前言
有时候拿到weblogic能命令执行，但是目标不能出网，不方便直接上线，这时就需要上个webshell来辅助后续的渗透
但是weblogic的web路径可能和常规的web系统不一样，不清楚的时候可能会一脸懵逼不知道上传到哪个目录下，以及如何访问，所以记录一下
漏洞点
路径
路径1：写入bea_wls_internal目录
自己根据需要对照修改，命令执行的时候一般在目录sv0下
E:APPMiddlewareOracle_Homeuser_projectsdomainssv0serversAdminServertmp_WL_internalbea_wls_internal6位随机字符warshell.jsp
/bea_wls_internal/shell.jsp
路径2：写入console images目录
这个shell不是写在AdminServer下，需要能访问到console
E:APPMiddlewareOracle_Homewlserverserverlibconsoleappwebappframeworkskinswlsconsoleimages
/console/framework/skins/wlsconsole/images/shell.jsp
路径3：写入uddiexplorer目录
和路径1类似，只不过这里是uddiexplorer罢了
E:APPMiddlewareOracle_Homeuser_projectsdomainssv0serversAdminServertmp_WL_internaluddiexplorer6位随机字符warshell.jsp
路径4：写入应用安装目录
E:APPMiddlewareOracle_Homeuser_projectsdomainssv0serversAdminServertmp_WL_user项目名6位随机字符warshell.jsp
shell无法访问
有时候上传的shell无法访问，大概率是因为端口不对，weblogic不同端口开放的server也不一样，找一找能访问的端口的server即可。
主要查看weblogic的配置文件domainssv0configconfig.xml
version='1.0' encoding='UTF-8'?><domain xmlns="http://xmlns.oracle.com/weblogic/domain" xmlns:sec="http://xmlns.oracle.com/weblogic/security" xmlns:wls="http://xmlns.oracle.com/weblogic/security/wls" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/weblogic/security/xacml http://xmlns.oracle.com/weblogic/security/xacml/1.0/xacml.xsd http://xmlns.oracle.com/weblogic/security/providers/passwordvalidator http://xmlns.oracle.com/weblogic/security/providers/passwordvalidator/1.0/passwordvalidator.xsd http://xmlns.oracle.com/weblogic/domain http://xmlns.oracle.com/weblogic/1.0/domain.xsd http://xmlns.oracle.com/weblogic/security http://xmlns.oracle.com/weblogic/1.0/security.xsd http://xmlns.oracle.com/weblogic/security/wls http://xmlns.oracle.com/weblogic/security/wls/1.0/wls.xsd"> <name>sv0name> <domain-version>12.1.2.0.0domain-version> <security-configuration> <name>sv0name> <realm> <sec:authentication-provider xsi:type="wls:default-authenticatorType"> <sec:name>DefaultAuthenticatorsec:name>sec:authentication-provider> <sec:authentication-provider xsi:type="wls:default-identity-asserterType"> <sec:name>DefaultIdentityAssertersec:name> <sec:active-type>AuthenticatedUsersec:active-type>sec:authentication-provider> <sec:role-mapper xmlns:xac="http://xmlns.oracle.com/weblogic/security/xacml" xsi:type="xac:xacml-role-mapperType"> <sec:name>XACMLRoleMappersec:name>sec:role-mapper> <sec:authorizer xmlns:xac="http://xmlns.oracle.com/weblogic/security/xacml" xsi:type="xac:xacml-authorizerType"> <sec:name>XACMLAuthorizersec:name>sec:authorizer> <sec:adjudicator xsi:type="wls:default-adjudicatorType"> <sec:name>DefaultAdjudicatorsec:name>sec:adjudicator> <sec:credential-mapper xsi:type="wls:default-credential-mapperType"> <sec:name>DefaultCredentialMappersec:name>sec:credential-mapper> <sec:cert-path-provider xsi:type="wls:web-logic-cert-path-providerType"> <sec:name>WebLogicCertPathProvidersec:name>sec:cert-path-provider> <sec:cert-path-builder>WebLogicCertPathProvidersec:cert-path-builder> <sec:name>myrealmsec:name> <sec:password-validator xmlns:pas="http://xmlns.oracle.com/weblogic/security/providers/passwordvalidator" xsi:type="pas:system-password-validatorType"> <sec:name>SystemPasswordValidatorsec:name> <pas:min-password-length>8pas:min-password-length> <pas:min-numeric-or-special-characters>1pas:min-numeric-or-special-characters>sec:password-validator>realm> <default-realm>myrealmdefault-realm> <credential-encrypted>{AES}xxxcredential-encrypted> <node-manager-username>weblogicnode-manager-username> <node-manager-password-encrypted>{AES}xxxnode-manager-password-encrypted>security-configuration> <server> <name>AdminServername> <ssl> <name>AdminServername> <listen-port>7002listen-port>ssl> <listen-port>8002listen-port> <listen-address>listen-address>server> <embedded-ldap> <name>sv0name> <credential-encrypted>{AES}xxxcredential-encrypted>embedded-ldap> <configuration-version>12.1.2.0.0configuration-version> <app-deployment> <name>sv0name> <target>AdminServertarget> <module-type>earmodule-type> <source-path>D:testapplicationssv0source-path> <security-dd-model>DDOnlysecurity-dd-model> <staging-mode xsi:nil="true">staging-mode> <plan-staging-mode xsi:nil="true">plan-staging-mode> <cache-in-app-directory>falsecache-in-app-directory>app-deployment> <app-deployment> <name>indexname> <target>AdminServertarget> <module-type xsi:nil="true">module-type> <source-path>D:testapplicationsindexsource-path> <security-dd-model>DDOnlysecurity-dd-model> <staging-mode xsi:nil="true">staging-mode> <plan-staging-mode xsi:nil="true">plan-staging-mode> <cache-in-app-directory>falsecache-in-app-directory>app-deployment> <app-deployment> <name>softwarename> <target>AdminServertarget> <module-type xsi:nil="true">module-type> <source-path>D:testsoftwaresource-path> <security-dd-model>DDOnlysecurity-dd-model> <staging-mode xsi:nil="true">staging-mode> <plan-staging-mode xsi:nil="true">plan-staging-mode> <cache-in-app-directory>falsecache-in-app-directory>app-deployment> <app-deployment> <name>doasname> <target>AdminServertarget> <module-type>warmodule-type> <source-path>serversAdminServeruploaddddd.warsource-path> <security-dd-model>DDOnlysecurity-dd-model> <staging-mode xsi:nil="true">staging-mode> <plan-staging-mode xsi:nil="true">plan-staging-mode> <cache-in-app-directory>falsecache-in-app-directory>app-deployment> <app-deployment> <name>tniqname> <target>AdminServertarget> <module-type>warmodule-type> <source-path>serversAdminServeruploadtttt.warsource-path> <security-dd-model>DDOnlysecurity-dd-model> <staging-mode xsi:nil="true">staging-mode> <plan-staging-mode xsi:nil="true">plan-staging-mode> <cache-in-app-directory>falsecache-in-app-directory>app-deployment> <admin-server-name>AdminServeradmin-server-name>domain>
如上配置只有AdminServer，所以我们写到AdminServer下都可以访问，如果配置了其他Server，则就需要根据端口开放情况写到其他的目录下
E:APPMiddlewareOracle_Homeuser_projectsdomainssv0servers其他Server
原文始发于微信公众号（安全宇宙）：【创宇小课堂】渗透测试-Weblogic上传shell路径
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
点赞
https://cn-sec.com/archives/1014614.html
复制链接
复制链接
-
左青龙
- 微信扫一扫
-
-
右白虎
- 微信扫一扫
-
评论