the current directory /root/Oracle/Middleware/user_projects/domains/base_domain).
SerializedSystemIni.dat is a binary file, so it must be read using Burp Suite. Downloading it directly with a browser may introduce extraneous characters. In Burp, select the retrieved string of garbled characters, right-click, and choose Copy to file to save it as a file:
GET /hello/file.jsp?path=./security/SerializedSystemIni.dat
上传war包。值得注意的是，我们平时tomcat用的war包不一定能够成功，你可以将你的webshell放到本项目的web/hello.war这个压缩包中，再上传。上传成功后点下一步。
The final path is http://10.77.0.130:7001//zydx666godz/godz.jsp\?o=vLogin
